Identity security announcements, June to September 2026: a recap by theme

Published 2026-09-29 · NextGen Identity Security desk · 4 min read

This recap covers announcements dated from 15 June to 22 September 2026, grouped by theme rather than by date. Most of them also appear on our news page, and each links to the original source. It was written on 29 September 2026 and adds nothing the sources do not say.

Agent identity moved from roadmap to product

The largest cluster of news concerned identities for AI agents. On 22 September 2026 Okta listed Agent SSO, which issues short-lived tokens, and Agent-to-Agent Connections as generally available. In the same announcement Agent Gateway and Shadow AI Agent Discovery for Endpoints were announced on 22 September 2026 as planned for Q3 2026 (https://www.okta.com/newsroom/press-releases/ai-innovations-oktane-2026/), and Configuration Designer and expanded Kill Switch capabilities for Q4 2026.

Ping Identity made two announcements in the period. On 16 June 2026 it announced integrations with AWS, Google Cloud and Cloudflare that extend its Runtime Identity for AI agents, with continuous authorization and policy enforcement across cloud and edge environments. On 1 September 2026 it announced Enterprise Personal Agent Access, which applies identity and authorization policy at runtime to discover, control and monitor personal AI agents such as Claude.

NewCore came out of stealth on 15 June 2026 with $66M from Cyberstarts, Index Ventures and Evolution Equity Partners. It describes itself as an identity provider for humans and AI agents, with a coexistence model that preserves existing federations and policies.

Read together, these announcements point the same way: agents get identities of their own, short-lived credentials and checks at the moment they act. The differences are in timing and in where the check sits, which are the points the AI agent security page scores.

A reference document for token protection

On 15 September 2026 NIST published the final version of IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. The draft had appeared on 22 December 2025. The report gives recommendations for identity providers, authorization servers, key management and token verification. The next day the OpenID Foundation wrote that the report recommends two of its specifications, the Shared Signals Framework and the Continuous Access Evaluation Profile.

For buyers, IR 8587 is useful because it turns a general worry about stolen or forged tokens into controls that can be asked about. Our lesson on token theft and forgery walks through them.

An industry reference architecture for agents

Also on 22 September 2026, Okta and companies including AWS, CrowdStrike, Databricks, Docker, Google Cloud, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler formed the Blueprint Alliance. They published a reference architecture built around four questions: where agents are, what they can do, what they are doing and how to respond.

Changes of ownership and board appointments

Astrix Security, a non-human identity vendor now part of Cisco, states that it ended standalone sales of new licenses effective 30 June 2026, and that existing customers keep the service in their current agreements. That is why Astrix is not scored on the non-human identities page.

On 15 September 2026 NewCore announced that Joy Chik, previously President of the Identity and Network Access Business at Microsoft, had joined its board of directors. On 18 September 2026 Okta named Helen Riley, CFO and COO at X, Alphabet's research subsidiary, to its board.

Two earlier items, for context

On 27 May 2026 Ping announced Programmable Identity through MCP, CLI and APIs, agent discovery features and Privileged Access for Desktop Agents, noting that availability may vary by product, region or deployment model. On 13 May 2026 the OWASP GenAI Security Project published an article on ASI06, Memory and Context Poisoning, one entry in the OWASP Top 10 for Agentic Applications published in December 2025.

What to do with this

• If you run Okta, check which of the agent features you need are generally available and which are planned, and time pilots to the dates Okta has published.
• If you are evaluating agent identity products, ask each vendor where its per-call check sits and whether it is available now.
• Read NIST IR 8587's recommendations against your identity provider's token lifetimes and signing-key protection.
• For non-human identity tools, confirm how each vendor is sold today, given the ownership changes in the category.