Identity and Device Mesh: turning 15 identical alerts into 3 critical incidents

Gal Baron Eliran , Elad Elouz

| Last updated: Oct 7, 2026

AI agents investigating alerts trace a laptop to its owner and everything that person can reach. Each hop requires matching records across tools, a link no vendor publishes. Identity Mesh and Device Mesh resolve those links in advance.

Where agent reasoning breaks: records that never connect

An agent investigating an alert follows a chain across systems. The alert lives in the EDR, the owner in the identity provider, the privilege in the cloud and the business function in HR. Each step depends on knowing which records describe the same host or person, and that link is harder to make than it sounds. A single laptop appears as a host in the EDR, an enrolled device in the MDM, a registered device in the identity provider and a posture record in the Zero Trust agent, with no shared key between them.

When the link is missing, the model fills the gap with the most statistically plausible entity mapping, such as matching a host to a user by name similarity. In the final report, that inferred link looks exactly like a verified one. 

Asking the agent to resolve entities at question time therefore has two costs. It repeats the most expensive part of the work on every question, and it only covers whatever sample of records the budget allows.

Resolving entities before the agent asks

The Sola Security Brain keeps a graph of the organization’s security-relevant state, and it handles this step ahead of time with two mesh layers:

• Device Mesh links records that describe the same machine across protection, device management, identity-provider device inventories, cloud virtual machines and servers, observability agents, Zero Trust clients and AI coding tools.
• Identity Mesh links records that describe the same person across identity providers, cloud IAM and identity centres, HR and finance, collaboration and source control, security tooling, AI platforms, Zero Trust access and business applications.

Both layers match on identifiers vendors already expose, such as serial numbers or assigned-user fields. Every matching rule goes through three stages:

1. Agentic investigation. An agent proposes candidate patterns.
2. Data hit validation. We test each candidate against live data.
3. Human in the loop. A person confirms each link means what it claims.

Approved patterns run on every sync. When the agent reports a relationship, it backs it with a retrieved link, and it says so when none exists.

What our research showed about identical alerts

The test

We staged a case where the alerts alone give an agent nothing to work with. Eleven employees each downloaded a well-known privilege escalation assessment script to their own laptop, some more than once. The result was 15 real EDR detections across 11 endpoints, all with the same name, severity and command line.

We then asked the Sola agent three things in plain language, with no hint of how to join the data:

• identify the identity behind each host
• find what they can access elsewhere
• rank the incidents by risk to the organization

The results

Most laptops resolved to their owners through serial numbers in the identity provider. One laptop the identity provider had never seen resolved through the Zero Trust agent instead.

Before following anyone further, the agent applied org context, the facts no connected system holds. It marked two people critical regardless of the severity the EDR assigned: the IT manager, who holds admin access across nearly every system, and the COO.

Following each person across the Identity Mesh changed the picture entirely. Behind identical alerts sat:

• administrators of both identity planes
• owners of cloud, source control and AI platforms
• a CRM administrator
• an executive whose cloud access reached decrypt permissions on the keys protecting stored data

Org context set the floor, marking the executive and the IT owner critical regardless of technical severity. Resolved privilege set the order, and a security engineer reached the critical tier on privilege alone. The 11 endpoints sorted into 3 critical, 3 high and 5 lower priority, with no rule written for the incident.

What a resolved enterprise means for security teams

The Security Brain pays for resolution once, on sync, and every question reuses it. The same links that ranked these detections also answer who owns a workload or what a compromised account could touch. Org context adds what no connected system knows, such as who runs the business, so alerts rank by risk to the organization instead of by the severity a single tool assigns.

Resolution only covers the systems you connect, and the mesh makes the edges of that coverage visible. The demonstration is a single staged case on our own employee laptops, and the full paper covers the method in depth.

When an agent working over the mesh reports a connection, it is reading one. When it cannot find one, it says so.