Boston, Massachusetts, Oct. 08, 2026 (GLOBE NEWSWIRE) -- HYCU, Inc., the #1 AI Resilience company, today announced the general availability of HYCU® aiR Graph™, a free solution that discovers the AI agents operating across an organization's applications, shows which workloads each agent can reach and who can invoke it, and identifies which of those applications lack independent backup. Agents increasingly run with broad permissions and write access to systems of record. A misconfigured instruction, a compromised credential, or an agent acting outside its intended scope can change or delete data across multiple applications at machine speed. Where those applications have no independent backup, that data cannot be recovered. aiR Graph connects read-only to Microsoft Entra ID and Okta and is available to any organization, whether or not it is a HYCU customer.
The first question IT and security teams may face is: how many agents are running, and what can they touch? This is often hard to answer. Business units connect copilots and create agents faster than IT can track them, and a periodic inventory is out of date before it is finished. aiR Graph answers that question from the first scan. It then answers the one that matters when an agent gets it wrong: can the organization recover the data?
"Every organization we talk to is adding AI agents faster than it can count them, and most of those agents hold permissions nobody regularly inspects," said Simon Taylor, Founder and CEO, HYCU, Inc. "If you can't see it, you can't protect it. aiR Graph gives any organization that first look for free. It shows which agents can change or delete data, and which of the applications they reach have no independent copy to recover from. That second answer is where resilience starts."
How HYCU aiR Graph works
aiR Graph follows the order a security or IT team would work through the problem: find the agents, judge what they can do, then protect what they can reach.
- First Supported Discovery Sources for Read-only Connection to Identity: aiR Graph connects read-only to Microsoft Entra ID, including Microsoft Entra Agent ID where it is enabled, and to Okta, including Okta AI Agents where the organization subscribes. Entra ID and Okta are the first supported discovery sources, and HYCU will be adding more.
- Discovery of Applications and Agents. The first scan maps the total applications in the organization and flags all copilots and agents in the organization.
- What Each Agent Can Reach, and Who Can Invoke It. For every agent, aiR Graph shows its OAuth scopes, the data sources it can read or write, whether it has organization-wide access, whether it can act unattended, how many users can invoke it, and whether anyone is recorded as its owner or sponsor.
- Findings to Act On. Severity reflects capability, not just ownership. The more an agent can reach and change, the higher it ranks: unattended access to every user's data, broad access combined with write or delete permissions, or an account still enabled after its agent identity was deleted.
- From Exposure to Protection. aiR Graph shows which applications agents reach most and which of those HYCU R-Cloud can protect, so teams can back up the systems of record most exposed to agent activity first.
- Assessment Report. One click produces a point-in-time report with an executive summary, recommended triage actions, and a full inventory for management, audit, or board review.
Once aiR Graph shows that an agent can write to a Git repository, a Salesforce org, or a Confluence space, the next step is an independent, immutable backup of that application in HYCU R-Cloud, which protects more than 100 workloads. That copy is what lets an organization roll back to the moment before an agent went wrong.
From Preview to General Availability
HYCU gave the first public look of aiR Graph at the 69th IT Press Tour in Ljubljana, Slovenia, home to one of HYCU's main engineering centers. Since then, a select number of customers have run aiR Graph in preview.
"We made a deliberate choice to keep language models out of the risk assessment," said Anant Chintamaneni, Chief Product Officer, HYCU, Inc. "Every finding in aiR Graph comes from an explicit rule applied to data read from your identity provider. Run it twice on the same tenant, and you get the same answer, and every finding traces back to the field that produced it. When a security team takes that report to an auditor or a board, it has to hold up."
Availability
HYCU aiR Graph is generally available today at no cost, directly from HYCU and through HYCU's global partner network. Organizations can connect Microsoft Entra ID or Okta and run their first assessment at aiR Graph. aiR Graph is part of HYCU® aiR™, which lets organizations search, query, and run purpose-built agents across their backup data. To join the aiR early adopter program, visit https://www.hycu.com/air.
To learn more about HYCU, visit www.hycu.com. Follow us on X (formerly Twitter), connect with us on LinkedIn, Facebook, Instagram, BlueSky, TikTok, and YouTube.
What The Industry is Saying About HYCU aiR Graph
"It used to be that IT had to protect against bad actors and your mistakes. But today, the agentic extensions of you (authorized to act on your behalf) can modify or delete your organization's data in ways you never intended. They can do it at speeds that no human can catch," said Jason Buffington, Principal Analyst, Data Protection Matters. "The answer has to start with IT understanding what all of the agentic extensions of you can access, so that controls can be implemented and the data can be protected. Mapping agent permissions against backup coverage is the gap assessment that most IT and security teams didn't realize they needed and will appreciate immediately."
"Authorized AI agents can become good, bad actors, using legitimate credentials to change or delete data at a speed and scale no human error ever reached," said Jerome Wendt, CEO and Principal Analyst, DCIG. "Knowing an agent can modify data in Salesforce, GitHub, or Confluence only identifies the risk. It does not mitigate it. HYCU aiR Graph connects agent governance with SaaS data protection, so organizations can stop asking only which agents can delete data and start asking which exposed applications need backup now."
“Application environments are the new unit of resilience,” said Don Gentile, Analyst, Data Platforms and Resiliency, HyperFRAME Research. “Business processes span multiple applications, data sources, identities and infrastructure. AI agents add autonomous action at machine speed, with the ability to change state across several systems during a single workflow. Restoring one application can leave other applications, data and dependencies at different points in that workflow. aiR Graph gives organizations visibility into the agents, identities and privileges acting across those systems and connects that exposure with applications that require recoverable state.”
"SaaS vendors have always been clear that protecting your data is your job," said Johnny Yu, Research Manager, Storage and Data Management, Enterprise Infrastructure, IDC. "What's changed is who's touching it. When an AI agent with write access makes a mistake, the platform will do exactly what it was told, and if there's no independent backup, that's the end of the story. Mapping agent permissions against backup coverage is the gap assessment most IT and security teams don't yet know they need."
"Agentic AI changes the risk model for data protection. The question is no longer only whether an application is backed up, but which non-human identities can modify it and how fast," said Philippe Nicolas, Analyst and Market Watcher, Coldago Research. "aiR Graph addresses this by correlating identity data from Entra ID and Okta with protection coverage, and its extensible design for additional discovery sources is a correct architecture for a market that will not standardize on a single identity provider."
###
About HYCU
HYCU, Inc. is the #1 AI Resilience Company that protects, uncovers, and recovers the data that runs your business. With one platform covering more than 100 workloads across AI systems, SaaS applications, cloud environments, and onpremises infrastructure, HYCU reduces cost for customers by eliminating complex, out-of-phase data protection operations. With HYCU R-Cloud, customers protect any workload, recover data to a location of their choice, and connect and correlate that data to streamline compliance and governance processes. When disruption occurs, customers safely and securely resume operations quickly and efficiently, achieving true AI data resilience. Based in Boston, HYCU is trusted by thousands of enterprises and government agencies worldwide.
Attachment
Don Jennings HYCU, Inc. 617-791-1710 don.jennings@hycu.com