Sola-Visibility-ISPM: Benchmarking Agentic AI for Identity Security Posture Management Visibility

TL;DR

The paper introduces the Sola Visibility ISPM Benchmark, the first benchmark to evaluate agentic AI on foundational ISPM visibility tasks using production data from AWS, Okta, and Google Workspace. It combines a live dataset, a tool-using AI agent, and a four-stage evaluation including expert scoring and LLM-based judgment to measure accuracy, reasoning quality, and evidence grounding. Key findings show strong performance overall, particularly on AWS hygiene tasks, with important roles for data grounding and pattern adaptation in achieving correct, verifiable results. The work establishes a practical, reproducible baseline for agentic ISPM evaluation and outlines a roadmap to broaden ISPM coverage to cross-system correlation, behavioral analytics, risk scoring, and governance-aligned reasoning.

Abstract

Identity Security Posture Management (ISPM) is a core challenge for modern enterprises operating across cloud and SaaS environments. Answering basic ISPM visibility questions, such as understanding identity inventory and configuration hygiene, requires interpreting complex identity data, motivating growing interest in agentic AI systems. Despite this interest, there is currently no standardized way to evaluate how well such systems perform ISPM visibility tasks on real enterprise data. We introduce the Sola Visibility ISPM Benchmark, the first benchmark designed to evaluate agentic AI systems on foundational ISPM visibility tasks using a live, production-grade identity environment spanning AWS, Okta, and Google Workspace. The benchmark focuses on identity inventory and hygiene questions and is accompanied by the Sola AI Agent, a tool-using agent that translates natural-language queries into executable data exploration steps and produces verifiable, evidence-backed answers. Across 77 benchmark questions, the agent achieves strong overall performance, with an expert accuracy of 0.84 and a strict success rate of 0.77. Performance is highest on AWS hygiene tasks, where expert accuracy reaches 0.94, while results on Google Workspace and Okta hygiene tasks are more moderate, yet competitive. Overall, this work provides a practical and reproducible benchmark for evaluating agentic AI systems in identity security and establishes a foundation for future ISPM benchmarks covering more advanced identity analysis and governance tasks.

Figures (2)

• Figure 1: SOLA AI Agent Conceptual Architecture
• Figure 2: Sola ISPM Visibility Evaluation Framework