All release notes
Platform
Accepted risk, EPSS scoring, and remediation verification
Major feature sprint across the full stack: accepted risk workflow with auto-expiry, EPSS exploit-probability scoring, automatic risk escalation on CVE data changes, a new software inventory page, remediation verification, session timeout enforcement, AI-powered CVE risk enrichment, and expanded Defender telemetry.
New
- Accepted Risk workflow: risks can be formally accepted with a business justification, compensating controls, and an expiry date. Accepted risks automatically reopen to Open when the acceptance expires; the assignee is notified.
- EPSS scoring integrated from FIRST.org (no API key required): each CVE receives a daily-updated exploit probability score and percentile. Scores contribute to risk scoring; an EPSS spike (increase ≥ 0.3 with new value ≥ 0.7) immediately escalates linked open risks to Critical.
- Automatic risk rescoring on CVE data changes: risks linked to CVEs that increase in CVSS score are rescored upward automatically. Risks linked to CVEs newly added to the CISA KEV catalogue are immediately escalated to Critical. Downgrading always requires manual action.
- Software Inventory page: aggregates installed software across all devices in scope, grouped by name, version, and publisher with device counts and an expandable device list. Supports search and OS-type filtering. Added to the sidebar under Infrastructure.
- Remediation verification: after each inventory, the platform checks whether software linked to closed CVE_MATCH risks is still present. If so, the risk is automatically reopened with a note and the assignee is notified.
- Partner Settings page: partner admins can now manage their own partner information (name, contact, website, address) and ticket settings from a dedicated two-tab page.
- Session timeout enforcement at the API level: every authenticated request checks activity against a server-side activity record. Requests that exceed the configured inactivity timeout are rejected and the session is cleared.
- Defender sub-protection states tracked: eight granular Windows Defender preference settings and GPO registry overrides are now collected and mapped to risk severity (Realtime/behavior → Critical; script scan/IOAV/cloud → High; network IPS/archive → Medium).
- Defender scan recency: quick and full scan age, last scan timestamps, and signature age are now collected and feed two new compliance checks (signatures_current and scan_recent) into the device compliance score.
- AI-powered CVE risk enrichment: after a CVE risk is created, the platform asynchronously generates a structured analysis (overview, root cause, attack chain, impact, affected versions, remediation) stored in risk metadata. Failures are silently skipped; risk creation is never blocked.
- CVE correlation normalization pipeline upgraded to a 7-step cascade with a token-based fuzzy fallback at ≥ 0.7 confidence and a learned_aliases feedback loop for AI-resolved matches.
- Login page background replaced with a real-time WebGL volumetric god-ray effect: a 24-ray fan with Perlin-noise shimmer, radial halo, and 26 dust particles visible only inside the ray cone.
Improved
- Ticket list default view no longer includes completed tickets. Completed tickets remain accessible via the dedicated Completed sidebar filter.
- Report PDF blank pages reduced via improved page break thresholds and title truncation at 120 characters.