All release notes
Platform
Command palette, EPSS fixes, and scoped locks
Performance improvements, false-positive suppression, and operational fixes: global Cmd+K search, @mentions autocomplete, configurable agent offline threshold, comprehensive EPSS scoring fixes, scoped parallel correlation locks, and a full audit trail for automatic engine actions.
New
- Global Cmd+K search: search across risks, devices, clients, tickets, and CVEs in a single modal from any page in the platform.
- @Mentions autocomplete: a dropdown appears when typing @ in risk notes, filters available users, and inserts the completed @username on selection.
- Configurable agent offline threshold: the period after which a device is marked offline is now configurable from Partner Settings, falling back to 20 minutes if not set.
Improved
- SECAI enrichment 7-day cache: CVEs enriched in the past 7 days are not reprocessed during correlation runs, manual edits, or EPSS rescores.
- EPSS scoring formula made continuous: step buckets replaced with a proportional formula so every EPSS change now has a proportional effect on risk scores.
- EPSS spike detection threshold improved: now triggers when a CVE jumps from low exploitation probability to actively dangerous, not on incremental high-range movement.
- EPSS de-escalation: when EPSS drops significantly, risk scoring is recalculated; automatic rescoring now works in both directions.
- EPSS staleness visible: a tooltip on the EPSS display block on the risk detail page shows the date of the last update so users can assess data freshness before acting.
- Correlation lock scoped per device / client / global: individual device scans can now run in parallel without blocking each other.
- Correlation audit trail: the engine now creates risk notes on automatic mitigation and reopen events; engine actions are distinguishable from user actions.
- Auto-reopen notification: when the engine reopens a user-mitigated risk, the assigned user receives a notification.
- Correlation key stability: rules are sorted by vendor and product before key generation; repeated enrichment updates no longer produce accumulated ghost risks.
- Loopback port risks suppressed: ports bound to localhost are never reported as an exposure.
- Known-safe applications excluded from port risk analysis: collaboration tools, cloud sync clients, password managers, and hardware utilities are recognised as benign.
- False mitigation guard: recent-only or per-device correlation runs no longer mitigate risks when older CVEs were simply not in scope.
- Windows build version matching improved: version strings such as 21H2 and 22H2 are now correctly compared during CVE correlation.
- Dashboard portfolio view cleaned up: legacy stat cards removed; the 'Top 3 most at-risk clients' banner is only shown when critical risks actually exist.
- Device change event log retention: records older than 30 days are automatically pruned.
- CVE resync survives restarts: the resync schedule is persisted and restored on every process start.
Fixed
- Remediation verification was reading the wrong field and never identified mitigated risks; fixed by reading from correlation metadata instead of deleted risk assets.
- Rate-limiter availability is now logged on first failure and on recovery, so operators know when distributed rate limiting is inactive.