All release notes
Platform
A check engine, Defender alerts, and a heartbeat that stopped being rejected
A broad release whose heaviest item was a fault nobody could see: devices reporting an administrative logon, an account change, a USB insertion or a DNS anomaly had their entire heartbeat rejected, losing that whole cycle of inventory, ports and posture. Beyond that, the custom-rule evaluator becomes a check engine that knows the difference between false and unmeasurable, Microsoft 365 starts opening investigations instead of stacking up posture findings, and Defender alerts arrive for threats an endpoint agent cannot see by definition. Read the Changed section: several items visibly alter what a client reads on screen once you upgrade.
New
- The custom-rule evaluator becomes a check engine. The evaluator was boolean and resolved an unreadable field path to nothing. Three operators read that nothing as a match, so a rule could pass on data that was never measured. A verdict now has three states, pass, fail and not assessable, and the last of those is not a silent match. Thresholds are versioned data, checks are grouped into categories, and a preset that cannot be assessed says so.
- Defender alerts for threats the agent cannot see: an agent watches files and processes on a device and cannot observe a phishing message detonated in the mail environment, while email is the most common initial access route there is. A tenant with a Microsoft 365 connection and no agents deployed therefore had no malware visibility at all. Alerts from the unified Defender feed now arrive on the same quarter-hour cycle as the rest.
- Microsoft 365 produces investigations, not only findings: an account takeover confirmed by an administrator in Entra previously produced a posture finding that queued beside an expiring application secret, with no triage clock, no evidence trail and no agreed response time, for the most serious verdict identity security can reach. Those cases now open an investigation.
- Network posture becomes a questionnaire about the firewall rather than four selects on a location. The four axes behind scoring used to be asked for directly, which asks an administrator to translate their network into our vocabulary and to decide for themselves whether their setup counts as zero trust. People answer that question with what they aspire to, not with what is configured, and nothing on the form said what any answer would do. The axes are now derived from questions about the network itself.
- Portfolio Intelligence rebuilt around two objects, a threat and a client, so no entity appears twice on the page. The dashboard listed the same clients three times and the same CVEs twice, and every repeat carried exactly one extra column of data, which is the tell: each was a column, not a panel.
- The Customize Dashboard control now customizes the dashboard you are looking at, instead of opening a separate, empty canvas. It is an edit mode on the page itself: the bar lists the panels of this view, and unticking one hides it, stored per user.
- Watching a risk becomes a plan rather than a bookmark. Watching recorded a row and did nothing else, while the planner stood apart and had to be filled in by hand. Watching now seeds a private task for the watcher that stays true to the risk for as long as the user has not edited it.
- Vacation mode for the Microsoft 365 sign-in country policy: the policy had exactly two settings per country, permanently allowed or a finding every time somebody takes a holiday. In practice administrators widen the list and never narrow it again, which is the worst of both outcomes. A vacation window is a time-boxed, country-scoped exemption that closes itself.
- Recurring background work gets an owner. Fifteen services each kept their own timer, which meant a job whose cycle outgrew its interval started overlapping itself, with every copy competing for the same rows and the same processing capacity.
- A shared event spine: the events already existed, but emitting them and delivering them to integrations were the same act, so nothing else could ever listen without editing all eight calling sites. Integration delivery is now the first listener of many, with its behaviour unchanged.
- Drift in the CVE corpus became a number instead of a line in a log: the full outcome of a reconciliation run, with missing, stale and local-only counts, changed CVSS values and how many risks were rescored, is now retrievable rather than visible only to whoever happened to be watching.
Fixed
- A heartbeat was rejected outright as soon as the event-log sample carried certain fields. Eight fields were described server-side as counts while both agents have only ever sent lists, and because the sample is strictly validated it was not that one field that was dropped but the whole cycle. Every device reporting an administrative logon, an account change or lockout, a USB insertion, an NTLM network logon, an audit policy change or a DNS anomaly therefore lost the entire cycle: inventory, ports, security posture and process creations. The event most often behind this fires on essentially any administrative logon, so this was not a rare path.
- The Weekly and Monthly presets in the report scheduler emailed tenant reports every hour, and the configured timezone was ignored.
- Microsoft 365 MFA coverage counted users it had never measured, so the percentage read high, and not only when the data source refused the whole set.
- A maintenance window that ran across midnight stopped at midnight.
- Three Microsoft 365 polls dropped data and then moved the read cursor past it, so what was missed was never fetched again.
- Defender reported when an action succeeded and stayed silent when it failed.
- No queue could be filtered on more than one severity or status at a time.
- Removing software from a device removed a different package than the one selected.
- An incremental CVE sync could skip a CVE permanently.
- The breakdown of a risk score did not add up to the score it explained, and described that score inaccurately in parts.
- A mitigated CVE risk reopened for an unrelated CVE, because nothing recorded what a mitigation had actually covered.
- The incident report printed the playbook as a blank checklist, because the responder's notes were stored against the investigation and never read back.
- The agent compared the package manager's verdict against the wrong exit code, so a package that was simply already current was reported to the operator as a hard patch failure.
- Signing out of one tab left every other tab signed in.
- A browser with site data storage blocked broke the dashboard.
- Downloading a report as JSON never produced a file.
- Changing a filter kept the old page and the old bulk selection, so an action on a selection could affect something other than what was on screen.
- Three CVE filters searched only the twenty rows on screen, and the Microsoft 365 findings list showed a truncated count as the total.
- The number of correlation runs in a client report was a platform-wide figure.
- A package parked by the retry cap had no way back.
- Risks at informational severity were missing from the risk trends chart.
Security
- The platform had no self-service password recovery at all: the login page linked to an address that never existed server-side.
- The access token was carried in the notification stream URL, where it can reach logs and referrers.
- A tags endpoint returned every tenant's tags rather than only the caller's.
- Ticket comments and knowledge base articles rendered attacker-supplied HTML without neutralising it.
- A partner administrator could attach a new client to a rival partner.
- A scheduled report could be created against any tenant, and the matching listing query failed open and returned every tenant's scheduled reports and recipient lists.
- CSV exports of CVE and KEV data were open to spreadsheet formula injection.
- The confirmation on bulk user deletion was decorative, and the role picker offered roles the server refuses.
- The browser security policy allowed a WebSocket to any host on the internet, and a legacy security header re-enabled the very auditor that policy replaces.
- The agent re-reported the same memory finding on an unchanged process every cycle, and mistook legitimate system binaries for masquerading.
Changed
- The patching control in all five supported frameworks is tightened. A client with an outstanding critical patch on any single host will now read gap where it previously read compliant. That is the intended reading, and it is a visible change to a number customers see.
- Network posture moved to the firewall questionnaire and no previously stored classification was carried across. The new axes derive from questions the old column never asked, and inventing answers to reproduce an old classification would record a configuration nobody described. Every site scores against the documented defaults until its firewall is recorded. Review your locations.
- The portfolio dashboard loses the Client Risk Ranking, CVE Portfolio Impact, Herd Immunity Tracker and Top 3 Most At-Risk panels. Each was a second listing of something already on the page. Risk age and SLA and the risk trends leave both dashboards; the underlying data is untouched and still serves the risk pages.
- An accepted risk no longer appears in All Risks but under Closed, and returns to the list on its own once its acceptance expires.
- Two shipped rule presets will read as not assessable on devices that have never reported a security block. That is the correction working. Rules using nested condition groups will start producing findings they previously could not.