All release notes
Platform
Threat feed health, an exploit-driven risk heat map, and automation that says where it applies
A release about making the invisible visible. Every intel feed used to fail the same way, silently: a feed that was never configured, one broken for a month and one that was healthy but quiet all looked identical from the console. Feeds now report their own state, including the state that matters most, stale. The Risks page gains a heat map whose likelihood axis is built only from measurable exploit signals, plus a trend view of how the backlog and SLA performance have actually moved. The automation page is rebuilt so that where a rule applies is always explicit, and keyboard shortcuts, broader search and a calendar feed make the product faster to move around.
New
- A threat feed status panel covering every feed Secuno relies on: TAXII, VirusTotal, Shodan, dark web monitoring, CISA KEV, EPSS, GitHub advisories, CVE.org and NVD. Each shows a state, when it last succeeded, how many runs it has done, the exact error message when something goes wrong, and which setting switches it on. There are six states: not configured, disabled, never ran, OK, stale and error. Stale matters most, because a feed whose scheduler has stopped looks exactly like a healthy feed with nothing new to report. A failed run never moves the last-success time forward, so the panel cannot flatter a broken feed.
- Run now: the TAXII and Shodan pollers can be started from the panel, so after changing a key or a setting you can confirm it works straight away instead of waiting hours for the next cycle.
- A risk heat map: severity rows against four likelihood columns, where likelihood comes only from measurable exploit signals. Exploited in the wild means a linked CVE is on the CISA Known Exploited Vulnerabilities list. Likely means an EPSS score of ten percent or higher. Possible means CVE-backed below that. Manual, configuration and compliance risks go into an honest no exploit signal column instead of being given an invented medium likelihood. Hovering a column shows its exact rule, and clicking any cell opens the risks behind it.
- The heat map shows what is actionable. It covers the open queue only and leaves out low-confidence correlation matches, so the grid reflects risks you would actually work. If it reaches its row limit the panel says so, rather than quietly showing a partial picture.
- Age and SLA trends: how the open risk count, the overdue backlog and the average risk age changed over the last 30, 90 or 180 days, next to SLA compliance, which is the share of resolved risks closed before their due date. Periods with nothing to measure show no data rather than a misleading zero percent. The trends are reconstructed from dates your risks already record, so the full history is there from day one without a setup period, and the panel explains the two cases it cannot reconstruct exactly: reopened risks, and risks closed as accepted or false positive. The strip above the trends now shows the ageing statistics Secuno was already calculating but never displayed anywhere.
- Automation rules say where they apply. Rules and library installs now carry an explicit applies-to selector that defaults to a single client, and applying a rule across the whole platform is a deliberate choice with a warning about how many clients it will reach. Every rule card names its client, so the scope of any rule is visible at a glance. Previously, a rule created by a platform administrator could end up applying to every client without anyone choosing that.
- A per-client kill switch: halt or resume all automation for a single client from the page, with a clear banner while that client is halted. Useful during an incident, an onboarding or a planned change window.
- Every safety guard is editable. Runs per hour, data freshness, maximum devices per run, the fleet-fraction threshold and respect-maintenance-window can all be set from the rule form. Three of these could not be changed from anywhere before and were stuck at their defaults, even though they are exactly what decides whether a rule is held back for touching too much of a fleet.
- Promotion eligibility on the rule card, reading for example eligible in nine days after 24 evaluations and six matches, so how close a rule is to leaving report-only mode is visible without opening it. Alongside it, an activity feed of every rule evaluation, filterable by outcome and client, which answers what automation has actually been doing without opening rules one by one.
- Keyboard shortcuts. Press g, then d, r, i, v, p or t, to jump to Dashboard, Risks, Investigations, Devices, Patch Management or Tickets. Pressing n then r opens a new risk from any page, the forward slash opens search, and the question mark shows every shortcut. Shortcuts never fire while you are typing in a field, and investigation pages keep their own triage shortcuts.
- Global search covers more: investigations, risk notes shown as the risk they belong to with a snippet of the note, knowledge base articles respecting each article's visibility, and audit log entries for platform administrators. Where did someone write that down now has an answer from the search box.
- A calendar feed. Under your profile you can create a subscribe link for Outlook, Google Calendar or Apple Calendar carrying risk SLA due dates, investigation deadlines, task due dates, scheduled patches and acceptance expiries, from a week back to 60 days ahead, with events updating in place instead of duplicating. Calendar apps cannot sign in, so the link itself is the credential: it is shown once, stored only in hashed form, can be rotated or revoked at any time, and shows when it was last fetched. Access is checked on every sync, so if a user is deactivated or their role changes, their feed stops working on the next refresh.
- A Linux deployment package: the Linux agent, a configuration already bound to the client and an install script, from the same place as the Windows package, with an installation guide covering setup and day-to-day operation. A mass deployment guide covers rolling the agent out through Group Policy, Intune or your RMM, with an install script built for fleet rollouts that exits quietly if the agent is already installed and never overwrites an enrolled device's configuration. Size the enrollment token to the fleet first, because a deployment package's built-in token allows ten enrollments.
Changed
- Automation and Custom Risk Rules share one layout: metric cards, a search bar with status filters, and compact rows reading when, if and then with a coloured status accent. Executions link straight to the risk, case or patch they acted on, confirmations use proper dialogs, and users are chosen from pickers instead of pasted identifiers. Everything is still in the same place, it is just easier to scan.
- Linux devices speak Linux. A Linux device page now shows OS package updates, flatpak and snap, LUKS disk encryption, firewall, scanner exclusions and agent tamper protection, instead of Windows labels.
Fixed
- Three intel results that read as clean when they were not. A dark web scan that stopped because of an invalid API key recorded itself as a clean scan. A Shodan sweep where every lookup failed, for example after a key was revoked, read as no exposed hosts. A TAXII feed that pulled data and then discarded all of it looked healthy. All three now show as the errors they are.
- Linux agents were being offered the Windows update. They correctly refused it, but that meant Linux self-update never worked at all. The release manifest now carries a separate Linux release, and each device is offered the one for its own platform.
Security
- Global search could return other clients' records, high severity. For partner accounts, global search did not correctly apply client boundaries, so results could include risk titles, device hostnames and ticket subjects belonging to other clients. No credentials or secrets were exposed. Search now uses the same shared access check as the rest of the platform, which limits partners to their own and linked clients, and automated tests lock that behaviour in place.