Secuno
ENNL
Book demo
All release notes
Platform

Patch management end to end, two detection engines that learn, and a real service desk

v0.0.57Major

The largest release the product has had. Patch management finishes as a deployment-safety model rather than an approval queue: soak periods, ordered rollout rings, rollback and pinning, and per-device exclusions. Two new detection engines arrive, one that learns what is ordinary on each individual device and one that clusters the same activity across many hosts before anything is judged. Risk severity now lands in the band CVSS itself assigns, which will move counts on upgrade. The service desk turns from a ticket table into the surface the work is done on. The Linux agent gains the detection engine it had been shipping without, and four classes of false positive that were burying the risk queue are traced and closed.

New

  • Approval waiting periods: a patch can auto-approve after a soak period you set per client and per severity, so a vendor pulling a bad update inside its first 72 hours never reaches your estate. Approval only arms a patch. The maintenance window still decides when it actually lands.
  • Rollout rings: deployment moves in ordered stages with a verdict recorded per ring per update. The soak verdict reads eligible, reported and succeeded devices separately, so nothing came back can never be mistaken for everything worked. A ring that fails does so immediately rather than at the end of its soak, and a ring that goes silent is treated as a warning sign rather than a pass.
  • Rollback, version pinning and per-device blocks: a third-party package can be rolled back to a named earlier version and pinned, so an auto-update never walks a deliberate downgrade forward again. Windows Update rollback is scoped honestly to the updates Windows itself allows to be removed, and the agent reports which those are instead of promising a rollback it cannot perform. A single device can be excluded from a patch without withdrawing approval for the rest of the estate.
  • Windows updates carry their CVEs: KB numbers are mapped to the vulnerabilities they fix from Microsoft's own security update feed, so a Windows patch and a vulnerability finding are finally the same conversation. Third-party patch coverage is now reported as a share rather than a raw count, because the agent reports every installed package it can match to a manifest: the denominator the product could not previously state.
  • Superseded updates retire themselves. Windows Update never announces that an update is superseded, it simply stops offering it. The catalogue now retires an update a device stopped reporting only when the scan genuinely succeeded, ran online and was not truncated, because a broken Windows Update Agent looks exactly like a fully patched device.
  • A per-device behavioural baseline: every device now has a profile of what is ordinary on it, covering process lineage, domains, connection patterns, PowerShell frequency, services, startup entries, scheduled tasks and the accounts that use it. It is rebuilt nightly, compared on every heartbeat, and surfaced on a new Behaviour tab on the device with its confidence level, the deviations found, and the keys quarantined from learning.
  • Confidence comes from observation, not enrolment. A device is trusted as a baseline only once it has actually been watched for fourteen days, or thirty at full sensitivity, and scoring uses diminishing returns so twenty instances of one novelty never outscore one instance of five different novelties. Dismissing a deviation as normal teaches the baseline immediately, a novelty appearing across many devices at once is suppressed along with the earlier findings from the same wave, and a behaviour tied to a confirmed detection is never allowed in. New devices start from what similar devices have in common, never across clients, and user identifiers inside a profile are pseudonymised per client.
  • Fleet burst correlation: the same activity running on many hosts at once is clustered into a single record before anything is judged, under one rule. Breadth may only lower a severity when a management platform's own job log accounts for the burst. In every other case breadth raises it, because an attacker driving that same management agent produces exactly the same evidence, so the claim alone quiets nothing. Credential dumping, shadow copy deletion, event log clearing and token theft sit in a floor tier that no host count can lower. A burst becomes one incident carrying every affected device, updated in place as it spreads, and it leads with the attribution and the reasoning rather than the host count.
  • Forty-three new custom risk rule presets, built from an audit of facts Secuno already collected but nothing read: vulnerable and unsigned kernel drivers, active Defender detections, unsigned startup items and scheduled-task actions, custom and expired root certificates, whether Defender's protection layers are actually inspecting rather than merely registered, proxy and WPAD interception paths, agent blind spots, CIS posture, passwordless local accounts, workgroup membership, geography, emergency KB coverage, and, new to the rule builder, Microsoft 365 apps, findings and monitored certificates.
  • Conditions that must match the same item: a condition on a list can now carry several checks that all have to hold on one item, which is what a service running as SYSTEM from a user-writable path actually requires. Two separate rows would have matched two different services.
  • A risk treatment workflow: formal treatment of a risk as mitigate, transfer, avoid or accept, with per-client approver lists, so approval authority is configured per client instead of requiring a new platform role. Risk SLA days become per client and per severity as well, rather than fixed platform-wide.
  • Ticket templates and checklists: a blueprint fills in a new ticket with its subject, body, priority, service type and a relative due date, and brings a checklist with it. Fifty-seven templates ship in seven groups, covering identity, endpoint, email, network, vulnerability, continuity and governance, carrying 316 checklist steps between them. Checklist text is snapshotted onto the ticket, so editing a template next month never rewrites what a closed ticket claims was done.
  • Ticket workflows: an ordered chain of templates, one ticket at a time, where finishing one generates the next. Twenty-three chains ship, including employee onboarding and offboarding, account compromise, business email compromise, ransomware response, new client onboarding, vulnerable driver response and known-exploited vulnerability response. The sequencing is the content: knowing that offboarding verification belongs a week later, and that a post-incident review belongs after recovery rather than instead of it. A run carries the person it is about, so every ticket in the chain renders the same details, and a ticket closed under a reason that does not claim the work was done halts the run for a human instead of advancing it.
  • Contacts and followers. A contact is an address book entry for the person who rings the desk once a year: enough to say who asked and how to reach them, with no account, password or seat attached. Deleting a contact who already appears on a ticket is refused because it would quietly strip the requester off that history, and deactivation is offered instead. Followers are the CC list and two things at once: a notification route for the colleague who needs to know, and, for an account, a grant of read access. Previously a client user could only ever open a ticket they had personally raised, so a colleague copied in on an outage was emailed about a ticket they could not view. There are now three ways in: you raised it, you follow it, or you are the linked contact. Internal notes never reach a client-role follower or a contact, in the portal or in email.
  • Links, parents and merges, as three separate mechanisms because they are three different claims. A link, related to, duplicate of, blocks or caused by, says read these together, changes nothing, and reads correctly from both ends. A parent says this work sits under that work, with cycle detection, and an umbrella ticket cannot close as resolved while work filed under it is still open. A merge says this was the same thing said twice, closes the duplicate and points it at the survivor. Comments and attachments stay on the ticket they were written on, because they were written in its context by people who never saw the survivor. What moves instead is everything that would otherwise be lost: followers, requester, contact and child tickets, with a comment on both sides saying where to look. Merge chains are refused, so a reader is never two hops from the live ticket. A ticket can also name the inventoried device it is about, and decommissioning that device clears the link but never takes the record of the work done on it.
  • The Linux agent has a detection engine. It ships with process, journal and file system watchers for persistence and execution, systemd and system utility inventory, a credential access detector and a memory region scanner. Detections carry stable technique identifiers mapped to MITRE ATT&CK, which is a contract between what raises a finding and what acts on it, so prose can be rewritten freely and changing behaviour becomes a deliberate, visible act.
  • Isolation can be released automatically. Containment had an automated way in and only a manual way out, so a false-positive burst left every affected device isolated until a technician worked through them one at a time. Releasing isolation is now an automation action, driven by an analyst dismissing the case that caused it. The guards are deliberately narrow: a release only ever reverses an isolation that automation itself imposed for that same case, and it refuses while any other case on the device is still open. It is not maintenance-window gated, because a release restores service.
  • A global client scope selector in the header filters every list in the product at once, without touching individual pages. Explicit per-page filters and deep links still win over it, writes are never filtered by it, and it clears on logout. It is a convenience and not an authority: the backend still checks every request against what the account may actually reach. Client settings move behind tabs at the same time, so password policy, login policy, account lockout, MFA, geo-blocking, compliance thresholds, risk SLA days and treatment approvers no longer sit in one long column, and rows open independently so two groups can be compared before saving.

Changed

  • Severity is rescaled to CVSS. A CVE now lands in the band CVSS itself assigns it, so 9.8 is critical and 8.8 is high. Previously a CVE with no exploit intelligence attached could not reach high at all and was quietly relabelled medium. Expect critical and high counts to move on upgrade without anything on the estate having changed.
  • Scoring notices neglect. New aggravators make a finding worse on the particular host where the facts support it: an unremediated detection, a patch backlog, stale signatures, tamper protection switched off, an oversized local administrators group. They are capped so a stack of hygiene problems never outweighs the vulnerability itself, and weighted down when the device's telemetry is stale. They also decide which host a fleet-wide CVE is assessed against, which is the neglected one rather than whichever host happened to sort first.
  • Compliance is platform-aware. The registry used to grade every device as though it were Windows, so on a Linux host one absent fact turned into four failures: no antivirus product meant antivirus enabled, definitions up to date, signatures current and recent scan all failed, alongside a meaningless pass for Defender exclusions on a machine with no Defender. Checks now declare what they apply to, and a check a host has no instance of is dropped from the verdict and from the score rather than counted as a failure. Linux compliance scores rise as a result, and Linux device pages now use the terms and mechanics of the platform they run on.
  • Required checklist steps block closing a ticket as resolved, and only as resolved. Duplicate, withdrawn, rejected and unsolvable all assert the work was not needed, so gating those would trap a ticket raised in error with no honest way out. The template and workflow editors live as a Settings tab, so they carry the same role permissions as the rest of Settings, and the ticket library installs itself at startup: templates and workflows are inserted only where they do not already exist, and your own edits are never overwritten.
  • The agent's local response engine is a control rather than a typed string. Its three modes are presented in ascending order of consequence, arming enforcement takes a deliberate confirmation, and that confirmation resets whenever a policy loads, so it can never sit over somebody else's settings. Stopping and disabling a service is available as a response action. Registry and scheduled-task actions are deliberately held back pending lab verification. Process creation and file drop events now carry the file's SHA-256 and size, which is what makes cross-host and cross-client correlation possible at all.
  • Agent 0.38 ships on both platforms, so Windows and Linux now share one version line. Deploy the backend before rolling out the agent: 0.38 reports inventory fields an older backend does not recognise and will reject, while the reverse order is always safe. Both builds are staged from the deployment page, and self-update stays disabled until code signing is in place, so these builds reach devices by deployment rather than by manifest.
  • The two new engines start empty, and a quiet first day is correct behaviour rather than a fault. The behavioural baseline arms detection after fourteen days of observation, thirty at full sensitivity, and rebuilds nightly. Fleet burst correlation sweeps every fifteen minutes and needs several hosts inside one window before it has anything to cluster.

Fixed

  • Windows ephemeral ports were filtered using the Linux range, so everything Windows hands out above it went straight through as an only one device has this risk. On a single Windows workstation that was 282 port risks. The range is now chosen per platform, and Windows components that run on a schedule, such as defrag, the Defender scanner, the security health host and the search indexer, joined the process allowlist. Third-party software is deliberately not allowlisted, so genuinely new software on one device still surfaces.
  • A fleet anomaly now raises one risk per device rather than one per value. A device joining a small fleet is the first to run almost everything it has, so one risk per unique value turned a single event into hundreds of queue entries. The finding was never that port 8443 is unique to this host, it was that this host runs things nothing else runs: one finding with a list attached. A second unique value updates the existing risk instead of opening another.
  • Linux kernel threads were permanent anomalies. A kernel thread names itself after the CPU or pool it serves and after the work item it is running at that instant, so the name is unique to the machine and the moment by construction and can never appear on a second device. Every one carried its own risk record, and a large host has hundreds of them.
  • Linux CVEs matched fully patched hosts. Distributions do not ship a new upstream version to fix a security bug, they backport the patch and bump the packaging revision, and the version comparison did not understand that. Across the two to three thousand packages on a typical Linux host this was a large and constant source of false findings. Distribution-managed packages are now compared on their own terms.
  • An update Windows does not consider applicable was recorded as a failure, which made it a retry candidate: three pointless install attempts and then a red failure in the interface that no action could clear. These now park as not applicable, the same state the catalogue already uses when it reaches that conclusion from the scan side.
  • Windows regenerates some scheduled task and per-user service names on every occurrence with a fresh identifier each time, so keyed raw they could never match yesterday's inventory and read as new forever. Keys now normalise the shape rather than the instance.
  • A certificate that went dark resolved its own alert. When a probe failed through a timeout, no certificate presented or a blocked route, the days-remaining value stayed empty, which read as healthy and actively mitigated any open expiry risk. An endpoint going dark now changes nothing in either direction.
  • Third-party software inventory reported nothing on real fleets, through three stacked defects in the package manager pipeline. All three are fixed.
  • The rule builder offered field names the agent does not write, so a rule built from those picks matched nothing, forever, with no error. Every field name is now verified against what agents actually report, and four inventory collections became authorable for the first time.
  • The behavioural baseline reported zero observed days indefinitely on healthy machines, because observation was measured from suspicious events rather than from telemetry coverage. Detection now arms on quiet devices as intended.
  • A bulk campaign dismissal could overwrite a verdict an analyst had just set. It now writes per case and leaves a confirmed case alone. The custom risk rule form can also no longer be closed by a stray keypress while a save is in flight.

Security

  • Cross-client contact details via a ticket assignee, high severity. A ticket's assignee was not checked against the ticket's client, so a ticket could be pointed at a user belonging to another client. Because the ticket detail shows an assignee's contact details, and a status change emails that person the ticket number and subject, this could publish one client's contact details into another and leak this client's subject lines back the other way. The same check now applies to the linked device and the linked contact.
  • HTML injection into outbound email, high severity. Ticket fields authored by whoever raised the ticket were placed into notification emails without escaping, so crafted text could render as working markup inside a genuine, correctly signed Secuno alert. That is a strong phishing primitive, because the recipient's own security vendor vouches for the message. Every interpolation into an email body is now escaped.
  • Attachment path traversal, high severity. The upload destination was built from an unvalidated ticket identifier. That identifier's shape is now validated and the resolved path asserted to stay inside the upload root, stored filenames are random and carry only a recognised extension so an uploader's original name never reaches disk, and response headers are rebuilt from an allowlist rather than echoed back. Containment is re-checked at download time as well, so records written before this hardening are covered.
  • One access rule instead of seven copies, high severity. The client-scoping check had been copy-pasted into seven methods and the ownership rule applied in only three of them, so a client user could modify, comment on and download attachments from a ticket the detail page refused to show them. Every read and write now goes through a single rule.