All release notes
Platform
Attack stories, a look back at how the attacker got in, patches that finish with a healthy restart, and tenant isolation in the database
Two capabilities that had been on the roadmap since the start have shipped. Secuno now turns the signals from a device into one attack story with a verdict and the action to take next, and when an analyst confirms an attack it looks back ninety days to find when the attacker most likely got in, with the NIS2 notification drafts ready to complete. Patching now finishes the job: an install is not done until the device has restarted and come back healthy. Underneath, each client's data is separated by the database itself, and users can sign in with Microsoft Entra ID or Google. Compliance was rebuilt around evidence an auditor can use, Microsoft 365 gained detections of Secuno's own, websites can be checked from the outside, and six sources of false positives in the investigation queue were closed.
New
- Attack stories. Signals from one device are grouped by process lineage and a ten-minute window, including configuration changes and behavioural deviations, and matched against sixteen known attack patterns. The result is one incident with a verdict, a confidence score, a MITRE timeline with one line per step and, for a known pattern, the specific action the technician should take next. Activity that follows the same account onto another device merges into one cross-device story, always critical. A confident story opens an investigation, and that case is the record: the analyst's decisions set the story's verdict, and only human decisions count as a false-positive call. Three false-positive marks on the same pattern quiet it for that client for ninety days, and never for anyone else.
- Dwell time forensics. When an analyst confirms an attack as active or contained, the device's last ninety days are re-read knowing which signals and tactics the confirmed attack used. Activity that sat below the alert threshold at the time is re-scored, and the earliest day tied to the attack becomes the probable initial access, with a confidence of high, medium or low, a scope statement built from what the device could reach, and the NIS2 Article 23 deadlines from both the probable first access and the detection. When nothing re-scores above threshold, the analysis says so rather than guessing a date.
- NIS2 Article 23 drafts. For a confirmed attack, the 24-hour early warning and the 72-hour incident notification are generated in Dutch and English, with the timeline, the preliminary scope and, for the notification, the assessment, the root cause and the measures. Every generation is a numbered version that is never edited afterwards, and sending is recorded with who, when and to whom. The text is a draft for the organisation to complete. Secuno does not send anything.
- A plain-language summary at the top of client reports. Risk summary and executive summary reports now open with the paragraphs a client manager reads first, in Dutch with English beneath: what was monitored, what was blocked, what was handled, what is still active and what to do about it. It is written from the period's attack stories, so a clean month reads as a clean month.
- Patches finish with a restart. A deployment policy per client covers delivery, restarts, checks before installing and notifications, each shown as a plain sentence. Devices restart once per set of installs through five modes from never to forced, with a prompt in the client's branding that shows the real deadline and the postponements left. Workstations default to four postponements and a 72-hour deadline, never between 22:00 and 07:00 local time, and servers never restart on their own. A kiosk profile is one click.
- Did it come back healthy? After a restart the agent reports back with evidence: services that stopped, bugchecks, boot loops and crash spikes fail the plan and count against the rollout ring, and a device that does not return raises a finding. A return with no evidence is recorded as unmeasured, never as healthy.
- Six checks before every install: disk space, power, a metered connection, someone presenting, a restart already pending, and the first ten minutes after boot. A held install goes back to the queue and says why, and a hold older than 72 hours becomes a risk. Batches are sized to the time left in the maintenance window, and content can be downloaded ahead of it.
- Urgency lanes with a clock. Every patch gets a lane: Emergency (24 hours) for anything known exploited, on the KEV list, with a high EPSS score or tied to an open incident; Accelerated (72 hours); Standard (14 days); and Deferred (60 days) for drivers, feature and definition updates. A responder can mark a CVE as seen exploited at a client, which moves every fix for it to Emergency. Servers can restart in order, a few at a time, with a health check between each.
- Single sign-on with Microsoft Entra ID and Google. Each client decides whether SSO is allowed, which providers, which Entra tenant or Workspace domain accounts must belong to, and whether the password stays. The account must already exist, so SSO changes how a person proves who they are, not who is allowed in. Requiring SSO is a separate, confirmed decision that a client's own administrator cannot take for their own organisation.
- Security keys and passkeys. FIDO2 keys and platform passkeys such as Windows Hello and Touch ID can be used as a second factor alongside the authenticator app, with up to ten named keys per user.
- Compliance, rebuilt. 107 controls across seven frameworks: CIS Controls v8, ISO 27001, SOC 2, DORA, NIST CSF, NIS2 and GDPR. Organisational requirements such as incident response, backups and awareness training are attested by a named person with a note and a review date, and one attestation covers the same requirement in every framework. A control that fails on one device in two hundred is now near compliant rather than a red gap. New views: a portfolio of every client on one framework, campaigns that run one fix across many clients, a simulator that shows what a fix would move, a calendar, and read-only auditor links that expire, can be password protected and revoked, and never show hostnames or other clients.
- Web exposure. A client's websites are checked the way any browser sees them: certificate, TLS and security-header findings from a deliberately narrow passive check that never crawls, submits a form or sends a payload, with a grade from A to F. Every finding quotes the header or certificate field that triggered it. Sites whose owner has proven control can receive a fixed set of probes for exposed files such as .git and .env, confirmed by content, with the contents never stored.
- Microsoft 365 detections of Secuno's own. A sign-in contradicted by the user's own laptop being in another country, a learned baseline of the countries each tenant and each person signs in from, and a successful sign-in after a password spray. Three of the four need no Entra ID P2 licence, which matters for the many tenants on Business Premium. Risky sign-ins now show whether MFA was satisfied, the application, the device and which Conditional Access policies applied.
- Microsoft 365 controls and response. Twenty-seven controls in eight sections, each with its CIS Microsoft 365 Foundations and CISA SCuBA references, recorded as pass, fail or could not be evaluated after every scan. Opt-in Exchange Online checks cover mailbox forwarding, external transport rules, delegation and audit logging. On tenants that opt in, an analyst can sign a user out everywhere or disable the account from the case, and break-glass accounts can be declared so they stop raising the top-severity MFA finding.
- Fleet overview. Partner staff see every client on one line, with its active attack stories, attacks blocked this week, unreviewed anomalies and its weakest device baseline, worst first.
- Working the risk list. Snooze a risk until a date with a reason, state that one risk is blocked by another, see a live countdown to each due date, and read exactly which field an edit changed. References now name the client, such as ALPL-00012, on risks, investigations, tickets and incidents. Tickets gain time tracking, and alert suppression rules can quiet chosen notifications during a declared maintenance window.
Improved
- Forty-one attack chains instead of eight. Real-time detections such as a cleared security log or an LSASS handle can now chain with a configuration change such as antivirus being disabled, which was impossible before. Four chains open as possible rather than suspected, so the doubt is on the case.
- Detection that is harder to dodge. Command lines are normalised and decoded before they are classified, so carets, quotes, variable tricks and encoded PowerShell no longer hide a known command. A spoofed parent process is detected and the real creator named. Stopping the agent's own trace session is itself a detection. New coverage includes token manipulation, cloud exfiltration tools, UAC bypass through a hijacked handler and AMSI tampering. Devices running past the end of vendor support are now graded for it.
- A kill can no longer hit the wrong process. Termination carries the image and start time the detection saw, and a new kill-tree action stops the whole process tree, because the encryptor is often the child of what was detected.
- Every detection keeps its evidence. A case opened from an attack story lists each underlying record with every field the agent sent, timed by the event itself, so the timeline reads which account used whose credentials rather than only the category.
- Linux vulnerabilities from the distributions' own advisories. Ubuntu, Debian, Alpine, Rocky Linux, AlmaLinux and openSUSE advisories are read and compared with each package manager's own version rules, so a fix the distribution backported is recognised. Windows itself is now matched against Windows CVEs at build level.
- EPSS history. Each CVE shows ninety days of exploit-prediction scores, and a client with an open risk for a CVE is alerted when its score jumps.
- Remediate from the risk. A CVE risk shows the Windows update that fixes it and, per device, the third-party package upgrade, with a Remediate button that approves the upgrade for that one device only.
- Device groups say something about risk. Operators can state what an agent cannot measure, such as a segment not being reachable or a device holding regulated data, from a fixed list of reasons. The adjustment is bounded, never moves a finding more than one severity band, and is shown apart from the measured controls.
- Seven report types, with a Microsoft 365 posture report that includes the controls section and a web exposure table on risk and executive summaries.
- Force sync. A button on the device page asks the agent for a fresh heartbeat, inventory and patch check now, answered in about thirty seconds, instead of waiting for the next cycle.
Changed
- A campaign that hits most of the fleet at once is now held as a suspected fleet event for the partner to decide. Blocks stay and cases stay open until someone confirms, rather than being lifted automatically.
- Repeat signals fold into the open case. A case nobody has touched yet keeps absorbing its own kind of signal for a day, instead of a new identical case every half hour.
- Switching a paid module off for a client now stops the module, not only its page: the client drops out of scheduled scans and lookups, and its findings are kept but not served until the module is switched back on.
- Uploaded files, such as ticket attachments and risk evidence, are now kept on persistent storage and survive every update.
Fixed
- Six sources of false positives in the investigation queue were closed, among them system processes read as masquerading, Windows database maintenance read as credential theft, builds and installers read as ransomware file activity, JavaScript and Java runtimes read as injected code, and a Linux administrator's own sudo read as credential abuse. Devices keep producing the old findings until their agent is updated.
- The Windows installer could not register its service on a clean machine and blamed permissions. Every earlier installer was affected, and in-place upgrades now keep the device's identity and settings.
- Windows devices never rotated their identity key. Every attempt was skipped silently; rotation now works every 30 days as intended.
- One new agent field could take a device offline for a day and a half, because the platform rejected the whole heartbeat. Every field the agents can send is now checked against the platform in the test suite.
- Matches against the indicator feed never opened a case. They now open an investigation named for the file, domain or address the device reached, and a badly shaped feed can no longer cut devices off from their commands.
- Correlated CVE risks lost their CVEs and CVSS while other devices were still vulnerable, and a legitimate Chrome CVE was hidden as informational beside an open high risk for the same install. Both are fixed and repair themselves on the next full evaluation.
- A USB stick was reported as BitLocker turned off at critical severity. Removable drives are now a medium finding that closes when the drive is removed.
- Impossible-travel risks on Secuno sign-ins were scored on the wrong scale and now read correctly.
Security
- Each client's data is now separated by the database itself, underneath the application's own checks. A query that forgets its tenant filter returns nothing. Before it was switched on, every list and detail route was compared as five kinds of user with and without enforcement: of 1,045 comparisons, 1,009 were identical, and every difference was intended. A request for another client's record now answers not found rather than forbidden, so it no longer confirms the record exists.
- A security review with a lowest-privilege account tightened input limits on every text field, restricted uploads to an allowlist of file types, confined three lookups to the caller's own client, and made the service survive a burst of malformed requests.
- Every outbound request the platform makes on a client's behalf now connects to the exact address it checked, closing a window in which a hostile name server could answer differently the second time.
- Support impersonation with a full trail: limited to thirty minutes, always bannered, and every action recorded as the administrator acting on behalf of the user. Administrators can also sign a user out of every session at once, and staff administrators now see only the audit entries for their own clients.