Secuno
ENNL
Book demo
All release notes
Platform

Lateral containment, Sigma and YARA detection packs, a measured verdict on every case, and the firewall as a source

v0.0.60Major

The paths between workstations that a breach uses to spread through a company can now be seen, closed for a while, and closed for good based on what each workstation learns. New detections now reach devices as signed Sigma and YARA packs instead of waiting for an agent release, and every case gets a verdict based on how often the detections on it were right before. Reachability is measured from connections that actually arrived, and a FortiGate or Meraki can be connected read only, so the perimeter is measured instead of described. Dark web monitoring and threat intelligence are worked like any other risk, with three new sources. The critical and high findings from the 28 September security review are closed, as is a long list of findings from a code review of the whole platform. Also new: service desk SLAs, SCIM provisioning, file integrity monitoring and dozens of smaller additions. Windows agent 0.59 and Linux agent 0.51 were released on 10 October.

New

  • Lateral containment. Most breaches that go from one PC to the whole company use services workstations accept from each other and rarely need: file sharing, RPC, remote desktop and PowerShell remoting. One risk per organisation counts how many Windows workstations accept those services from the local network, how many open paths that makes and how many were used in the last 28 days, with a Lateral Containment tab per workstation. Lateral quarantine is a middle step between watching and isolating: the device loses every connection to the internal network and keeps the internet, so the browser, mail, Teams and OneDrive work and the file server, printers and other PCs do not. Without contact with the platform it lifts itself after twelve hours. A three-state control (monitor, lateral quarantine, isolated) sits on the device, the case and attack stories, and says what the user will lose before the change.
  • Learned segmentation, opt-in per organisation. Each Windows workstation learns which internal devices connect to it and over which service, with no user names. After four weeks, and once nine in ten workstations have learned enough, a policy is proposed that closes every lateral path except the connections seen and the designated management sources. A person reviews and approves it, then it rolls out ring by ring, pauses itself when three devices in a ring lose the same peer, and rolls back in one click. Connections the policy drops are read as a signal: one source dropped on three workstations within ten minutes opens a lateral scan case. The privacy statement names the connection records and how long they are kept.
  • Detection packs. New detections now reach devices as signed packs, with a key used for nothing else, instead of waiting for an agent release. Sigma rules read every channel the agent follows: process starts, PowerShell script blocks, the Security, System and Defender logs, WMI and DNS, and Sysmon where an administrator has installed it. Secuno never installs Sysmon itself. YARA scans new files and process memory with an engine Secuno wrote for its agents: 99.0% of 12,450 public rules compile and run, and on 21,817 test files the engine agreed with the reference implementation on every rule. A match reports the rule and the position, never the file's contents. Windows and Linux get the same engines.
  • Live, shadow or off, per client. Community rules start in shadow: they are evaluated and counted but raise nothing, and go live after fourteen days only if they rarely match. A stable pack of 32 rules is on for every client; a test pack of 2,218 Sigma rules and a YARA pack of 2,919 rules stay off until a client switches them on. A client can add its own Sigma rules, which are checked at once and go to that client's devices only. A community rule reports at high at most and triggers an automatic action only when a response rule names it. The coverage view shows which ATT&CK techniques are detected and which rules cannot fire because the telemetry for them is missing.
  • A measured verdict on every case. Closing a case records what it was: malicious, real but authorised, false positive or duplicate. From that the platform tracks, per detection, per client and across the fleet, how often each detection was right, with a conservative lower bound beside the plain rate. Every open case gets a verdict, likely malicious, likely benign or needs you, with the reasons listed. Credential theft, canaries, log clearing, tampering and indicator matches can never be called benign. Closing without a person is off per client and happens only for detections that were benign at least 95% of the time, at worst, over fifty or more decided cases. Until enough outcomes exist, every case reads needs you.
  • Automation earns enforcement. A rule that acts on cases or risks can move from report-only to enforcing only once twenty of its matches were decided and at least 80% of them, at worst, turned out malicious, and it returns to report-only on its own when its enforced firings show the opposite. Also new: devices as a trigger (enrolled, offline, back online), actions such as a YARA sweep or a window-gated restart, follow-up timers and cooldowns, version history per rule, and a rule that would trigger itself is stopped as a loop.
  • Measured reachability. The agents now report, per listening port, how many connections it accepted and from how many addresses, split into subnet, private and internet peers, from the TCP table they already read: no scanning and no probing. An observation can only raise the tier: a port with internet peers makes the device internet facing, whatever the site record declared. The exposure card states it as a line a technician can check on the host, such as port 3389 accepted 14 connections from 3 internet addresses in the last 30 days. When traffic contradicts a firewall record that declares no inbound access, one high risk is raised.
  • The firewall as a source. A Fortinet FortiGate (directly, through a read-only administrator) or Cisco Meraki MX (through the Meraki cloud) can be connected read only. A credential that can write is refused, a FortiGate's certificate is pinned, and Secuno never writes to a firewall. The configuration fills the questionnaire with measured answers, a port forward to a listening device makes that device internet facing, and the configuration raises risks such as administration reachable from the internet, administrators without a second factor, firmware with known vulnerabilities and VPN without MFA. IPS, malware, VPN and administrator events are read every five minutes and open or join a case. Other vendors keep the questionnaire.
  • DNS tunnels measured by volume, and discovery bursts. Both agents measure, per program and domain over ten minutes, how many distinct subdomains were asked for and how often they repeated, with no list of allowed domains: the platform recognises a product's own channel because the same signed program with the same domain occurs on three or more clients. Discovery commands such as whoami and net group are grouped per process tree and graded on breadth, and a routine a device runs every day fades on its own. Both are evidence on the device and in attack stories first; opening cases from them is a per-client switch.
  • New devices measured against similar ones. A device with no history of its own borrows, opt-in per client, the baseline of at least five similar devices with mature baselines. Behaviour its peers also show counts as normal, behaviour new to all of them is reported without opening a case, and once the device's own baseline matures, only that counts. Behaviour now weighs into attack stories with a cap, a strong deviation with no rule to name it opens a case that asks for a person, and a new Behavioural Baseline page shows, per organisation, the deviations and how mature each device's baseline is.
  • Dark web monitoring and threat intelligence, worked as risks. Findings have a lifecycle with an owner, a critical or high finding or an exposed password creates a risk at once and alerts the right people, and an exposed password closes only after a recorded action such as a reset or MFA. When a device sees failed logons against an account with an open password exposure, one confirmed critical case opens. Every finding carries a confidence figure, the same breach across accounts and clients is grouped, partners get an exposure portfolio across all their clients, and a Threat and Exposure Briefing PDF sums up, per organisation, what was found and what was done about it.
  • Three new threat intelligence sources: registered lookalike domains of the organisation's own (high when they have mail servers, since they can then send mail in the organisation's name), publicly listable cloud storage on AWS, Google Cloud and Azure named after the organisation, with the caveat that the name may belong to someone else, and posts on ransomware groups' leak sites, matched on domain and never on company name.
  • Web Exposure sees vulnerable components. A scan now reads the JavaScript libraries (a fixed list of 22, including jQuery, Bootstrap, AngularJS and Lodash) and the WordPress plugins and themes a site loads, from the page it already fetched. On a site with a verified domain, at most ten small version files are read to confirm them, and nothing is enumerated from a wordlist. One finding per component names the CVEs and the lowest version that clears them all. WordPress advisories come from the Wordfence Intelligence feed.
  • File integrity monitoring. The agent policy takes a list of files and folders to watch, such as the hosts file or an SSH configuration. Every five minutes the agent reports what was created, changed or deleted, with the SHA-256 before and after, and every file is hashed again at least daily, so an edit that restores the size and timestamp is still caught. Changes survive a restart or a long outage and are kept for 180 days. Windows 0.59 and Linux 0.51 carry a first version.
  • Patching. Feature-update rings roll out a Windows release such as Windows 11 24H2 through the client's patch rings, leave Windows Server alone and respect a release pinned by Group Policy or Intune; they go through a pilot before customers use them. Driver updates can be offered per policy. An approval carries over to the update that supersedes it, Defender definition updates leave the patch lists, and a laptop closed after an evening restart gets until its usual online hour to come back. The emergency lane now also opens on its own when a connected firewall or a detection rule sees that CVE being exploited on the device.
  • Microsoft 365. A finding opens a side panel with what the scan saw, why it matters, how to fix it and its CIS and CISA SCuBA references, and a user opens a panel with account state, MFA, roles and sign-in countries. New findings: a Secure Score below a threshold, enabled accounts no MFA policy reaches, standing admin roles alongside Privileged Identity Management, apps from unverified publishers with broad permissions, consents left by disabled accounts, and shared mailboxes that can sign in. Microsoft 365 now appears in the executive summary and the period comparison, and expiring certificates and secrets appear in the calendar.
  • Reporting. A scheduled report can be previewed before it is saved, partners get a portfolio report across all their clients, any report can carry commentary, a watermark and a sign-off, and a button on the client page produces a board report in one click with the posture score, the three risks that matter most, compliance per framework and next steps.
  • Service desk. Every new ticket gets a first-reply and a resolution target per priority, with a monthly SLA report per client. A ticket's audit trail records every field that changes. Waiting tickets come back on their own after their date, missed target dates are flagged, and there are bulk actions, export, shared saved views and a monthly time report with billable time. Email to ticket is built and ships switched off.
  • Devices. The device page opens with a 0 to 100 health score, its parts and a 90-day trend. New tabs show system internals (drivers, services, WMI subscriptions, root certificates) and a comparison with an earlier point in time or with another device, vulnerabilities included. A topology tab places each device in its network segment, and the client overview ranks the ten worst combinations of weaknesses on a single device. Agent connectivity shows what share of the agent's requests succeeded.
  • Users and access. SCIM 2.0 provisioning from identity providers such as Entra ID or Okta, importing users from CSV, a list of sign-in locations with an alert for a country the account has not used in 90 days, and a view of what each role can do. Each organisation's security policy (password rules, timeouts and two-factor per role) is now actually enforced, and a deactivated organisation loses access at once.
  • And more: a board of risks by status, importing risks from CSV, one ticket to patch a vulnerability on every affected device, per-client escalation for critical cases nobody picks up, a daily or weekly summary email, posture score history, custom fields on devices, risks and tickets, a view of what false-positive decisions are hiding, an audit trail for rules, integrations, policies and playbooks, actions in the command palette, a high-contrast theme at WCAG AAA level, a bottom navigation bar on phones, installing the console as an app, and the OpenAPI document and a Postman collection to download.

Improved

  • Legitimate software no longer assembles into attack chains. What the per-change check already recognised as routine, such as Edge post-update cleanup or a vendor's signed Run entry, is now also skipped by the chain engine, attack stories and dwell time analysis, as are changes in the safe direction. The same startup entry or task on three or more of a client's devices within 24 hours counts as a rollout, unless it is suspicious on its own.
  • The CVE match gate recalibrates itself. Analysts can mark a match as correct, wrong or fix verified, and each week the platform proposes new cuts from those verdicts: with at least fifty of each, at most five points per proposal and within fixed bounds. An administrator applies or dismisses the proposal. Nothing moves on its own.
  • Correlation per product. Each install lands in the risk group of the product it matched, risks in progress are mitigated automatically when the software is patched, and after an inventory only changed software is re-evaluated. Concurrent correlation runs can no longer overwrite each other's work. Device group modifiers follow the attack path: not reachable over the network lowers only findings reached over the network, not a local privilege escalation.
  • Campaigns from attack chains. An attack chain now feeds the cross-client campaign engine with only what may leave a client: blockable external indicators, the program and the port, never paths, users or internal names. A campaign that reaches 30% of clients within six hours is flagged for review.
  • Local response rules. A published rule set no longer replaces the agent's built-in rules but sits on top of them, so the built-in anti-recovery, credential theft and canary kills cannot vanish by accident. A kill rule may not act on a YARA file match, because that process is usually the browser or mail client that delivered the file; quarantining the file is the action there. Quarantines have an hourly ceiling of their own.
  • Agents cope with a wrong clock. A device whose clock is off by more than five minutes signs with the platform's time, up to a 24-hour skew. A rejected record no longer blocks the queue behind it, and a failed collection no longer clears the device's stored data.
  • Certificate monitors now also check the chain and the host name, and flag a new issuer or a replacement long before the old certificate was due.
  • Linux updates keep architectures apart and check after every install that the approved version is the one installed.
  • Compliance has its navigation in a left rail, and NIS2 is the default framework wherever none has been chosen.

Changed

  • Compliance scores can move with this update. A device check the agent reported no data for no longer counts as a pass or a fail; it shows as Not reported and is left out of the score. Nothing about the devices themselves changed.
  • Some users sign in once more after the update. The organisation's idle timeout now applies per session and on session refresh, the maximum number of concurrent sessions is enforced, a session ends after a day at most, and Remember me, which never did anything, is gone.
  • Switching on Microsoft 365 response actions needs only the two core permissions again, for sign-out and disable. Each further action needs its own permission. Revoke app consent removes delegated grants only, which is what consent phishing creates; application permissions are listed for the tenant's administrator to remove in Entra. Secuno therefore no longer asks for a permission that would let an app grant itself other permissions.
  • Campaign IOC blocks for other organisations now wait for an administrator's approval, unless an organisation opts in to automatic application.
  • Microsoft sign-in requires the organisation to have pinned its own Entra tenant, and an account with a second factor proves it after single sign-on too.
  • Network isolation on Windows uses the Windows Filtering Platform only. When it is unavailable the command is refused and the console says why, instead of a fallback that blocked the agent's own traffic. An enrolment token is valid for a year at most, admits a bounded number of devices, and is needed for a reinstall too.
  • An accepted or false-positive risk no longer absorbs new CVEs the analyst never saw. They open the next generation of the risk, with a note pointing back to the earlier decision.
  • Automations now run per occurrence instead of once per case, so a case confirmed again is isolated again. Containment no longer waits for the maintenance window; the window governs only patching and other disruptive changes.
  • Counts that move: open patches every device already has now close, so needed and overdue patch counts drop, and a due date picked as a day falls due at the end of that day.
  • Windows agent 0.59 and Linux agent 0.51 require the platform to be updated first. Older agents keep working but get these improvements only once updated.

Fixed

  • Windows 10 and 11 vulnerabilities never reached Windows devices, because NVD files them per feature release. They are now matched per release and build, at normal confidence. Missing patches were always found by the patch module. Expect new Windows risks on the next full correlation sweep.
  • The KEV floor did not hold after the adjustments for asset criticality, device groups and segmentation. A known exploited vulnerability now always stays at high or above.
  • Network isolation on Linux was always refused. It now works, and an isolated host keeps reaching the platform so the release order can arrive. Persistence monitoring on Linux now survives files being replaced, as useradd, passwd and visudo do.
  • A WMI service that stopped responding could bring the Windows agent down after about a week, and a failed WMI query reported every administrator as removed and re-added. Both are fixed, as are DNS tunnel alerts on ordinary reverse lookups and Active Directory queries.
  • An agent request resent after a newer one could roll a device back, including its isolation and patch state. That is now recognised. Offline alerts go out once per offline period instead of every half hour.
  • Patch results could overwrite each other, and a winget install could stay installing for good. Results now write only from the states they may settle and only for the reporting device, and an install times out from when it was dispatched.
  • Confirming a case from the status menu or a bulk action did not run its automations, and triage did not re-judge a case that gained late evidence. Both now go through the same path as the buttons.
  • In the console, a live update no longer closes open dialogs or discards a half-typed acceptance, ticket attachments download again, and lists show only the selected client after a switch.
  • Impersonation signed the administrator out, and a device moved to another location got its new reachability tier only at the next inventory.

Security

  • 28 September security review. The critical and high findings are closed, each pinned by a test. They were mostly about separation between organisations: partner accounts, dark web and threat intelligence settings, cloning a client, notes and watches on risks, and custom fields are now strictly bound to the caller's own organisations. An endpoint that returned more user data than it needed now returns names and email addresses only.
  • Sign-in and sessions. Sign-in rate limits apply per visitor instead of to everyone together, the allowed sign-in countries are checked on every path and an unknown country is refused, a one-time code works once, single sign-on is bound to the browser that started it, changing two-factor settings needs a recent sign-in, and forgot password no longer reveals which addresses have an account.
  • Orders and replies to agents. The platform signs an order when it is created instead of when it is fetched, every order expires and runs only once, rule sets are bound to their organisation and cannot be rolled back to an older version, and every reply an agent acts on is signed and bound to its request. Lists of allowed programs reach the agent as salted hashes.
  • The agents themselves. A process is terminated by identity and never if it is a critical system process, IOC blocks never cover the gateway, the DNS servers or the platform, secrets in command lines are redacted before upload, and on Linux journal lines count only when the journal vouches for their sender. Restart prompts always say that Secuno never asks for a password.
  • Content and network. Ticket comments and knowledge base articles can no longer draw outside their box, knowledge base drafts are readable by administrators only, evidence uploads are stored only after every check has passed, webhook text in email is escaped, and the certificate monitor and outbound integrations connect to exactly the address they checked and send no secrets along on a redirect. One device's Defender verdict no longer counts as a verdict for every organisation.