Secuno
ENNL
Book demo
All release notes
Platform

A public API with scoped keys, attack stories that follow the attack, integrations that survive an outage, and firewalls read from the LAN

v0.0.62Major

Dark mode is back on a calmer palette, and the sidebar now counts what is waiting. Secuno gets a versioned public API with service accounts and scoped, rate-limited API keys that secret scanners recognise. Attack stories now follow an attack across hours and devices and explain themselves, Edge updates and other known software stop opening cases, and patch rollouts, approvals and exceptions stay the way they were decided. Integrations queue and retry through an outage, one PSA or RMM connection can serve every client, and firewalls gain device discovery, a check from outside and SonicWall and Sophos support. Data retention is now on by default. No agent was released in this period; the current agents remain Windows 0.62 and Linux 0.54.

New

  • Public API v1. A versioned API for clients, devices, risks, investigations and tickets, including creating and updating tickets. Fields are only ever added within v1, deprecations are announced six months ahead, lists are cursor-paginated for incremental sync, and writes take an Idempotency-Key so a retry never creates a second ticket. The OpenAPI document is under Settings, API.
  • Service accounts. An API identity owned by a client, a partner or the platform instead of a person, so a PSA sync keeps working when the engineer who set it up leaves. It uses OAuth 2.0 client credentials with a secret or a private key JWT, one-hour tokens and two active secrets for rotation, and is managed by the organisation's administrators.
  • Scoped API keys. A key gets access per area (devices, vulnerabilities, investigations, tickets, compliance, patching, integrations, response, and clients, users and settings): read only, read and change, or none. Actions that touch endpoints, mailboxes, firewalls or access are never on by default. A key can be limited to some of its owner's clients and to chosen IP addresses or ranges, and calls from anywhere else are refused and audited. Each key allows 600 requests a minute, 120 of them changes, with RateLimit headers on every response.
  • Keys you can account for. Every change made with a key records which key made it, so a script no longer looks exactly like the person who owns it, and Profile, API keys, Activity shows requests, refusals and changes per key over 30 days. Owners are warned 14 days, 3 days and on the day before a key expires, keys unused for 90 days are revoked, deactivating a person revokes their keys, and use from a new country raises an alert. New keys start with secuno_sk_ and carry a checksum, so secret scanners recognise a leaked key and a mistyped one is refused at once.
  • One story per attack. Attack stories are now joined by what they share (file hashes, threat domains and addresses, files in user-writable folders, processes) for up to 24 hours instead of by ten minutes of time, so an afternoon-long attack is one story instead of several. The same hash or C2 domain on another device makes one story across devices, and lateral movement joins the story on the device it came from. In our own replay of seven attacks and ten ordinary days, attacks told as one correct story went from 3 of 7 to 7 of 7, and every ordinary day stayed quiet.
  • A story card that explains itself. Each new story shows the probable start, the step to watch for next, what joined later and why, the accounts, files and destinations involved, and every part of its confidence. From the card you can block a domain, sign a person out of Microsoft 365 or look for a hash on other devices.
  • Deliveries that survive an outage. Events are queued per integration and retried for up to 24 hours, so a receiver that is down for a minute, or a platform restart, no longer loses them, and failed deliveries can be replayed from the delivery log. Each integration shows Healthy, Degraded, Failing or Disabled with the reason, the last success and what is queued, and its owner hears when it starts failing, when it recovers and before its credential expires. After five failures in a row an integration pauses and backs off without using up the retries of queued events.
  • Webhook contract v1. Every payload gains an id, a version, a timestamp and an entity, and every delivery carries webhook-id and webhook-timestamp headers. Standard Webhooks signing is the new recommended option, with a JSON Schema per event type and a Send test event button.
  • One PSA connection for all clients. ConnectWise, Autotask, NinjaOne and Datto RMM can hold one connection that sends each client's events to that client's own company, organisation or site, and partners can create one for their own clients. Client mapping matches each Secuno client to its PSA company or RMM site, with suggestions by domain and name to accept one by one or all at once. Unmapped clients are skipped, never sent to a catch-all. Integrations get their own section with Overview, Health, Connectors, Client coverage, Client mapping, Delivery log and Backup vendors.
  • Firewalls read on the LAN. An agent already at the site can read the firewall on its LAN address, so WAN management no longer has to be exposed to connect it. The certificate is pinned and the credential is never stored on the device. This needs Windows agent 0.63 or Linux agent 0.55, which are not yet released.
  • What the firewall knows about the site. The firewall's device list is compared with the managed devices, and computers seen regularly without the Secuno agent raise one grouped risk per client; guest networks, phones and randomised MAC addresses are never kept. A device's egress, segmentation and IPS credit now come from the firewall policy that actually covers its network instead of the site questionnaire. Once a day, a TCP handshake from Secuno to the site's public addresses checks what is open from outside: a port the configuration does not explain is a risk, critical for RDP, SMB and Telnet. Firmware flaws are read from vendors' own advisories, so they can reach a risk before NVD has mapped them.
  • Firewall events corroborated, and more vendors. A firewall C2 or malware hit that the agent also saw is confirmed, and a VPN user that matches one Microsoft 365 account makes the case about that person. SonicWall (through a collector or directly) and Sophos Firewall (directly) can be connected, both read only. With separate consent, Secuno can maintain a blocklist group and a quarantine group on FortiGate and Meraki; it never touches your policies, and the first push waits for you to approve a dry run. Connection, discovered devices, outside-in results and response share one Firewall page, and firewall checks appear on compliance controls and the board report.
  • Client health and access reviews. The client list shows posture, open risks, devices, incidents and tickets, worst first, with a Needs attention filter, saved views and CSV export, and the client page leads with what needs attention and its top five risks. The users list is built for access reviews: last sign-in, users without MFA, stale accounts, bulk deactivate, activate and two-factor reset, and active sessions that can be signed out one by one.
  • My Organisation and the device agent log. Partner administrators get one page for their clients, people, teams, macros, ticket settings and white-label, and can invite users by email to set their own password. Each device gets one timeline of every command, update install and restart plan Secuno sent and how it ended, plus every restart and its cause: a Secuno order, a user, Windows Update or a crash.
  • Console. Dark mode is back: every page was reviewed in dark mode at desktop and phone width and measured for contrast, surfaces are near-neutral with a slight teal tint, and teal is kept for buttons, links and the active item. The sidebar shows how many incidents, investigations, approvals, tickets, patches and risks are waiting, using the same numbers as each page, and a badge turns red only when something is overdue or near its deadline. Dark web, threat intelligence and web exposure become one Exposure Management section, with a per-client Portfolio as the administrator's starting point. Old links keep working.
  • Risks you can work through. The summary strip shows Overdue, Due this week, KEV open, Unassigned and Awaiting approval, and clicking a figure shows exactly those risks. Group by folds the risks in view by category, source, client, device or CVE, worst first. Group by Fix lists the upgrades and Windows updates that close the risks in view, how many each closes or only reduces, and the share of the client's risk it removes; Remediate all approves the upgrade once per device. The Remediation Plan moves in here as the ranked plan for a single client.

Improved

  • Edge updates no longer open cases. Each Edge update used to arrive as two or three high malware cases about a new executable in a user-writable folder. A correctly named, Microsoft-signed update package in Temp is now recorded without opening a case. As before, a signature means a valid one the agent checked on the device, and nothing is excused on a file name alone.
  • False-positive verdicts hold for 14 days. Closing a case as false positive, benign or authorised stops the same detection with the same evidence from reopening a case for 14 days. New evidence or a higher severity still opens one.
  • Known software is recognised. A signed file already common across the client's devices no longer opens a case; unsigned files and startup-folder drops never qualify. Printers, NAS devices and file servers no longer open an NTLM case on every heartbeat. Signed downloads and files written by trusted signed installers are graded lower, while remote-access tools stay graded higher because tech-support scams use them. Teams, Zoom, Slack, Discord, Spotify, OneDrive and the Google, Edge and Dropbox per-user updaters are recognised when signed in their own folders.
  • Routine Windows activity stays quiet. OneDrive sync storms, Realtek driver updates, IExpress cleanup entries, Defender platform services, Workplace Join, Windows' own scheduled tasks, UAC prompts and versioned runtimes such as Visual C++ and .NET no longer raise findings. Scripts run by a verified management tool are graded lower, while loaders, AMSI bypasses and shellcode keep their grade.
  • Fewer confident non-attacks. Context such as administrator logons, NTLM and USB counts far less in attack stories, and analyst decisions now calibrate each sequence's confidence. Ransomware, credential dumping, DCSync and log clearing are never pulled below the investigation threshold.
  • Judgement engines reviewed. Triage only closes a case on its own when the case is unchanged since its verdict, a management job only excuses activity it can be tied to, and ransomware and credential-theft patterns can no longer be suppressed automatically.
  • Patch rings judged on their own devices. A device in both the pilot and a later ring no longer counts toward the later ring, small rings can reach a verdict, empty rings wait one soak period, and a pilot halts as soon as its failures cross the threshold. A newer release of an approved winget package starts again at the first ring instead of installing everywhere at once, and adding or moving a ring no longer leaves its devices without an update that had already finished rolling out.
  • Patch decisions stay decided. An expired decline exception waits for a person instead of being picked up by an approve rule, exceptions belong to one decline, and approval status changes only through approve, decline and schedule. A client with its own maintenance windows or approval rules follows only those instead of combining them with the platform defaults. Large cumulative updates rank their CVEs by exploitation first, so a known exploited CVE puts the update in the Emergency lane.
  • Custom rule fields match the agent. The rule catalogue for processes, software, network adapters and logged-on users now uses the agent's own field names. Saved rules keep working, and an unknown field is refused with the valid ones listed.
  • Console polish. Hovered rows and buttons stay dark in dark mode, text fields and checkboxes no longer sit white on a dark page, and light-mode captions and chip labels are a step darker. Toolbars wrap on a phone, metric strips no longer leave a blank tile, and the CVE page opens with its score tiles in the left column. The Threat and Exposure Briefing and the domain and leak checks offer a client picker when every client is selected, instead of hiding.

Changed

  • Data retention is on by default. Retention policies shipped switched off, so most data was kept beyond its policy. They are now on, nine tables that grew without limit get a policy, and a client's own retention setting now also covers change, USB and evidence events. On the first night, data past its period is permanently deleted with nothing exported first, including audit logs and setting history older than three years, read notifications older than 90 days and usage metrics older than two years. Change events are still kept for 30 days by default and can be extended per client.
  • Generic Webhook receivers get new payload fields and the webhook-id and webhook-timestamp headers. A receiver that rejects unknown fields needs updating, and since deliveries are now retried it should drop a webhook-id it has already processed.
  • The inbound receiver now takes its token in the Authorization header. Tokens in the URL still work but are deprecated, tokens are stored hashed and cannot be shown again, an unknown token is answered with 401, and more than 120 events a minute with 429.
  • New API keys need scopes. Existing keys keep their full reach and are marked Full access (legacy), and every key is limited to 600 requests a minute. Existing keys in the old format keep working; since unused keys are revoked after 90 days, the first revocations come in January.
  • The API no longer sets a patch's status directly. Use approve, decline and schedule.
  • Completed patch rollouts may resume on rings added since they finished, and winget rollouts restart at the first ring on a package's next release.
  • Existing attack stories show no explanation on their card until they receive a new signal, and restarts appear in the device agent log from this release on.
  • The newer firewall reads (collector mode, SonicWall, Sophos and device discovery) and the PSA and RMM company lists are new. Try them on one client first. Firewall device discovery, the outside-in check and perimeter response are off by default and are switched on per connection.

Fixed

  • Two-factor sign-in. A code typed a few seconds late is accepted, a wrong code no longer reloads the sign-in page, errors say what went wrong, and the security key button is back on the two-factor step.
  • Routine recovery maintenance, such as Microsoft's own WinRE fix, is no longer stopped mid-script. Deleting shadow copies is still critical.
  • An installer that exited cleanly without upgrading no longer counts as patched and is retried. Microsoft Edge no longer picks up WebView2 findings when a fix is verified, tiles and lists agree, and the install history CSV exports every row.
  • Findings for Microsoft 365 administrators eligible through PIM stay open when Microsoft's API is throttled or unavailable, instead of closing.

Security

  • Inbound receiver. The token moves from the URL to a header and is stored hashed, the receiver can require Standard Webhooks signatures, and it is managed from the integration's settings instead of only through the API. Tokens no longer appear in request logs.
  • API keys are scoped per area and can be bound to clients and addresses, every change records the key that made it, and leaked keys are recognisable to secret scanners. Actions on endpoints, mailboxes, firewalls and access are never granted to a key by default.