Secuno
ENNL
Book demo
All release notes
Platform

Device management, approved remote scripts, two-person risk acceptance and a large false-positive review

v0.0.63Major

Secuno now manages devices as well as watching them: configuration profiles that roll out in stages and correct drift, monitors that can fix themselves, software installs, and BitLocker and local admin password escrow, across every client from one Devices section. Remote scripts arrive with second-person approval, by hand or on a schedule. The device page and list are rebuilt, patching gets an emergency push, accepting a risk now takes two people, and deletes can be undone for 30 days. Also new: AI Exposure Management, announcements, bulk mail, your own email templates, an email log, feature releases and a new knowledge base. Windows agent 0.63 and Linux agent 0.55 are released alongside this platform version.

New

  • One Devices section. Overview, All devices, Profiles, Monitors, Alerts, Software and Secrets in one place, covering every client you can reach. The Overview shows per client: compliance, failing settings, open alerts, failed installs and escrowed devices.
  • Configuration profiles. 52 settings from a fixed catalogue: firewall, Defender and ASR rules, screen lock, USB storage, BitLocker, local admins, SMB signing, LLMNR, WDigest, LSA protection, RDP, UAC, password and lockout policy, audit policy and more on Windows; SSH hardening, sysctl, kernel modules, auditd and more on Linux. The agent checks every 15 minutes and puts back what drifted.
  • Never fights another tool. A setting that a GPO or MDM owns reads "managed elsewhere" and is left alone. A setting changed back three times in a day reads "conflict" and is not re-applied. Report mode only checks, and removing a setting leaves the device as it is.
  • Staged rollout. Each profile change goes to devices tagged pilot, then 10%, 50% and 100%, with a soak time per stage. It halts on its own when more than 5% of devices fail the change or go silent, and you can pause, advance or abort. Profiles, monitors and apps can target chosen clients, every client of a partner, or every client, narrowed by group, tags or named devices, with exclusions.
  • Fix with a profile. A failing CIS check, a failing compliance control or a vulnerability with a workaround opens a profile already filled in with the settings that fix it. Compliance evidence names the profile that enforces a control.
  • BitLocker and admin password escrow. Recovery keys and a managed local admin password are stored encrypted, and BitLocker is only turned on after its key is escrowed. Revealing a secret needs a reason, is audited, notifies the administrators and rotates the secret 8 hours later.
  • Monitors that can heal. Low disk, services, CPU and memory, Windows events, script checks, certificate expiry, TCP ports, ping, Linux journal, device offline and backup too old. A breach opens an alert and optionally a ticket. A monitor can run an approved script when it breaches, and if that fixes it in time no ticket is raised. Breaches during mutes, maintenance windows or right after a restart stay quiet. Alerts, self-heals and time to recover can be charted on custom dashboards, with a new Device monitoring template.
  • Software on demand. Required apps are kept installed, one-time apps are installed once, and available apps install with one click from the device page. Push an app to chosen devices now, search the winget catalogue, install an exact version and hold devices at it. Custom MSI, EXE, DEB or RPM installers up to 500 MB need a second person's approval and are checked by hash before they run. A software policy can uninstall what it matches; security tools and remote-support agents are never removed.
  • Remote scripts with two-person approval. Pick an approved script from the device menu, read it in full, run it as SYSTEM or root and see its output. Every script needs a second administrator to approve it, never its author, and any edit clears the approval. Scripts can declare text, number or choice parameters, which reach the script as environment variables and never in its text, so the approved script is exactly what runs.
  • Scheduled automation. Automation rules can run daily, on chosen weekdays or monthly, in your time zone, over a client, a group, named devices or devices with chosen tags, and platform rules can span several clients. A rule can run an approved script, or a chain of up to five where each runs only after the previous one succeeded, and a Runs panel shows every device's result. A slot missed while the platform was down is recorded, never run late. A rule without conditions acts on everything its trigger brings, with every guard still in place.
  • Collect diagnostics. Download a zip of the agent's logs, configuration, network settings and event logs or journal for 1 to 14 days, straight from the device page.
  • A rebuilt device list. Sort by hostname, client, OS, last seen, risks, agent version, free disk or warranty end, with sort and filters kept in the link. Online, Offline over 7 days, Critical risks, Reboot pending and Low disk tiles filter the list, plus a Status column, warranty and service filters, removable filter chips and CSV export.
  • A rebuilt device page. A "Needs doing" panel with one-click actions, editable criticality, assigned user and location, open work, AI tools, pinned notes and related devices. Changes, risks, patches, commands, logons, reboots and notes sit in one timeline, filterable by type. A hardware card shows processor, memory, disks, battery, TPM and Secure Boot with a lifecycle view, and warranty can be looked up from Dell, Lenovo and HP where configured. Press / to find a section and [ or ] to step between devices.
  • Emergency patch push. Patch one KB across many clients at once: approve it, skip the remaining rings and allow it outside the maintenance window for up to 72 hours. One person asks, a different person approves. Auto-approve rules can target the Emergency lane and KEV-listed CVEs, with a ready-made Emergency patches template.
  • AI Exposure Management. A catalogue of 51 AI tools (local model servers such as Ollama and LM Studio, desktop clients, coding assistants, browser extensions, AI services and meeting bots) is matched against every device's software, processes, ports, extensions and DNS. A model server listening beyond the device itself is a HIGH risk, CRITICAL when internet-facing, unless marked as intended with a reason. AI apps users approved in Entra are judged by the mail, calendar and file access they hold. Copilot gets seat usage, six posture checks and a readiness checklist and PDF. Tools can be sanctioned per client with a reason and expiry; an exposed server is never excused. The module is opt-in per client under Modules.
  • Announcements and bulk mail. Post a banner across the console for maintenance, incidents or a release, with severity, a schedule, links and a live preview; partner administrators can post to their own team and clients. Bulk mail reaches chosen partners, clients and roles with a live count of who it reaches. Product news carries one-click unsubscribe; service notices reach everyone.
  • Your own email templates and an email log. Build templates in the same editor and send them from automation rules in the partner's branding. Every email the platform sends is logged, whether it arrived or bounced, with View and Resend. Mail carrying a password or invite link can never be resent.
  • A new knowledge base. Search ranked by relevance in Dutch and English with highlights and typo help, a new editor with tables, callouts, code blocks and pasted images, translations that show when the original changed, owners and review schedules, and partner copies of Secuno articles that show what changed upstream. 20 starter articles are included: 14 for end users and 6 runbooks for analysts.
  • Feature releases and plans. Every feature has a stage: Off, Alpha, Beta or GA. Beta access is per client and partners' clients inherit it, and modules in alpha or beta are not billed until GA. Plans can cap devices, users and API requests per client with warnings from 80%; they only warn unless enforced, and nothing is limited until a plan is assigned.

Improved

  • Patch This CVE knows its patch. The ticket it opens is linked to the patches that fix the CVE, and Approve fix on a CVE or risk approves the patch and notes it on the ticket. Windows Update error codes now show a reason, where the problem lies and a first thing to try, and every patch decision is in the audit log with who, when and why.
  • Third-party patching. Installs run through winget's own interface as SYSTEM, devices without App Installer can patch, and an install only counts as done when the new version is actually there. Chrome, Edge, Firefox and Brave get 3 days to update themselves before winget steps in, unless their updater is switched off, and "no applicable upgrade" is parked at once instead of failing three times.
  • Fewer false alarms. Every trigger that opens a case was reviewed, each change tested both ways: the benign case stays quiet and the attack still alerts at full severity. A dismissed update of a signed app stays dismissed across new versions, a detection can be held for one device or the whole client for up to 90 days with a reason, and closing a case as false positive or authorised now trains the baseline as Dismiss does. Canaries, LSASS access, DCSync, known-bad hashes and unsigned files can never be held.
  • Cases that say what happened. "Critical real-time detection" becomes, for example, "Mass file modification by Discord.exe", with the folders it wrote to. The same change on devices across a partner's clients within a day is recognised as a rollout, though suspicious persistence never is. Routine logons and administrator accounts no longer escalate a story to CRITICAL, and a dismissed story stays dismissed. The shadow copy reset that Veeam, Datto and Acronis document is no longer treated as anti-recovery.
  • Incidents and investigations. Every incident has an owner and its own playbook checklist that carries over the steps already ticked on the case. A playbook step can run a response action (isolate a host, sign a user out, an Intune sync) when an L2 analyst or above ticks it. Devices, accounts, addresses, hashes, domains, processes and clients link to their page wherever they appear, and about 40 filters now take several values at once.
  • Detection. 2,254 of the 2,394 public Windows Sigma rules now compile (94%, up from 2,119), and 32 more Windows event logs are read, including Application, BITS, TaskScheduler, AppLocker, Exchange and IIS. The agent reads DLL loads and network connections itself, so about 150 rules that used to need Sysmon now fire without it.
  • Windows on Arm. One installer carries x64 and Arm64 builds and installs the right one, so Snapdragon and Surface Pro X devices run the agent natively.
  • Faster and lighter. Heartbeats write far less, the portfolio dashboard and device list respond faster, long tables render as you scroll, and one office behind one address no longer shares a rate limit. Agent requests are compressed and back off when the platform is busy, a fleet restarting together no longer arrives at once, and the Windows security snapshot uses one PowerShell process instead of seven.
  • A new look for every email. All mail uses the new teal layout with the Secuno shield, and invites and risk emails carry more detail. Partner branding still applies on top. Failed integration deliveries can now be discarded as well as retried.

Changed

  • Accepting a risk takes two people. An acceptance is now a proposal that someone else approves, with an expiry of at most a year. Analysts recommend; administrators, partner administrators and client super users decide. The accept risk automation action now proposes instead of accepting, and the API no longer accepts a risk directly. Existing acceptances are untouched.
  • CVEs nobody exploits score lower. A CVE with no KEV listing and no public exploit is discounted by its exploit likelihood, by at most one severity band. Expect fewer CRITICAL CVE risks as risks are rescored.
  • An L1 analyst's escalation is now a request that an L2 analyst signs off or declines, or the L1 withdraws.
  • Deleted tickets, incidents and risks are kept for 30 days with their notes, evidence and time entries, and can be restored.
  • Remote scripts are off for every client until an administrator switches them on under Client settings, Agents, and a device owner can refuse them locally. Script orders are signed, pinned to the script's hash and expire after 2 hours. Script output is kept for 30 days.
  • Device management, remote scripts and the agent features above need Windows agent 0.63 or Linux agent 0.55. They are new: try them on one client or a lab device first.
  • Device management API callers send clientIds instead of clientId, and the software install scope field is now installScope.
  • Microsoft 365 tenants connected before 26 October need their Global Administrator to consent again for the new AI Exposure read permissions.
  • Every outgoing email looks different from this release. Plans and limits, Feature releases and Announcements are new in Settings and stay off or empty until configured; every existing feature starts at GA.

Security

  • Another client's device now answers "not found" instead of "forbidden", so its existence is never confirmed. API callers that relied on the difference need updating.
  • Separation of duties across the platform: scripts, custom packages, emergency patches and risk acceptances each need a second person who is not the requester, and revealing an escrowed secret is reasoned, audited, announced to administrators and followed by rotation.