Release 2026.09

Asset Intelligence

This release expands external discovery and connected access while making exposure evidence, account activity, and day-to-day investigation clearer and more reliable.

• Added lightweight web discovery that follows eligible same-origin links to identify related hosts, along with organization- and asset-level subdomain inventories, discovery provenance, current and historical status, and CSV exports.
• Added account-level MCP access with explicit organization and scope approval. Authorized clients can review assets, posture, findings, and recent changes, update finding dispositions where permitted, and be reviewed or revoked from My Account.
• Refined Exposure Score calculations so accepted risks retain partial weight, false positives and not-applicable findings are excluded, and repeated observations have less influence. Current scores and historical trends now use the same live calculation.
• Expanded web and DNS posture evidence with checks for HTTP pages that do not redirect to HTTPS, non-essential cookies set before consent, and explicit coverage for missing SPF, DKIM, DMARC, MTA-STS, and CAA records.
• Improved finding accuracy by refining registrar-lock evaluation, DNS exceptions, cookie analysis, blocked-page handling, and recurring browser and runtime noise.
• Added complete sign-in activity with authentication method, status, client, network, and approximate location context, plus alerts for the first sign-in from a newly recognized country.
• Strengthened account security with compromised-password screening, clearer expired-session handling, and better one-time-code autofill across supported browsers and password managers.
• Refreshed the authenticated interface with a shared navigation shell, global search, clearer registry patterns, and more useful detail pages for assets, events, certificates, DNS records, pages, similar domains, subdomains, and technologies.
• Improved monitoring reliability and consistency across web discovery, open-port processing, collector identification, and technology detection.

Superviso

September marks the first release of Superviso, a dedicated workspace for running connected security and compliance programs across identity, governance, evidence, risk, and third-party oversight.

• My Workspace brings tasks, assigned items, requests, reviews, and documents into a configurable home, supported by responsive navigation and global search.
• Identity & Access supports program oversight, governed access enablement, identity-scoped access requests and reviews, sequential review steps, connector-backed evidence, durable completed records, and safeguards around identity removal.
• Identity sources for Google Workspace and Microsoft synchronize users, eligible groups, and direct memberships into Superviso.
• Connectors bring provider evidence into Assets & Data and Identity & Access, with support for services including AWS Identity Center, Microsoft Azure, Google Cloud, GitHub, Atlassian, and Cloudflare. Scheduled and manual synchronization, sync history, and retained source snapshots keep imported data reviewable.
• The Governance Library supports directives, document versions and translations, in-browser PDF and text reading, acknowledgement tracking and reminders, and governed exceptions with review dates and mitigating controls.
• Controls & Evidence connects operational attributes, recurring evidence schedules, assigned work, frameworks, reviews, and collected evidence.
• Risks & Incidents provides a scenario-first risk register with append-only assessment history, treatment and ownership context, and clear risk charts.
• Vendors & Partners provides structured third-party and artifact assessments, autosaved responses, findings and customer responsibilities, acceptance blockers, versioned templates, and retained review history.
• Canadian French is available throughout the interface, with organization defaults, per-user language preferences, and organization-aware sign-in pages.
• Organization settings cover branding, support contacts, SSO and fallback access, while user and administrator authentication logs and new-country alerts provide additional account oversight.