The Cyber Toolchain — issue 060, August 31, 2026

New Azure Cloud Pentest type, launched from Pentests > Run Assessment > Infrastructure > Azure Cloud Pentest and scoped per Tenant ID and Subscription ID, combines Azure API enumeration with an Internal Pentest in a single run — covering cloud resources and workloads on Azure VMs with no on-premises infrastructure required. NodeZero deploys a temporary Standard_D4s_v3 VM into a subscriber-selected subnet and authenticates via a managed identity: a Horizon3 Cloud Connector Custom Role with 28 permissions across Microsoft.Authorization, Microsoft.Compute, Microsoft.ManagedIdentity, Microsoft.Network and Microsoft.Resources is provisioned, and dynamic just-in-time role assignment grants Global Reader at the Entra ID tenant level plus a subscriber-chosen subscription-level role (built-in Reader, Contributor, Virtual Machine Contributor or a custom role) only for the pentest's duration, revoking both at teardown. Pre-launch validation checks subnet IP space, NSG outbound connectivity on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. 443, regional vCPU quotas (minimum 4 Total Regional vCPUs and 4 Standard DSv3 Family vCPUs), VM and network interface quotas, allowed VM SKUs, allowed locations, denied resource types (Microsoft.Compute/virtualMachines), and managed-disk policy, with a Tags field to satisfy required tag-value pairs or tag keys. Resources are deployed into a resource group named H3-NodeZero-rg-[suffix], and all four resources (VM, OS disk, network interface, managed identity) are automatically removed when the pentest completes; a Real-Time View shows live progress and vulnerability findings as the test runs.

⤢ ⤢ ⤢ ⤢ ⤢

New Pentests > Cloud Connections section lets practitioners create and manage Azure cloud connections required to run Azure Cloud Pentests. Subscriptions can be added via direct Subscription ID entry or by uploading a CSV file with a required id column header. A tenant verification step reads Microsoft-verified domains from Microsoft Entra to confirm tenant ownership, and a permissions verification step confirms the Horizon3 Cloud Connector Custom Role PowerShell script ran successfully and the managed identity can authenticate. Once verified, practitioners can launch a test directly via a Run Pentest button or add more tenants with Add Another Tenant, and a Check Again button recovers from admin consent polling timeouts without restarting the flow.

⤢ ⤢ ⤢ ⤢ ⤢

The -kb / -knowledge-base flag makes httpx's page-type classification (tagging pages as login, captcha, parked, etc.) opt-in rather than always-on, and results can be filtered with existing flags like -fpt (e.g. -fpt parked,captcha).

$ httpx -l targets.txt -kb -fpt parked,captcha -o live.txt

Adds clickhouse-backup sidecar and ClickHouse as an optional in-cluster column-oriented database, backed by a StatefulSet and S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object storage, deployable via Helm or KOTS to power Endpoint Protection analytics. ClickHouse is optional in 2026.8 but becomes mandatory in 2027.1.0, requiring S3-compatible object storage (Azure Blob Storage and GCS support in progress) to be provisioned before that upgrade.

Enables the unified filter bar on self-hosted, supporting incident search by secret value, commit author, or file path. Plain-English search (AI Filters) activates once a workspace administrator enables the External LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. toggle under Settings > Workspace > AI and configures a reachable LLM provider, after which AI Filters appears in the Incidents page filter bar.

Adds a GitGuardian Remote MCP server deployment (Helm only, beta, disabled by default) that runs in-cluster so no traffic or secrets leave the network. Point Claude, Cursor, or any MCP client at the instance to scan for leaked credentials, manage incidents, and deploy honeytokens from the IDE.

Adds a Set your own validity status API call that accepts valid or invalid for secrets on internal systems GitGuardian cannot reach. Affected incidents display Custom validity with the date set, recorded in both the incident activity log and the audit log.

Adds detectors across v2.167–v2.169.1: Azure SQL Credentials, Azure Machine Learning Key, Azure Video Indexer Key, Azure Health Insights Key, Azure Fluid Relay Key, LiteLLM API Key, DashScope API Key, Apify Proxy Token, Authress Access Key, two Gemfury token variants, Azure Immersive Reader Key, DashScope Coding Plan API Key, DashScope Token Plan API Key, Prefect Cloud API Key, Slack Webhook Trigger URL, n8n API Key, Atlassian Auth Key, AWS Cognito Access Token, OpenAI Access Token, Vercel OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Token, OpenCode API Key, Lovable Access Token, and Lovable Git Token. Adds or upgrades checkers: LiteLLM Without Host, LaunchDarkly SDK Key, Llama Cloud API Key, New Relic APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. License Key, npm Token, Hume AI API Key, Alibaba Cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., GitLab Deploy Token, and Supabase Service Role JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store..

Adds AWS S3 to GitGuardian's monitored perimeter, running historical scans of accumulated objects — including backups, CI/CD logs, and Terraform state files — to surface exposed credentials as incidents, and extends scanning into supported ZIP and tar.gz archives so secrets hidden inside compressed objects are found. Connects via an OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-assumed read-only IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role (no long-lived keys), lets you select individual buckets and assign them to teams, and routes findings into existing incident workflows with the usual severity, validity, playbooks, and notifications. Scanning defaults to the integration's region and the S3 Standard storage class; cross-region scanning and other storage classes are opt-in to control retrieval and transfer costs.

⤢ ⤢ ⤢

Adds AI-agent analysis of public secret incidents, producing a Company-related verdict (Related, Uncertain, or Unrelated) exposed as a column, a filter, and three ready-made saved views, plus a new Analysis tab showing the company identified, the agents' reasoning, the risk score with rationale, and which agent concluded. This replaces the ML risk score on public incidents and supersedes the Context related to company tag; risk score filtering is no longer available for notifications on public incidents.

Adds automatic monitoring and automatic scan toggles for Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center, and Microsoft Teams — new spaces, projects, and channels are picked up without manual addition.

⤢

Teams can create and manage Asana tasks directly from Socket alerts, either manually or via ticketing rules that filter by event, type, priority, and repository, with configurable sync between task and alert status. Available in beta on Business and Enterprise plans.

New scanning covers every extension in Mozilla's official add-ons directory, monitoring for permission changes, network activity, malware, credential and clipboard theft, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., remote loading, obfuscation, and impersonation. Available in Experimental for Enterprise customers.

Cloudsmith now supports the Nix package format, enabling hosting of public or private Nix binary caches with Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe.-signed packages, along with upstream proxying and caching against NixOS release channels.

Adds comment-on-elements capability in the integrated browser to select and annotate HTML elements for targeted UI feedback on batch agent edits; adds automatic reload of local HTML files when they change on disk; and supports setting the integrated browser as the default editor for HTML files via the editor associations setting (Editor > Associations, mapping *.html).

Adds an experimental /rubber-duck command usable in a Copilot Agent Host session to ask a complementary model to surface missed details and edge cases before merging.

$ /rubber-duck

Adds a /btw slash command that opens a side chat sharing the primary chat's context and prompt cache, while the main chat continues running.

Adds multi-language dictation using an on-device model with automatic language detection, user-level and workspace-level dictation instructions for custom transcript cleanup aligned to project terminology, and shell-aware cleanup that preserves command syntax when dictating in the terminal instead of inserting spoken punctuation literally.

Adds chat sticky scroll to keep the current prompt pinned while scrolling through long conversations; supports arranging chats side by side in horizontal or vertical groups with layout restored on return to the session; adds a default single-pane layout that opens session details and editors in one side pane with adaptive-width diffs; enables switching between regular and diff editors from the breadcrumb bar in the Agents window; and allows terminal output expanded in chat to reflow as the view is resized.

Curation Federation propagates open-source blocking rules, waivers, and approvals from any peer site to every regional pipeline worldwide within seconds of being set. To use it, go to Curation > Policies in the JFrog Platform UI, create or update a blocking rule or waiver on any peer site, and Platform Federation propagates it automatically to every connected site in the mesh.

Automated Repository Provisioning creates and configures repositories on the correct sites automatically based on a Stage-to-Site mapping, eliminating per-repo and per-site manual administration. To use it, go to Platform Federation > Stage-to-Site Mapping in the JFrog Platform UI, define which release stages map to which regional sites, then add the new site to the mesh so required repositories are provisioned automatically.

JFrog Platform Federation introduces a peer-to-peer mesh architecture for distributed JFrog sites, replacing hub-and-spoke and script-driven sync with autonomous, continuous background synchronization of projects, access control, policies, artifacts, and repositories. It supports both self-managed and JFrog Cloud SaaS sites — including airgapped and private-cloud deployments — in the same federated mesh, enabling phased SaaS migrations without breaking centralized security or identity control, and provides a Federated Topology View showing the global peer mesh across regions with entities and policies synchronized in real time.

⤢ ⤢

⤢

⤢

A new check actively tests multipart and JSON upload flows using JPEG and PNG canary images embedded with controlled metadata in fields such as UserComment, ImageDescription, Artist, timestamp fields, and GPS coordinates; a finding is created only when a metadata field matches exactly or a GPS coordinate pair is confirmed preserved in the served image. The scanner validates the full image processing path — upload endpoint, application response, image discovery via response body, redirect headers, JSON/HTML responses, image links, and rendered DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. — rather than flagging storage configuration alone, and produces evidence including the original upload request, the application response, the retained EXIF fields, and the URL where the image was found for use as a testable AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. control in CI/CD.

⤢

Adds dalfox payload javascript selector to print canonical JavaScript execution payloads used in JS-string contexts.

$ dalfox payload javascript

Adds the dalfox completion subcommand to generate shell completions, installed alongside the man page by packages.

Elcomsoft System Recovery 8.38 adds a built-in BitLocker TPM exploit library supporting the YellowKey and GreatXML exploits. During installation, the installer offers to build a second USB flash drive loaded with the chosen exploit; the target machine is then booted with both drives attached to attack a locked drive.

Adds a new mlx5 Direct Verbs backend, enabling --rx-mode receive support directly on Mellanox mlx5 NICsNICsA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link.. For example: sudo wireblast -i eth1 --mode receive --rx-mode udp-port --rx-port 9000 -d 60s.

$ sudo wireblast -i eth1 --mode receive --rx-mode udp-port --rx-port 9000 -d 60s

Adds a dns_cache configuration block with ttl (default 1h), negative_ttl (default 5m), and size (default 16384) keys, caching DNS lookups with an LRU cache to reduce repeated resolver calls. Example tuning for large or frequently-rotating address sets: ttl: 30m, negative_ttl: 5m, size: 32768.

dns_cache:
  ttl: 30m
  negative_ttl: 5m
  size: 32768

Adds appsec-challenge and appsec-challenge-infra metric categories to cscli, the latter exposing internal AppSec challenge runtime upkeep metrics: signing-key rotation, JS re-obfuscation, and cache eviction. Adds matching Prometheus counters cs_appsec_challenge_requested_total, cs_appsec_challenge_submitted_total, cs_appsec_challenge_accepted_total (labeled kind=solved for valid submissions or kind=granted via GrantChallengeCookie(reason)), cs_appsec_challenge_rejected_total (labeled kind=protocol for crypto-PoW failures, kind=submission via RejectSubmission(reason), or kind=cookie for invalid incoming cookies), cs_appsec_challenge_exempt_total for requests exempted via ExemptFromChallenge(reason) (verified bots like gptbot, well-known paths), and cs_appsec_fingerprint_mismatch_total labeled by severity from EvaluateMismatches(). Runtime internals for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory troubleshooting are also exposed: cs_appsec_challenge_kepoch_generated_total, cs_appsec_challenge_kepoch_evicted_total, cs_appsec_challenge_reobfuscation_total (labeled bundle, with bundle=dynamic for the per-epoch signing module), and cs_appsec_challenge_dynamic_module_evicted_total.

v1.8.0 adds WAF bot detection via waf challenge mode, which serves a challenge-and-fingerprinting page to clients before granting site access, with configurable score thresholds and cookie-disabled error messaging. RejectSubmission now generates an alert so WAF submission rejections surface in the alert stream, and a configurable auth timeout from WAF to LAPI was added.

Adds a dedicated Kubernetes datasource that fetches logs directly from the k8s API server, streaming container logs from pods selected by labels, giving CrowdSec native k8s log acquisition without an agent proxy. Exposes a cs_kubernetessource_hits_total Prometheus counter labeled by datasource_type.

Adds cs_machines_heartbeat_seconds for tracking agent heartbeat timing and cs_machines_last_heartbeat_timestamp, a gauge exposing the Unix timestamp of the last heartbeat received from each machine.

Revamps cscli console status into an all-in-one status view for console enrollment and feature status, and improves cscli hub list output.

$ cscli console status

Introduces custom container pull policies (open beta): organizations write Rego expressions submitted as YAML manifests, managed via chainctl, supporting parameters with per-binding values and an ENFORCE mode that blocks pulls. The new chainctl policies custom validate subcommand reports the exact line and column of a policy error before storing it, enabling CI validation of Rego policy manifests.

Enables build pinning for all organizations using Chainguard Libraries with upstream fallback across JavaScript, Python, and Java, recording the first-resolved copy of each package version to keep lockfiles and checksums stable. The new chainctl libraries cache command lets you review which package-version copies (upstream mirror or Chainguard rebuild) your organization holds, or opt out of build pinning.

$ chainctl libraries cache

New Commit Verification capability enforces cryptographically signed commits against a per-repository policy, supporting keyless (Sigstore) signatures and static keys such as GPG.

New .chainguard/ configuration model enables Guardener GitHub App capabilities (Hardened Actions, Commit Verification) per repository via committed config files.

Extends chainctl self-update on Windows to replace the running executable correctly and verify release attestations before installing, without requiring administrator privileges.

New Hardened Actions capability recommends and migrates GitHub Actions to Chainguard's hardened, SHA-pinned equivalents, delivered via non-blocking PR review comments or scheduled/on-demand migration pull requests.

The container images kube-conformance:1.32, kubernetes:1.32, nextcloud-server:31, rke2-runtime:1.32, and teleport:17 have passed their grace periods and are no longer available.

The Unroll processor splits log entries containing arrays or slices of events into individual log events before parsing and ingestion. When inputs are raw string payloads, a Transform processor (e.g. set(body, ParseJSON(body))) must be positioned immediately before the Unroll processor in the pipeline execution sequence.

SumoLogic Terraform Provider v3.3.0 adds two new resources: sumologic_async_aws_lambda_invocation and sumologic_s3_logging_lambda_enable.

Dashboards gain two auto-refresh guardrails: auto-refresh pauses when a tab is hidden for more than 10 minutes and resumes automatically on return, and a panel is dropped from auto-refresh after 5 consecutive query failures so it doesn't disrupt other healthy panels.

Sumo Logic now lets admins provision the SOC Analyst Agent when creating or editing a child org baseline, alongside existing Logs, Metrics, Traces, and Cloud SIEMCloud SIEMA Security Information and Event Management platform delivered as a hosted service, aggregating logs and alerts from across an environment to detect threats without requiring on-premises infrastructure. Enterprise baselines, with a configurable Number of investigations per day control and optional overage.

An Inactive user account auto-disable option in the User Accounts app Settings menu (top right of console) lets administrators automatically disable local accounts inactive for 30, 60, 90, or 180 days. Accounts disabled this way appear grayed out on the Select business page for multi-business users, and disabled users attempting to sign in see a clearer message directing them to contact their administrator. A new Status set by column in User Accounts shows whether an account's status was last changed by a user or the system, all auto-disable configuration changes and disable actions are recorded in the audit log, and an email notification is sent to a local user account when the system automatically disables it for inactivity.

Corellium added the Arm RD-1AE virtual hardware platform to the Arm Virtual Hardware platform powered by Corellium, virtualizing an advanced automotive reference design with Neoverse-V3AE application processors, Cortex-R82AE safety islands, and a Cortex-M55 Runtime Security Engine. The platform supports execution of Type 1 and Type 2 hypervisors, including the Xen hypervisor from Arm's reference software package, and includes SystemReady IR support, Arm Trusted Firmware, and trusted services. Pre-built RD-1AE software images covering the full set of Arm reference software deliverables are selectable at device creation time, and the platform boots to a Linux prompt in under 30 seconds on AWS Graviton 3 instances.

⤢

Improves guidance on the Web Filtering pages in Mobile Threat Defense policies for Android and iOS, and the Chrome Security policy for ChromeOS, clarifying that protocol prefixes such as https:// or chrome:// must not be included in the Allowed domains and Blocked domains fields.

Each host now receives a label (Benign, Suspicious, Malicious, Honeypot, or Inactive), a 0–100 score, a confidence level, and evidence for the top five signals that influenced the assessment, generated using a SHAP (SHapley Additive exPlanations) model. Some data fields from the legacy reputation score method changed as a result, so existing queries or integrations relying on those fields should be reviewed against Censys documentation before upgrading.

⤢

ASM web scanning switches to ActiveDNS resolution, increasing detected web entity counts by 0–10% while reducing false-positive host counts by 2–15%; host counts drop correspondingly because bare IPs not seen in the last 24 hours are no longer retained and only the most recent active resolution is shown.

Adds a new Forgejo software fingerprint to the Platform to detect self-hosted Forgejo Git forge instances, and an Exposed Forgejo Application risk fingerprint to ASM that flags exposed HTTP services running Forgejo due to the sensitive source code, credentials, and CI/CD configs they may contain. New risk types like this may be disabled by default, so workspaces should check risk type configuration in the ASM web console to enable them.

Web entity instances are now limited to a maximum of one per web entity, representing only the most recent active IP resolution rather than all historical resolutions; as a result the web_entity.instance_count field will show significantly reduced values after migration, requiring review of any dashboards or alerting thresholds based on instance counts.

ASM now automatically captures web screenshots for every web entity in inventory, storing exact timestamps and a historical view over time so analysts can surface exposed login pages, admin panels, and potentially compromised infrastructure.

ASM adds JavaScript risk detection to identify and flag vulnerabilities in end-of-life JS libraries, enabling rapid response to JS-related incidents such as React2Shell. As with other new risk types, this may be disabled by default and require enabling via risk type configuration in the ASM web console.

Introduces the Aembit Edge SDK (TypeScript and Python): in-process libraries that handle workload attestation, token lifecycle, and credential retrieval with no proxy required, suited for serverless functions, ephemeral CI containers, and restricted runtimes. It supports seven Trust Providers — AWS Metadata Service, AWS Role, Azure Instance Metadata Service, GCP Identity Token, GitHub, GitLab, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. ID Token — with integration guides for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., AWS Lambda, GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Vercel OIDC.

The Windows MSI installer now applies AEMBIT_TENANT_GRPC_PING_INTERVAL_SECS and AEMBIT_TENANT_GRPC_PING_TIMEOUT_SECS when passed as install-time properties. The Linux installer script now validates Agent Proxy arguments — including numeric environment variables such as AEMBIT_HTTP_IDLE_TIMEOUT_SECS — before installation proceeds.

$ msiexec /i AembitCLI.msi AEMBIT_TENANT_GRPC_PING_INTERVAL_SECS=30 AEMBIT_TENANT_GRPC_PING_TIMEOUT_SECS=10

Adds authorizationChain to Agent Proxy workload events — an ordered list of context IDs for the authorization events behind a request, enabling full trace-back to the directive and credential retrievals. Also adds severity, outcome.result, and outcome.reason to response events when Aembit answers in place of the Server Workload, so the outcome is no longer cleared between request and response.

Aembit CLI 1.34.5772 adds aembit_agent_cli_linux_amd64_glibc_<version>.tar.gz as a second Linux amd64 archive, dynamically linking against glibc 2.28 or newer, for organizations whose policy requires glibc or to work around DNS resolution issues caused by musl's stricter handling of resolver responses.

Adds provider_key (string) and fallback_to_native (boolean, default true) fields to the feature config object in the Management API for programmatic engine selection and fallback control. A new Marketplace UI lets you connect third-party identity verification providers and choose, per workflow feature node, which engine runs the check via a Verification engine control on the node's first configuration tab, with status labels Active, Switch, and Connect and inline provider setup without leaving the workflow builder. A 'Fall back to Didit if my provider fails' toggle (default on) automatically runs Didit's own engine if the selected third-party provider is unavailable.

{
  "config": {
    "provider_key": "your-provider-key",
    "fallback_to_native": false
  }
}

{
  "config": {
    "provider_key": "your-provider-key",
    "fallback_to_native": true
  }
}

Adds face_retention_policy and face_retention_days fields on PATCH /v3/webhook/ to configure biometric-template retention at the application level, keeping image-free face embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. alive for duplicate detection, Face Search, and biometric authentication after session data is purged. A retain_face_embeddings parameter on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ overrides that policy per call, and a Retain biometric template toggle with a required finite retention period is available in App Settings → Data.

$ curl -X PATCH https://api.didit.me/v3/webhook/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"face_retention_policy": "retain", "face_retention_days": 90}'

$ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"retain_face_embeddings": false}'

New Biometric Templates API — GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /v3/biometric-templates/{template_uuid}/, DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ — lists, counts, inspects, and purges retained templates, with every retain and purge action audited.

Adds deletion_instruction: "privacy_erasure" (with instruction_id) on session deletion to purge all retained biometric templates for a person regardless of application policy. POST /v3/users/delete/ now purges a user's retained biometric templates before deleting the user, returning 503 (retryable, nothing deleted) if a template cannot be purged.

$ curl -X POST https://api.didit.me/v3/sessions/delete/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "<your-instruction-id>"}'

New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically, with matching library and install endpoints for browsing, installing, and removing preset rules from the rule library.

DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on a 204 response will break and must be updated.

New AI-assisted rule migration workflow lets the Didit assistant, or any MCP-connected agent, map a rule set exported from another provider (CSV or Excel) onto Didit's rule schema, backtest it against your transaction history, and create the rules in test mode for review before activation.

A new Access Risk Detection capability builds a unique behavioral profile per user from 60 days of continuous activity or the last 50 successful logins, then correlates concurrent signals (e.g., unfamiliar browser paired with impossible travel) into a single weighted risk score. Events are mapped into three severity tiers — Low, Medium, and Critical — and privileged account weighting applies a higher score to deviations on admin profiles than on standard user accounts. Automated step-up MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. verification loops trigger additional authentication when anomalous login signals are detected, reducing false positives. A dedicated Needs Review dashboard filters out auto-resolved events, surfaces granular telemetry, supports custom admin filters, and allows compliance notes to be attached directly to an incident.