PAGES
Subscribe Get it delivered — five to ten releases we picked each morning from the tools you run, with every release in the issue on the web. Compare plans →

The Cyber Toolchain — issue 074, September 14, 2026

THE CYBER TOOLCHAIN NO. 074
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED SEPTEMBER 14, 2026 · EVERY DAY
EDITIONS tail grep head ls diff uniq

The daily firehose — everything the toolchain shipped today, already filtered.

We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.

VIEW
ISSUE VIEW scroll
INFORMATION DENSITY everything
ISSUE WIDTH reading width
Do you prefer scroll?
ADDITIONAL FILTERS 
$ tct list   # 21 tools matched

What stands out across today's releases, grouped by what it lets you do. Every tool named links to its entry below.

Three unrelated things stand out. Endor Labs now flags unpinned dependencies as Potentially Affected for malware, closing the blind spot where a floating version range could resolve to a poisoned package. Cloudflare's Passive DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. shows you where sensitive data actually flows before you write a blocking policy. ALEAPP and iLEAPP take raw and E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. images directly, skipping the extraction step.

  • protect

    Catch malicious packages you can't prove you didn't pull

    Endor Labs classifies unpinned dependencies as Potentially Affected rather than clean, with policy parameters to tune the noise — the gap where a caret range silently resolves to a compromised release. OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories.-Scanner now reads Git dependencies natively as pkg:git PURLs, so vendored and source-pinned code stops being invisible to the scan, and Cloudsmith exports vulnerability and malicious-package findings as JSON for downstream tracking.

    Endor Labs · OSV-Scanner · Cloudsmith

  • identify

    See what sensitive data is moving before you block any of it

    Passive Detection profiles matches across Gateway traffic without enforcing, so a DLP rollout starts from measured flows instead of a guess. The usual failure — turning on a policy and breaking a business workflow nobody documented — becomes a report you read first.

    Cloudflare

  • respond

    Parse a phone image without staging an extraction first

    Both now ingest raw disk images and E01 acquisitions directly (-t raw in ALEAPP) and parse F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices., the filesystem on much modern Android. That removes a mount-and-export step per device and keeps the acquisition as the working artifact, alongside new app coverage including Blink, MEGA, Garmin Connect and Tutanota.

    ALEAPP · iLEAPP

Application Security
◆  SAST / SCA / Code Security

ZeroPath

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 75/65/65, +15 breaking change, +6 runnable example — 89.33 How ranking works →

ZeroPath is an AI-native SAST platform that finds 2x more real vulnerabilities with 75% fewer false positives.

ZeroPath's latest release centers on syncing GitHub and Bitbucket repository permissions into its own 39-permission model, alongside new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for AI coding assistants, Microsoft Teams notifications, continuous scanning, and a set of breaking API and permission changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 2 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Access sync and permission import from GitHub and Bitbucket new 75

ZeroPath now imports repository permissions from GitHub (five roles, including direct collaborators) and Bitbucket (Cloud workspace groups and Server project groups), mapping provider roles onto ZeroPath's own model of 39 permissions across 10 groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Mechanism and scope given, but no UI or API steps to invoke it changelog-20260914-ed06a3ad
02 00
Microsoft Teams notification channel new 65

Scan notifications and vulnerability alerts can be routed to a Microsoft Teams channel via an Incoming Webhook connector, without an Azure AD app registration; the webhook URL is added under Settings -> Connections -> Notifications, with rules to select which events (scan complete, new vulnerability, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. breach) reach that channel.

Route scan notifications and vulnerability alerts to a Microsoft Teams channel without an Azure AD app registration.
📍In Microsoft Teams: 1. Open the channel you want to receive alerts -> Manage channel -> Connectors -> Incoming Webhook -> Configure. 2. Copy the generated webhook URL. In ZeroPath: 3. Go to Settings -> Connections -> Notifications. 4. Add a new Microsoft Teams channel and paste the webhook URL. 5. Configure notification rules to select which events (scan complete, new vulnerability, SLA breach) reach that channel.
— Concrete UI navigation and webhook setup steps given changelog-20260914-ed06a3ad
03 02
Granular permissions for integrations, repositories and ticketing breaking 65

Connecting an integration now requires the Create Integrations or Create Installations permission, adding a repository by URL requires Create Repositories, and creating Jira and Linear tickets is now a per-repository permission that organizations using access control must explicitly grant.

— Names exact permissions but not how to grant them changelog-20260914-ed06a3ad
└──▷ BREAKING ON UPGRADE
  • !
    On repository objects, lastScanError is replaced by lastScanFailure; any API consumer reading lastScanError will receive no value.
  • !
    Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — consumers must treat these fields as optional.
  • !
    On secret findings, the dismissal explanation generated by ZeroPath is withheld from the API response; only a reviewer's own note is returned.
  • !
    Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories.
  • !
    Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it.
Was this useful?

Veracode

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 73, +15 breaking change, +6 runnable example — 94 How ranking works →

Veracode is a cloud-based application security platform that performs static, dynamic, and software composition analysis to identify vulnerabilities in code.

Veracode added automated SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. remediation via a new fix command and ended support for its legacy eLearning REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 1 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Automated SCA vulnerability remediation patches new 73

After a software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scan, Veracode can automatically generate a remediation patch for a vulnerable dependency identified in your project, triggered via veracode fix sca.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

After an SCA scan, automatically generate a remediation patch for a vulnerable dependency identified in your project.
$ veracode fix sca
— Names the exact command but not scope of supported ecosystems changelog-20260914-4d08813d
└──▷ BREAKING ON UPGRADE
  • !
    Veracode eLearning REST API has reached end of support — Veracode will no longer update this API or provide technical support.
Was this useful?

Semgrep

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 50, +15 breaking change — 65 How ranking works →

Get started with Semgrep to help you catch, flag, and fix real vulnerabilities before they ship.

└──▷ WHAT SHIPPED · 1 FEATURE 1 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
General availability of Autofix new 50

Autofix is now generally available for all customers, running on demand per finding via the finding page or via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names entry points but no API endpoint or flag. changelog-20260914-8778169c
└──▷ BREAKING ON UPGRADE
  • !
    Homebrew installs of Semgrep are no longer supported on Intel Macs.
Was this useful?

Cloudsmith

Sources Blog / feed → 2 releases · 2026-09-14 Blog Rank Why this rank top features scored 55/33, +10 product media, +6 runnable example — 60 How ranking works →

Cloudsmith added two web app features this window: JSON export of vulnerability and malicious package findings, and per-package audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

A fully-managed, enterprise-scale solution to control, secure, and distribute software packages and containers.

Cloudsmith added two web app features this window: JSON export of vulnerability and malicious package findings, and per-package audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Export vulnerability findings as JSON new 55

Cloudsmith now lets you export vulnerability and malicious package findings as a JSON file directly from the Cloudsmith web app, useful for offline analysis or compliance reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ In the web app, navigate to your repository's vulnerability findings view and select the option to export findings as a JSON file, or use the Download vulnerability data option on a package's Overview tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Download a snapshot of all vulnerability and malicious package findings for offline analysis or compliance reporting.
📍In the Cloudsmith web app, navigate to your repository's vulnerability findings view and select the option to export findings as a JSON file.
— Names format and UI path but no endpoint or size limits Download package vulnerability findings from…
02 00
Per-package audit logs new 33

Cloudsmith adds a per-package audit trail in the web app showing what changed, who changed it, and when.

— Describes purpose but no fields, retention or access details Track every change to your packages with pac…
Was this useful?

OWASP dependency-track

Sources Release notes → 1 release · 2026-09-14 Notes Rank Why this rank top features scored 40 — 40 How ranking works →

Dependency-Track is a software composition analysis platform that identifies and monitors vulnerabilities in application dependencies and third-party components.

Dependency-Track 4.14.4 adds support for ingesting and processing SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in the CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. schema.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
CycloneDX 1.7 SBOM support new 40

Dependency-Track can now ingest and process SBOMs using the new CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 schema version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names the schema version but no mechanism or scope details. 4.14.4
Was this useful?

Codacy

Sources Blog post → 1 release · 2026-09-14 Blog Rank Why this rank top features scored 85/65, +6 runnable example — 81 How ranking works →

Codacy introduced Codacy Skills, splitting the offering into a local Analysis CLI Skill for pre-commit scanning and a cloud-backed Code Review Skill for pull request review, both distributed as Claude Code plugins under the Agent Skills standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Documentation homepage for the Codacy automated code review tool.

Codacy introduced Codacy Skills, splitting the offering into a local Analysis CLI Skill for pre-commit scanning and a cloud-backed Code Review Skill for pull request review, both distributed as Claude Code plugins under the Agent Skills standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Analysis CLI Skill for local pre-commit scanning new 85

Installable via npm i -g @codacy/analysis-cli and claude plugin install codacy-skills@codacy (with claude plugin marketplace add codacy/codacy-skills to add the marketplace), this skill lets AI agents — Claude Code, OpenAI Codex, GitHub Copilot — run Codacy static analysis locally before a commit, with no Codacy account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Analysis can be scoped to specific files, staged changes, a branch, or an open pull request via @codacy/analysis-cli, and when connected to a Codacy account it syncs local rulesets so checks match the standards enforced at the merge gate. It follows the Agent Skills standard, so it works across multiple coding agents, not just Claude Code.

Install the Analysis CLI and Codacy Skills plugin into Claude Code to enable pre-commit scanning with no account needed.
$ npm i -g @codacy/analysis-cli
claude plugin marketplace add codacy/codacy-skills
claude plugin install codacy-skills@codacy
— Names install commands, scoping options and ruleset sync mechanism launch-20260914-e9ff6a7c
02 00
Code Review Skill for cloud PR reviews new 65

Installed via npm install -g @codacy/codacy-cloud-cli and authenticated with codacy login, the Code Review Skill reviews an open pull request against quality gates, coverage, and cloud analysis results.

Install the Cloud CLI and authenticate to enable the Code Review Skill, which reviews an open PR against quality gates, coverage, and cloud analysis.
$ npm install -g @codacy/codacy-cloud-cli
codacy login
— Exact install/auth commands given but review mechanism only briefly described launch-20260914-e9ff6a7c
Was this useful?
Reverse Engineering, Malware & Forensics
◆  Digital Forensics & Incident Response

ALEAPP

Sources Release notes →Source code → 1 release · 2026-09-13 Notes Code Rank Why this rank top features scored 85/65/40, +6 runnable example — 69.33 How ranking works →

ALEAPP v2026.4.0 adds direct raw/E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. disk image ingestion via a new -t raw flag, F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. filesystem parsing support, and expanded Android app artifact coverage — full Blink camera/doorbell parsing, MEGA cloud storage caches, and newly named support for Kwai, Avast Cleanup, and YouCam Perfect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Android Logs Events And Protobuf Parser

ALEAPP v2026.4.0 adds direct raw/E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. disk image ingestion via a new -t raw flag, F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. filesystem parsing support, and expanded Android app artifact coverage — full Blink camera/doorbell parsing, MEGA cloud storage caches, and newly named support for Kwai, Avast Cleanup, and YouCam Perfect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 5 FEATURES 0 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Raw/E01 image input via -t raw flag new 85

Adds the -t raw flag to read raw disk images and E01 acquisitions directly, enabling forensic analysis without prior extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Example usage: python aleapp.py -t raw -i <path_to_image.E01> -o <path_for_report_output>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Parse a raw disk image or E01 acquisition directly without extracting it first — useful when working with full-device forensic captures.
$ python aleapp.py -t raw -i <path_to_image.E01> -o <path_for_report_output>
— Names exact flag and includes a runnable command. v2026.4.0
02 00
Blink camera/doorbell artifact parsing new 65

Adds full Blink camera/doorbell artifact support for Android, covering Camera Information, Camera Entitlements, Syncmodule Information, Syncmodule Entitlements, and Network Information, all parsed from the BlinkRoom database.

— Lists five specific artifact categories and the source database. v2026.4.0
thinner coverage below
03 00
F2FS filesystem support new 40

Adds F2FS filesystem support via re-vendored qnxprobe, allowing ALEAPP to parse Android devices formatted with F2FS.

— Names the underlying library but gives no usage command. v2026.4.0
04 00
MEGA cloud storage artifact support new 30

Adds MEGA cloud storage node cache and media caches support for Android.

— Brief description with no further mechanism given. v2026.4.0
05 00
New app coverage: Kwai, Avast Cleanup, YouCam Perfect new 15

Adds new Android app coverage for Kwai, Avast Cleanup, and YouCam Perfect, named in the release summary but without artifact-level detail in this window.

— Only named in summary; no artifact or mechanism detail provided. v2026.4.0
Was this useful?

iLEAPP

Sources Release notes →Source code → 1 release · 2026-09-13 Notes Code Rank Why this rank top features scored 75/70/65 — 70 How ranking works →

iLEAPP v2026.4.0 adds direct CLI parsing of raw disk images and E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. acquisitions with new F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. filesystem support, plus new artifact coverage for Garmin Connect, Tutanota, MEGA, and expanded SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp/WiFi/KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

iOS Logs, Events, And Plist Parser

iLEAPP v2026.4.0 adds direct CLI parsing of raw disk images and E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. acquisitions with new F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. filesystem support, plus new artifact coverage for Garmin Connect, Tutanota, MEGA, and expanded SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp/WiFi/KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 7 FEATURES 0 OF 7 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Raw disk image and E01 input type new 75

Adds -t raw input type to parse raw disk images and E01 acquisitions directly from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names exact CLI flag and supported formats v2026.4.0
02 00
SMS preview attachment and metadata reporting new 70

Adds the apple_sms_preview_ktx_atx artifact (SMS & iMessage category) to surface Apple SMS preview attachments stored as ATX containers with .ktx extensions under com.apple.MobileSMS/Previews/Attachments/, and adds a Shared Name column to the Apple SMS Preview Cache artifact reporting contact card and location share titles from companion plists.

— Names artifact key, path, extension and new column v2026.4.0
03 00
F2FS filesystem support for raw images new 65

Adds F2FS filesystem support via re-vendored qnxprobe 1.28/1.29, enabling raw image parsing of F2FS volumes.

— Names library versions but not invocation v2026.4.0
thinner coverage below
04 00
New artifacts for Garmin Connect, Tutanota, and MEGA new 45

Adds full artifact coverage for Garmin Connect on iOS, including the Move IQ activity series, plus new artifact coverage for Tutanota and for MEGA cloud storage.

— Names apps but no schema or fields given v2026.4.0
05 00
WiFi geotag linking in Known Networks artifact improved 30

Links WiFi network store geotags to their networks through recorded relationships in the WiFi Known Networks artifact.

— Names artifact but not the relationship mechanism v2026.4.0
06 00
Timestamp-based KML placemark naming improved 30

Names KML placemarks by timestamp in two location artifacts for clearer geographic reporting.

— Two artifacts affected but not identified v2026.4.0
07 00
Expanded WhatsApp call record parsing improved 20

Expands WhatsApp call record parsing to include additional call record fields on iOS.

— No fields named, vague scope v2026.4.0
Was this useful?

Mobile Verification Toolkit

Sources Release notes →Source code → 1 release · 2026-09-14 Notes Code Rank Why this rank top features scored 86/62/48, +6 runnable example — 71.33 How ranking works →

MVT's latest release focuses on forensic accuracy and robustness: bugreport analysis now respects device timezones, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. loading is deferred for efficiency, and corrupted sysdiagnose archives fail gracefully instead of silently aborting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

MVT's latest release focuses on forensic accuracy and robustness: bugreport analysis now respects device timezones, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. loading is deferred for efficiency, and corrupted sysdiagnose archives fail gracefully instead of silently aborting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Timezone-aware bugreport timestamp analysis new 86

Adds --timezone/-t option to mvt-android check-bugreport, accepting an IANA timezone name (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Europe/Paris), so bugreport file timestamps are interpreted in the device's wall-clock zone rather than the analysing machine's timezone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ If not specified, it falls back to reading persist.sys.timezone from the bugreport's SYSTEM PROPERTIES section automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Analyse a bugreport from a device known to be in a specific timezone when persist.sys.timezone is absent or unreliable in the archive.
$ mvt-android check-bugreport --timezone 'America/New_York' -o ./results/ bugreport-2026-09-14.zip
— Full mechanism, fallback behaviour, and runnable command given. v2026.9.14
02 00
Graceful handling of corrupted sysdiagnose archives improved 62

Unreadable or truncated sysdiagnose archives now trigger a critical-level log message and a clean exit code 1, instead of a silent 'Aborted!'. This is achieved by catching tarfile.ReadError, EOFError, zlib.error, and OSError.

— Names exact exceptions and exit behaviour, but no user command. v2026.9.14
thinner coverage below
03 00
Deferred STIX IOC loading improved 48

mvt-android and mvt-ios subcommands that list modules or reject invalid paths no longer parse IOC files unnecessarily, since STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. indicator loading is now deferred until first use.

— Explains behaviour change but no direct user action. v2026.9.14
Was this useful?
Network Security
◆  Firewalls & Network Defense

Clavister Knowledge Base

Sources Blog / feed → 1 release · 2026-09-14 Blog Rank Why this rank top features scored 45 — 45 How ranking works →

Clavister Knowledge Base is a technical documentation repository providing security solutions, product information, and support resources.

Clavister NetWall gained the ability to act as a DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows.) gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
DNS-over-TLS gateway support in NetWall new 45

NetWall can now terminate DNS-over-TLS (DoT) connections by configuring the cOS Core TLS functionality within an IP Policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names cOS Core TLS and IP Policy but no config steps Using NetWall as a DNS-over-TLS (DoT) Gatewa…
Was this useful?
Detection & Response
◆  Endpoint Security (EDR/XDR)

Trend Vision One

Sources Blog / feed → 2 releases · 2026-09-14 Blog Rank Why this rank top features scored 40/40 — 40 How ranking works →

Trend Vision One is Trend Micro's cloud-based XDR platform providing unified security visibility and threat detection across endpoints, networks, and cloud environments.

Trend Vision One shipped faster device posture reporting for its Windows Zero Trust Secure Access module and expanded ChatGPT traffic inspection with an updated Prompt Scan engine on the On-Premises Gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Faster device posture reporting interval improved 40

The Zero Trust Secure Access Module for Windows reduces the device posture reporting interval from 5 minutes to 2 minutes, enabling faster detection of posture changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Clear before/after numbers but no config surface Zero Trust Secure Access Module for Windows …
02 00
ChatGPT unauthenticated traffic inspection and Prompt Scan update new 40

The Zero Trust Secure Access On-Premises Gateway adds support for ChatGPT unauthenticated traffic inspection, covering sessions where users have not signed into ChatGPT, and adopts the latest Prompt Scan engine to improve detection accuracy for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and harmful prompts.

— Names the capability and engine but no config detail Zero Trust Secure Access On-Premises Gateway…
Was this useful?
◆  Threat Intelligence

OpenCTI

Sources Release notes → 1 release · 2026-09-14 Notes Rank Why this rank top features scored 60/45 — 52.5 How ranking works →

Open Cyber Threat Intelligence Platform

OpenCTI added support for custom map tile sources and improved reliability for deployments behind load balancers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Custom PMTiles map source new 60

Admins can upload a custom PMTilesPMTilesA single-file archive format for storing map tiles, maintained by Protomaps, that lets cyber tools serve interactive maps from static storage without a tile server. file as the map source; it is stored in S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage (Silo or any S3-compatible storage) and replaces the previous file on upload, becoming active immediately with no extra steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names storage mechanism and upload behavior but no exact config path. product docs
thinner coverage below
02 00
Configurable keep-alive and headers timeout improved 45

Adds configurable keep-alive and headers timeout settings for deployments behind a load balancer (ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy./ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.), addressing intermittent 502 errors.

— Describes purpose and target setup but no exact setting names. 7.260914.0
Was this useful?
Exposure & Vulnerability Management
◆  Attack Surface & Exposure Management

Intruder

Sources Changelog → changelog · Sep 14, 2026 Changelog

Give feedback to the Intruder team so we can make more informed product decisions. Powered by Canny.

Intruder adds Additional Domains configuration for authenticated web app scans, enabling subdomain and cross-domain coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT
Include an API subdomain and an external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. in an authenticated scan so the crawler can follow full application flows without hitting domain boundaries.
📍In the Intruder console, open your web app target and go to Authentication settings. Locate the Additional domains field and add entries such as api.example.com and auth.example.com, then save and re-run the scan.
  • Adds an Additional domains field when setting up or editing authentication for a web app target, allowing trusted subdomains (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ api.example.com, auth.example.com) and external services (identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., CDNs, third-party APIs) to be included in authenticated scan scope.

1 detail in Everything

Was this useful?
◆  Vulnerability Management

OSV-Scanner

Sources Release notes → 1 release · 2026-09-14 Notes Rank Why this rank top features scored 77/60/40, +6 runnable example — 65 How ranking works →

OSV-Scanner v2.6.0 adds an experimental-plugins flag for extra file-type extractors, native Git dependency detection via pkg:git PURLspkg:git PURLsPackage URLs (PURLs) with a `git` type, a community-maintained scheme for uniquely identifying software packages by source; the `git` variant pins a dependency to a specific repository and commit rather than a registry release., and a multi-arch container image, alongside smaller improvements to SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. retry handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

OSV-Scanner v2.6.0 adds an experimental-plugins flag for extra file-type extractors, native Git dependency detection via pkg:git PURLspkg:git PURLsPackage URLs (PURLs) with a `git` type, a community-maintained scheme for uniquely identifying software packages by source; the `git` variant pins a dependency to a specific repository and commit rather than a registry release., and a multi-arch container image, alongside smaller improvements to SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. retry handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 5 FEATURES 0 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Experimental extractor plugins flag new 77

The --experimental-plugins flag enables additional file-type extractors that are not on by default; supported extractor names are documented in the Supported Inventory Types doc.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Example: osv-scanner scan source --experimental-plugins -r /path/to/your/dir.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Scan a directory using experimental extractors to cover newly supported file types not yet enabled by default.
$ osv-scanner scan source --experimental-plugins -r /path/to/your/dir
— Runnable command given but new extractor names not listed v2.6.0
02 00
Git-pinned dependency detection with pkg:git PURLs new 60

OSV-Scanner now extracts Git repository URLs and supports local OSV tag matching for Git-based dependencies, typing them as pkg:git PURLs. This applies to JavaScript lockfiles including package-lock.json, yarn.lock, pnpm-lock.yaml, and bun.lock.

— Names lockfiles and PURL type but gives no command v2.6.0
thinner coverage below
03 00
SPDX output retains unversioned packages improved 40

SPDX output now retains packages that lack a version or PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously., and merges related packages based on lineage relationships.

— Describes behaviour change but no example or flag v2.6.0
04 00
Multi-arch container image for scanner action new 30

Publishes a multi-arch (linux/arm64) container image for osv-scanner-action.

— Bare fact with no usage detail v2.6.0
05 00
gRPC retry backoff for scalibr plugins improved 30

Configures a retry policy with exponential backoff for transient gRPC errors in scalibr plugins.

— Mechanism named but no config surface or example v2.6.0
Was this useful?
Identity, Access & Data Protection
◆  Identity & Access Management

Didit

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 92/42/33, +6 runnable example — 61.67 How ranking works →

Didit's latest release enriches session results for digital-ID-wallet verifications with credential detail, adds a billing-rate preview to console lookup switches, and exposes per-country configuration for non-document ID lookup with retry and fallback controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Didit provides identity verification, fraud prevention, and transaction-monitoring APIs, SDKs, and MCP tools.

Didit's latest release enriches session results for digital-ID-wallet verifications with credential detail, adds a billing-rate preview to console lookup switches, and exposes per-country configuration for non-document ID lookup with retry and fallback controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Per-country non-document lookup configuration new 92

Non-document lookup can be enabled per country in the ID Verification step, letting users verify with just their national ID number instead of uploading a document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ In the Didit console, open your workflow, select the ID Verification step, go to the Countries tab, choose the target country, and toggle the non-document lookup method on; set the retry count (1–5) and choose a fallback action for each failure mode (partial match, no match, no source response).

Enable non-document lookup for a specific country so users can verify with just their national ID number instead of uploading a document — useful for markets where lookup sources have high coverage.
📍In the Didit console, open your workflow, select the ID Verification step, go to the Countries tab, choose the target country, and toggle the non-document lookup method on. Set the retry count (1–5) and choose a fallback action for each failure mode (partial match, no match, no source response).
— Exact console navigation, tab name, and retry/fallback parameters given. changelog-20260914-1233caae
thinner coverage below
02 00
Credential details in wallet verification results new 42

Session results for digital-ID-wallet verifications now include credential details: the wallet used, its issuing authority, the level of assurance asserted, and whether the signature checked out.

— Names the data fields added but no API path or schema. changelog-20260914-1233caae
03 00
Cost preview for console lookup switches new 33

The Didit console now shows a cost preview when configuring lookup switches: each lookup switch displays its billing rate before the configuration is saved.

— Describes UI behaviour but no exact navigation path. changelog-20260914-1233caae
Was this useful?

ConductorOne

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 60/45/30, +15 breaking change, +10 product media — 70 How ranking works →

ConductorOne replaced its single Product digest view with per-section overview dashboards across the admin nav, added a configurable bulk-request cap, and shipped role mining, access graph, and anomaly-detection UI improvements — alongside two breaking changes to automation expression syntax and the Findings Owner field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Govern workforce access, deploy AI agents, and get work done with C1.

ConductorOne replaced its single Product digest view with per-section overview dashboards across the admin nav, added a configurable bulk-request cap, and shipped role mining, access graph, and anomaly-detection UI improvements — alongside two breaking changes to automation expression syntax and the Findings Owner field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Anomaly detection pause for membership automation new 60

The membership automation edit drawer adds an Anomaly detection section with a Pause automation when anomalies are detected toggle and a view of removed members, allowing automations to halt when unusual membership changes occur.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names toggle and section but not exact configuration path changelog-20260914-87306871
thinner coverage below
02 00
Per-section overview dashboards across admin nav new 45

Adds dedicated overview dashboards to each major admin nav section, such as Identities & NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (with tabs and stat tiles for human users, service accounts, secrets, agents, and NHI counts), replacing the single Product digest view that previously aggregated this information.

— Names replaced view and one dashboard but no exact nav path changelog-20260914-87306871
03 00
Access graph highlights matched entitlement grants new 30

The access graph for a requested entitlement now shows its granted repositories with the searched-for repository highlighted as a match.

— Thin description with no navigation or scope details changelog-20260914-87306871
└──▷ BREAKING ON UPGRADE
  • !
    Automation expressions that reference the bare workflow context, or pass it directly to a function, no longer compile — expressions must name the step and field directly. Any automation using an indirect-reference expression will fail to save on next edit until rewritten to a static path.
  • !
    The Owner column, filter, detail field, API field, and audit-log event names on Findings are renamed to Assignee — integrations consuming the Finding object via API, webhook, or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. audit log must update to the new field and event names.
Was this useful?

JumpCloud

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 70/65, +15 breaking change, +10 product media, +6 runnable example — 98.5 How ranking works →

JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.

JumpCloud expanded its AI Gateway with MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connection status tracking, a guided Add MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. workflow, and mandatory app-based access scoping (with related breaking changes), while also adding AI agent identity registration, device-level MCP discovery with token/cost tracking, and a Custom Query Builder for compliance reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 2 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
AI agent identity registration with OAuth credentials new 70

Admins can register an AI agent identity under Identity Management > Agents, filling in name, owner, and company email, then generating OAuth client credentials on the Authentication tab so the agent can authenticate to JumpCloud resources, including the AI Gateway, independently of a human account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Register an AI agent identity and configure OAuth credentials so an AI agent can authenticate to JumpCloud resources independently of any human account.
📍In the Admin Portal, go to Identity Management › Agents and click + Add. Fill in the agent name, owner, and company email on the Details tab, then open the Authentication tab and generate OAuth client credentials for the JumpCloud AI Gateway.
— Exact navigation and steps make it directly actionable. changelog-20260914-6fcef65f
02 02
MCP connection status and Add MCP Server workflow new 65

The AI & SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. Applications tab now shows an MCP Connection Status column with values Discovered, Connected, and Not Available, and a new Add MCP Server workflow lets admins connect discovered MCP servers to AI Gateway without leaving the applications view.

— Names UI location and status values but not a runnable command. changelog-20260914-6fcef65f
└──▷ BREAKING ON UPGRADE
  • !
    MCP servers previously created without an associated SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. application or bookmark must now have one assigned in AI Gateway; access is not scoped by User Groups until an application is assigned.
  • !
    The custom app creation option has been removed from the Add MCP Server dialog; admins must use + New App to open the standard Add New SSO Application wizard when creating an app during server setup.
Was this useful?

1Password

Sources Changelog → 1 release · 2026-09-14 Changelog Rank Why this rank top features scored 60, +10 product media, +6 runnable example — 76 How ranking works →

1Password's browser extension now fully supports passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., and Watchtower can identify existing logins that are eligible to be upgraded to one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

All the latest releases from the 1Password team

1Password's browser extension now fully supports passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., and Watchtower can identify existing logins that are eligible to be upgraded to one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Passkey support with Watchtower upgrade alerts new 60

The 1Password browser extension now ships full passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support, letting users create and save passkeys for sites directly from the extension.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Watchtower has been updated to flag logins that can be upgraded to a passkey, so users can find and switch eligible accounts without manually checking each site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Find which of your saved logins can be hardened by switching to a passkey, without manually checking each site.
📍In 1Password, open Watchtower. Review the new passkey upgrade alerts — each flagged login identifies an account where you can replace your password with a passkey. Select a login and follow the prompt to create and save the passkey for that site.
— Names Watchtower and browser extension, gives a clear UI path. changelog-20260914-a09dc10e
Was this useful?
◆  Secure Access (VPN / SASE / ZTNA)

Zscaler

Sources Blog post → 1 release · 2026-09-14 Blog Rank Why this rank top features scored 70/70, +6 runnable example — 76 How ranking works →

Zscaler launched Zero Trust Exchange Agentic Operations, a new AI-driven operational layer pairing a hosted MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with the native ZAgent assistant, alongside OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly.-based governance controls for connecting and auditing third-party and custom AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Zscaler is a cloud-based security platform that inspects and filters internet traffic to protect organizations from cyber threats.

Zscaler launched Zero Trust Exchange Agentic Operations, a new AI-driven operational layer pairing a hosted MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with the native ZAgent assistant, alongside OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly.-based governance controls for connecting and auditing third-party and custom AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 2 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Zero Trust Exchange Agentic Operations with ZAgent new 70

Introduces Zero Trust Exchange Agentic Operations, a new hosted operational layer exposing intent-based tools and skills to first-party and third-party AI agents via a hosted Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Includes ZAgent, Zscaler's native agentic experience within the Experience Center, letting administrators describe objectives in natural language and receive coordinated responses from specialized Zscaler agents and skills.

Investigate why a user cannot reach a business-critical application using ZAgent in the Experience Center, without manually navigating multiple consoles or logs.
📍In the Experience Center, open ZAgent and type: 'Why can't [user] reach the finance application?' — ZAgent routes the request to the appropriate Zscaler agents and skills, gathers context, and returns a likely cause and recommended remediation.
— Names MCP server and ZAgent with a worked example, but no config/API detail 2026-09-14-ddbcce12
02 02
OAuth-based agent authorization and governance new 70

Supports connecting approved commercial AI clients (Claude, ChatGPT) and custom customer-built agents through an OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authorization flow, with per-user role-scoped consent and revocation. An Agentic Operations Gateway handles routing, identity, authorization, approval controls, and auditing for all agent interactions, with client registration and token lifecycle events recorded in Zscaler audit logs. Super Administrators can review and revoke authorization grants across the entire organization from a central view.

— Names OAuth 2.1, clients, and audit logging but no exact command or endpoint 2026-09-14-ddbcce12
Was this useful?
Governance, Risk & Compliance
◆  Integrated & IT Risk Management

CISO Assistant

Sources Release notes → 1 release · 2026-09-13 Notes Rank Why this rank top features scored 33 — 33 How ranking works →

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

CISO Assistant v4.0.3 gives admins the ability to enforce a single date format across all users on an instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Admin-enforced date format setting new 33

Admins can now force a single date format to apply for all users across the instance, standardizing how dates are displayed platform-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— States the change but no config key or UI path given v4.0.3
Was this useful?
◆  Continuous Control Monitoring (CCM)

RegScale

Sources Blog / feed → 1 release · 2026-09-13 Blog Rank Why this rank top features scored 80/55/30, +15 breaking change, +6 runnable example — 76 How ranking works →

RegScale's CLI added three new integration subcommands for third-party security data ingestion, deprecated the CSAM subcommand in favor of JCAM, and improved JCAM configuration checks with empty-role detection alongside new CLI-based service account management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

RegScale is a compliance management platform that automates regulatory assessments, documentation, and audit workflows for organizations.

RegScale's CLI added three new integration subcommands for third-party security data ingestion, deprecated the CSAM subcommand in favor of JCAM, and improved JCAM configuration checks with empty-role detection alongside new CLI-based service account management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Empty-role detection in jcam check_config improved 80

regscale jcam check_config now detects any role declared in jcamSystemRoles that matches no point-of-contact position in any JCAM system in scope, surfacing roles that would be created empty before they are built.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Catch unmatched roles in your JCAM configuration before provisioning, so no empty roles are created in scope.
$ regscale jcam check_config
— Names config key, mechanism, and a runnable command example. CLI 6.46.0 (2026-09-13)
thinner coverage below
02 00
New integration subcommands: archer, ibm, veracode new 55

Adds archer subcommand for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. Archer bidirectional integration, including login and sync commands, ibm subcommand for IBM AppScan file processing, and veracode subcommand to process Veracode export files.

— Names three subcommands but no flags or file formats detailed. product docs
03 00
Service account management from the CLI new 30

Adds ability to create and manage RegScale service accounts from the CLI.

— No commands, flags, or scope detailed. CLI 6.46.0 (2026-09-13)
└──▷ BREAKING ON UPGRADE
  • !
    The csam subcommand is deprecated; DoJ renamed CSAM to JCAM — use regscale jcam instead.
Was this useful?
// END OF TRANSMISSION

The Cyber Toolchain · curated daily · September 14, 2026
Releases & features from the open-source and commercial cyber tools that practitioners actually run.

▷ Subscribe
cyber-toolchain / feedback

Feedback on

compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback