The Cyber Toolchain — issue 075, September 15, 2026

The scan module now assigns CVSS scores with severity colours to detected CVEs and orders findings worst-first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ This is backed by a 6th column added to data/cve.csv carrying the CVSS score (list version 0.5), which requires sippts 4.2.1 or newer to read.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The new --chrome-user-data-dir flag lets you point gowitness at an existing Chrome User Directory, enabling reuse of an already-authenticated browser session (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ after manually logging into an SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. portal) across gowitness runs instead of re-authenticating each scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ gowitness scan single --url "https://internal.corp.example.com" --write-db --chrome-user-data-dir ~/.config/google-chrome/Default

Copilot auto model selection gains three optimization tiers — efficiency, balance, and intelligence — letting users control how auto weighs cost, quality, and response latency per prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The tier configuration is rolled out in Visual Studio Code, Copilot CLI, and the GitHub Copilot app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Workspace owners can now grant members individual read-only access to billing, usage, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. data without assigning the Manager or Owner role, via separate toggles for Billing, Usage, and OIDC privileges under Workspace Settings > Members.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Scan location exports now include HTTP Methods and Status Codes fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The CSV (Locations) export gets these columns appended at the end of each row, and the JSON and XML scan location export formats gain matching HTTP method and HTTP response code fields.

Adds Test Runs update and delete permissions, with Owner and Admin holding them by default while other roles require explicit grants; adds Admin-wide delete permissions across the platform; grants Security Engineer the ability to delete endpoints; and adds role and permission changes to the audit log under a new Role resource type, recording the role's identifier, permission set, and user-assignment actions as distinct events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds per-application security-test configuration overrides via a new Configuration tab on each application's Security Testing page, with settings marked as inherited from the environment or overridden for that application.

Adds Service Graph (Beta) to the API catalog, visualizing call relationships between services; enabled per workspace from admin settings.

Adds CreateFinding API opt-in synchronous mode that returns event IDs on completion; default asynchronous behavior is unchanged.

Adds an Active / Stale / Down status filter on the On-Prem Deployments screen for Satellites, Taggers, Sensors, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Runners, and AI Gateways alongside the existing lifecycle filter, and adds an Install Satellite action to the Taggers tab on On-Prem Deployments.

Extends Broken User Authentication tests to probe for unauthenticated access even when no authenticated baseline is available, reporting genuine resource-shaped responses as Medium, low-confidence unconfirmed findings.

Adds a generic_high_entropy_secret filter that suppresses false positives when the assigned variable name ends with checksum, with no loss of recall.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Extends the n8n MCP Access Token and n8n API Key detectors to recognize n8n hosts given as a container service name or as a scheme-less hostname, and to reject unreachable private IP hosts.

Zeek adds a UDP packet source via zeek -i udp::0.0.0.0:4789:vxlan (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without needing raw packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., using SO_REUSEPORT so multiple workers can kernel-load-balance the traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The new policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script adds VNI-aware connection tracking when this source is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ zeek -i udp::0.0.0.0:4789:vxlan

$ zeek -i udp::0.0.0.0:4789:vxlan policy/frameworks/conn_key/packet_source/udp/vxlan_vni

Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX. Setting it to JSON::STRING_ESCAPE_POLICY_TSV in local.zeek switches to reversible TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity.-style encoding for round-tripping binary fields.

redef Log::json_string_escape_policy = JSON::STRING_ESCAPE_POLICY_TSV;

Broker's legacy embedded WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server is fully removed: Broker::BrokerProtocol, Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy no longer exist, and the BrokerProtocol enum and the Broker manager's Listen() C++ method's optional BrokerProtocol argument have been removed. Use Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead.

Extends the known-certs, known-hosts, and known-services scripts with storage-framework options including enable_hosts_persistence, host_store_prefix, host_store_backend_type, and host_store_backend_options, using a SQLite backend under Cluster::default_store_dir by default.

Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format().

Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.

Extends the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer to forward SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. payloads from bindRequest/bindResponse to the GSSAPI and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. parsers, enriching ntlm.log and kerberos.log.

Extends krb_ap_request() event with an in_kdc_padata parameter to indicate whether the AP-REQ is embedded in KDC/TGS pre-authentication data, and populates the service and cipher columns in kerberos.log AP entries, which were previously unset.

Extends the HTTP analyzer with nine new weirds — HTTP_bad_chunk_size, HTTP_chunked_multi, HTTP_content_length_0_and_expect_100_cont, HTTP_content_length_leading_zeros, HTTP_bad_content_length, HTTP_obsolete_line_folding, HTTP_content_length_and_chunked, HTTP_content_range_and_chunked, and HTTP_expect_not_100_continue — for unusual Content-Length, Transfer-Encoding, and Expect header usage.

Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.

Adds ?as operator to test whether a value can be safely cast to a target type at script level, and extends the as casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions.

Adds dce_rpc_auth() event giving script-level access to the security provider, per-message protection, and authentication context in DCE-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. PDUs.

Adds policy/protocols/conn/multicast-participants.zeek, producing a new multicast_participants.log with IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address.-derived data about hosts participating in multicast connections.

Adds ssl_extension_encrypted_client_hello, an event carrying information about the TLS encrypted_client_hello extension, and ssl_extension_signature_algorithms_cert, raised for the TLS signature_algorithms_cert extension.

The Fastly JavaScript SDK 3.46.0 adds a CoreCache.transactionLookupAsync method for performing asynchronous cache transaction lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Cache Instance Encryption Type Query Filter to identify Cache Instances by encryption configuration (Customer-Managed Key vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Provider-Managed Key), defaulting to Provider-Managed Key detection, and Cache Instance Access Key Authentication Enabled Query Filter to identify Azure Cache for Redis instances where disableAccessKeyAuthentication is set to false. Adds Insights Cache Instance Not Using Customer Managed Key and Cache Instance With Access Key Authentication Enabled (aligned with CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Database Services Benchmark v2.0.0 Control 2.9). Expands the Azure Cache for Redis harvester to collect Customer-Managed Key (CMK) encryption properties from Azure Cache for Redis Enterprise resources.

Adds Distributed Table Public Network Access Query Filter to identify Azure Cosmos DB accounts with public network access enabled, and Distributed Table Without Diagnostic Logging Query Filter to identify Cosmos DB accounts missing a specified diagnostic log category, defaulting to allLogs. Adds Insights Distributed Table With Public Network Access Enabled (mapped to CIS Controls v8.1.2 safeguard 4.4, CMMC L1/L2, NIST SP 800-53 Rev. 5, and Microsoft Cloud Security Benchmark v1) and Distributed Table Without Diagnostic Logging, requiring the allLogs category. Expands the Azure Diagnostic Settings harvester to collect diagnostic settings for Cosmos DB accounts (Microsoft.DocumentDb/databaseAccounts) and the Distributed Table harvester to collect the public_network_access property.

Adds Database Instance Entra-Only Authentication Query Filter to identify Database Instances without Microsoft Entra-only authentication configured. Adds Insights: Database Instance Without Microsoft Entra-Only Authentication (PostgreSQL); Database Instance Public Network Access Enabled (SQL Server); Database Instance Without Secure Transport Enabled (MySQL), detecting Azure Database for MySQL Flexible Servers where require_secure_transport is not enabled; and Database Instance Without Connection Log Auditing Events (MySQL), detecting instances where audit_log_events does not include CONNECTION or CONNECTION_V2, aligned with CIS Azure Database Services Benchmark v2.0.0 Control 5.6. Expands the Azure Database Instance harvester to collect Microsoft Entra-only authentication status for Azure Database for PostgreSQL flexible servers.

Plerion adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 provisioning so Okta, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., or any SCIM 2.0 identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can create, update, and deactivate Plerion users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Existing users are matched by email address and adopted automatically into the SCIM-managed set.

Adds organization API keys scoped to the whole organization with read or readWrite access, intended for use by identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. performing SCIM provisioning.

The disable_block_device_use option is removed from runtime-rs as it was unsupported — configs referencing it will need to be updated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The cpu_nested_config override is removed from runtime-rs.

Passes block storage sources by file descriptor in runtime-rs/QEMU, enabling more secure and flexible block device attachment, and passes VFIO devices by file descriptor in runtime-rs/QEMU, enabling fd-based VFIO device handoff.

A Beta API for Lakebase supports create, get, list, and delete operations on point-in-time snapshots of a project branch, plus restoring a snapshot by creating a new branch from it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Preview feature that automatically captures a snapshot of Python variables and Spark session state from eligible serverless compute job runs, letting you restore them into a new interactive notebook to debug failures or explore results without rerunning the entire job.

New ai_transcribe SQL/AI function transcribes audio files to text, producing per-segment timestamps and automatic speaker labeling.

Adds the (?i) case-insensitive regex operator to the Censys Query Language (CenQL), enabling case-insensitive value=~ pattern matching in fields such as host.services.endpoints.http.headers and other string fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ host.services.endpoints.http.headers:(key="Server" and value=~"(?i)^nginx$" and not value="nginx")

Adds two new ASM risk fingerprints queryable via risks.name: Vulnerable GitLab Server (CVE-2026-85706) covering unauthenticated arbitrary file read via the repository commits API, and Vulnerable GitLab Server (CVE-2026-87719) covering authenticated credential leak via a GraphQL subscription in GitLab EE.

$ risks.name: "GitLab Server (CVE-2026-85706)"

Adds 22 new protocol, application, and endpoint scanners to the Platform: UTILINET_LPP, ORENCO_ATRTU, OPW_FSC3000 (Critical Infrastructure module); PIGEONHOLE, SAMSUNG_OFFICESERV, CISCO_SDWAN_VDAEMON, VANTAGE_INFUSION, CNORD_SECURITY_CENTER, VISIONHITECH_IPCAM (Starter/Search/Core); and OTLP_GRPC, NETFLIX_NRDP, HIKVISION_DNVRS, SPOTIFY_CONNECT, MANAGESIEVE, LIBP2P, TAURUS_STB, GEOVISION_AUDIO, BLUEMAX_NUTTCP, WOW_REALMD, THRULAY, STOMP, and CLAMAV (available to all users).

The Markdown editor used in Finding notes, descriptions, and other markdown fields now supports images via paste from clipboard, drag-and-drop, or the Insert image toolbar button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Images are stored by DefectDojo and render inline in the notes feed and in generated reports, removing the need for an external image host.

⤢

Fingerprint-based masking options — format-preserving masking, randomized response masking, and rounding/grouping using a data fingerprint — for Snowflake integrations are deprecated and will be removed from Immuta SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. on December 15, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Tenants without existing policies using these options can no longer create new ones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Consolidates administration previously requiring the Management Console into the Varonis web interface: creating and updating dictionaries alongside EDM classifiers and classification policies; creating, viewing, and managing users and roles; and managing permissions, groups, folder protection, and memberships directly from the Analytics page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a dedicated Activity tab inside the Account Pane that combines activity trends and detailed event logs in a single view, with interactive filtering and drill-down to identify spikes and accelerate investigations.

Introduces SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. with discovery, categorization, warning/blocking controls, and usage insights for shadow IT apps via the JumpCloud Go browser extension, and lets admins manually add applications for tracking, warning, and blocking before automatic discovery occurs (r2).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Renames it to AI & SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Management and significantly expands coverage of generative AI apps for discovery, adds the Shadow AI Dashboard for visibility into generative AI shadow IT usage, adoption by department, and most active users, and releases SaaS License Management to GA, automating license tracking for supported SaaS applications via connectors (r3).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Adds MCP Discovery and Token & Cost Tracking options under Access > AI & SaaS Management > Settings > Enhanced Discovery Options to discover MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and track token usage and estimated cost from Cursor, Claude Code, OpenCode, Codex, and VS Code Copilot CLI on managed Windows and macOS devices, and adds an MCP Connection column in Access > AI & SaaS Management > Applications showing Discovered, Connected, or Not Available status for each app, with Add MCP Server and View actions available inline (r4).

⤢ ⤢ ⤢

Releases Custom Admin Roles for all direct organizations, enabling granular role creation based on specific admin responsibilities (r3). Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations and a No Access permission to the Identity Management and Application Management scopes; splits Identity Management and Directory and Groups Management into separate, independently assignable scopes; moves Directory Management and Group Management under a unified Directory and Groups Management category, SaaS Applications and Asset Management under SaaS and Asset Management, and RADIUS Authentication under Access Management; includes Application Templates in the Applications scope and existing User Portal APIs/operations under the Multi-Factor Authentication scope; and renames Policy Management to Access Management, System Management to Devices, and Authentication Policies to Conditional Access Policies and IP Lists (r5 preview).

⤢ ⤢ ⤢

The GET request for api/systemusers/reactivate/{id} is deprecated and now returns a 404 error; replace it with POST https://console.jumpcloud.com/systemusers/reactivate/{id} with activation_email in the request body. Dynamic Groups API memberQuery filter operators $ge and $le are deprecated and replaced by $gte and $lte; existing API scripts using $ge or $le must be updated.

Adds forced re-authentication support: the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. now honors ForceAuthn="true" in SAML and prompt=login in OIDC, prompting users for credentials even with an active session; and adds Authentication Methods References (AMRAMRAutonomous Mobile Robot — a self-navigating wheeled platform that maps its environment and plans its own path; cyber tools might target AMR firmware or fleet-management APIs in OT/ICS assessments.) claims in both SAML assertions and OIDC ID tokens, tagging logins with proof of factors used (e.g., password + OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.).

<samlp:AuthnRequest ... ForceAuthn="true" ...>...</samlp:AuthnRequest>

Adds per-device macOS software update scheduling from the Admin Portal, including timeframe control and user deferral options; adds macOS Ventura upgrade-blocking software management policies so admins can delay or prevent unwanted upgrades to macOS 13; adds a Managed Login Items policy for macOS 13 Ventura to prevent end users from disabling persistent software such as the JumpCloud Agent; adds a Universal Browser Patch Management policy for Google Chrome across macOS, Windows, and Linux from a single policy; and adds a Browser Patch Management Policy Report and an OS Patch Management Policy Report for audit evidence and compliance status.

Raises item storage limits to 13,000 items with autofill enabled, 5,000 items per shared folder, and 30,000 items when autofill is not used; introduces an auto-lock schedule with a default of 15 minutes of inactivity and a maximum of 1440 minutes (24 hours), plus an Auto Lock setting that locks the app when the device is locked.

Enables MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. by default for all new admin accounts logging into the Admin Portal, splits WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. into separate Security Keys and Device credential types for enrollment, adds push bombing mitigation for JumpCloud Protect blocking more than one notification per resource within a sixty-second period (configurable in MFA Configurations), and adds lock-screen push notification approval or denial in JumpCloud Protect (long-press on iOS, expand on Android) when User Verification is not required (r1). Allows admins to enable password resets from the User Portal when MFA is enforced but the user has not yet enrolled (r2). Adds user group exclusion from JumpCloud Protect Push enforcement, allowing excluded groups to use TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. only (r3).

Adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admin ability to bulk-select and export reports across all tenant organizations as JSON or CSV from the Multi-Tenant Portal homepage, and adds MSP Custom Command Templates so MSP admins can create, save, and apply command templates across tenant organisations (r0). Adds ad hoc command execution on devices directly from the Multi-Tenant Portal and Admin Portal, the ability to add new users and devices, export user and device lists, and run bulk actions directly from the Multi-Tenant Portal, and MSP billing visibility for committed user license counts and JumpCloud contract downloads (r1). Adds Account > Settings > Global MFA Requirement in the Multi-Tenant Portal to bulk-enforce MFA for all MSP admins in a tenant (r2).

Adds Dynamic Groups for both devices and users, allowing admins to automate group membership via attribute-based rules with optional pre-review of membership changes; adds Vendor and Public IP Address as new attributes for dynamic device groups, and Manager as a new attribute for dynamic user groups.

Adds shared folder management for JumpCloud Password Manager from the Admin Portal, including manual per-folder sync from the desktop application (r1); admins can create and update shared folders and assign users or user groups to any shared folder, a Move All items button moves every item in a folder at once, and shared folder events sync to Directory Insights (r7).

Adds the JumpCloud Go browser extension enabling hardware-protected, phishing-resistant passwordless login using Apple Touch ID and Windows HelloWindows HelloA Microsoft authentication framework built into Windows 10 and later that lets users sign in via biometrics or PIN instead of passwords, giving cyber tools a phishing-resistant credential layer to build on. on managed macOS and Windows devices, and enforces it as the default MFA method for conditional access policies on SSO apps with user and device verification on every application session (r1). JumpCloud Go sessions now automatically refresh on device login or unlock, enabling seamless access to protected resources without additional MFA challenges, and a new User Portal > Security > Multi-Factor Authentication section lets users manage JumpCloud Go sessions per device (r2).

Promotes Access Risk Detection to general availability, providing behavior-based detection of unusual locations, impossible travel, unfamiliar devices, dormant accounts, and abnormal login volumes, with configurable risk factors, automatic MFA-based resolution, intelligent VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./gateway suppression, and email, Slack, and webhook notifications.

Adds a Command After Agent Install command type so admins can specify enrollment commands to run immediately after the JumpCloud agent is installed on new devices, and adds a Running column to the commands queue to distinguish commands waiting in queue from commands actively running (r0). Adds Background Tools remote command line and remote file transfer capabilities, letting admins access an end-user's device and transfer files without disrupting their work (r1).

MCP servers in AI Gateway must now be associated with an SSO application or bookmark via the App dropdown, enabling group-based access scoping; a + New App option opens the standard Add New SSO Application wizard during server setup. Previously created MCP servers without an associated application must be assigned one or access will not be scoped by User Groups.

Introduces JumpCloud Remote Assist for unlimited remote desktop access and support on Windows and macOS — free, installed silently via JumpCloud Agent v1.61.0 or later (r0). Adds user-switching between accounts during Remote Assist sessions on Windows devices, a Ctrl+Alt+Del command shortcut from the Session Options toolbar, and support for viewing and interacting with the initial login screen on Windows servers (r1). Ships Remote Assist as two separate architecture-specific packages — ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. for Apple Silicon and x86_64 for Intel Macs (r2).

Adds certificate (passwordless) based authentication to JumpCloud RADIUS, supporting any X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. compliant certificate authority — existing certificates can be imported and used for RADIUS auth; adds RADIUS authentication with Azure AD as the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., enabling secure RADIUS access without managing users outside Azure AD (r0). Adds faster reconnect for EAP connections by allowing recently authenticated devices to skip the full security handshake using a cached session credential (r3).

Introduces Agent Identities so admins can register an AI agent with OAuth client credentials for the JumpCloud AI Gateway and scope its SSO application access via Agent Groups, keeping automated agents auditable and separate from human accounts.

Adds support for escaping the pipe | character with backslash \\ inside in and nin API filter operators (e.g. GET /systemusers?filter=department:$in:...), enabling pipe characters in search terms.

Admins can install and update the Password Manager desktop app using a new command template v.2.0.0 on Windows and macOS devices, removing the need for users to have admin permissions for subsequent updates.

Adds a Password Manager Desktop App Linux build (Debian/Ubuntu x86) with improved security and automatic updates (r1); adds an ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build for macOS devices with M-series silicon (M1 and above), available on the Downloads page with automatic update to the ARM build when applicable, and an RPM build for Linux (x64 Red Hat distributions such as Fedora), auto-updating and stable, alongside the existing Debian build (r7).

Adds an Asset Manager role in the Admin Portal providing dedicated Asset Management access without broader admin permissions; adds file upload functionality (Invoice field) to asset records under Purchase Details with support for custom fields of the File Upload type; adds Disk Size to Hardware Specifications for tracking device storage capacity; adds a Local Device Accounts display on the Asset Detail page under Device Management; and adds asset cloning, automatically clearing unique fields to prevent duplicates.

Introduces JumpCloud Access Requests, enabling approval flows for access requests submittable from the JumpCloud User Portal and manageable in the admin console; adds webhook support to integrate with external ticketing systems such as JIRA, automatically creating tickets on new request submission; and tracks Access Request events in Directory Insights.

⤢

Adds the JumpCloud Case Portal under the Support menu, centralising all organisation cases and ideas into a filterable list with clickable case numbers (r0). Introduces the Customer Portal for tracking and managing support cases, with sortable columns for Last Modified Date, Account, and Requester, plus attachment uploads and inline ticket editing, and adds MTP admin access to view and create support cases for all managed tenant organizations (r3).

Adds Android zero-touch enrollment support for fully managed, dedicated, and company-owned Android devices with a work profile (r1); adds Android EMMEMMEnterprise Mobility Management: a category of software for enforcing policies on mobile devices, apps, and data, giving cyber tools a hook to monitor or control endpoints without managing the full OS. support for fully managed and dedicated devices with 7 new policies including Factory Reset Protection, Kiosk Mode, and System Updates, plus Android EMM work profile support for enrolling and managing company-owned and personal Android mobile devices (r1); and adds full Android 15 support in MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. (r2).

Supports BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. enrollment of iOS/iPadOS 18+ devices via Account-Driven User Enrollment (ADUE) in MDM, now in general availability, and adds two new MDM policies to restrict Apple Intelligence features on iOS/iPadOS 18.1 and macOS 15.1 Sequoia devices (r2). Adds Apple Business Manager as a new service discovery method for Account-driven Enrollment, and adds IPA file support to the JumpCloud Private Repository for uploading and deploying iOS and iPadOS app packages (r3).

Launches JumpCloud App Catalog for Windows, enabling install and auto-update management for 1Password, Adobe Acrobat Reader DC, Chrome, Firefox, Google Drive, OneDrive, OpenVPN, Slack, Webex, and Zoom.

⤢

Adds SentinelOne integration via the Commands feature to download and install the SentinelOne Agent on macOS, Windows, and Linux devices, and extends the Microsoft 365 integration to include M365/Azure AD security groups (r0). Adds integration with AWS Verified Access using JumpCloud Go, SAML, or OIDC SSO as a VPN-less remote access solution, and adds a Deel SSO Connector integration (r1).

Adds Download Logs and Keyboard Shortcuts options under Settings, and multi-select functionality with item sorting (r2); extends sorting to various criteria including nicknames, adds multi-select for bulk management, a paginated items list showing 100 items per page, a Copy button in Password History, ability to delete multiple folders at once, a What's New link on Settings > General for release updates, and archiving of items with the ability to view, delete, and restore archived items (r7).

Introduces JumpCloud Device Monitoring and Alerting, supporting availability, software, uptime, disk, and battery monitoring plus directory event alerts (user addition, privilege elevation) on Windows, macOS, and Linux endpoints.

Adds six new Windows MDM CSP-basedCSP-basedContent Security Policy, a W3C browser standard that restricts which scripts, styles, and resources a page may load, letting cyber tools enforce or audit site defenses against injection attacks. policies: Windows Wi-Fi Configuration Policy, Windows VPN Policy, Install Certificate Policy, Bluetooth Configuration Policy, Control Policy Conflict, and Windows Notification Service, plus a new policy to configure Simple Certificate Enrollment Protocol (SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention.) for Windows devices.

Adds an MDM Upcoming Certificate Expirations homepage widget covering MDM certificates, Apple VPP, and Automated Device Enrollment Certificates (r0), evolving into an MDM Certificate & Token Status Board on the Admin Portal and Multi-Tenant Portal homepages, showing expiry status for MDM, SSO, and AzureAD tokens and certificates with an aggregate MSP view (r1).

Adds JumpCloud agent support for Linux Fedora 37, and adds a Linux Forbidden Services policy to remove unsupported service types and reduce security risk across Linux fleets.

ConductorOne now offers an EU-hosted instance with region-specific URLs for login, API, webhooks, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and CLI, selectable via the Hosting region option (EU) during domain registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Microsoft Teams as a notification and interaction surface is not yet supported on the EU data residency instance.