Edgescan

No entries match these filters. Clear filters

1. PHP2Shell (CVE-2026-109618 & CVE-2026-109619) seen Oct 23, 2026 · issue 117
   • New vulnerability check PHP2Shell detection (CVE-2026-109618 & CVE-2026-109619)
2. Release Notes - 6th Oct 2026 Oct 6, 2026 · issue 116

   Edgescan adds sitemap filters for unmatched scope directives, manual sitemap upload for pentested assets, and inline scanner IP documentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When configuring a pen-tested asset, upload a crawled URL list so the customer portal reflects complete sitemap coverage without requiring an automated scan.
   📍In the customer portal, navigate to the asset page for a manually pentested asset, then use the manual sitemap upload option to upload your crawled and tested URL list file.
   • Adds a filter on the sitemap view to show only URLs not yet matched to a scope directive, making it easier to identify unscoped requests during target selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables manual upload of sitemap files (crawled and tested URL lists) for manually pentested assets, giving pen-tests full sitemap coverage and visibility in the customer portal.
   • Surfaces scanner source IP documentation directly on the asset page, so users can allowlist scan traffic without opening the create-asset form.
   • Adds a filter on the sitemap view to show only URLs not yet matched to a scope directive, making it easier to identify unscoped requests during target selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables manual upload of sitemap files (crawled and tested URL lists) for manually pentested assets, giving pen-tests full sitemap coverage and visibility in the customer portal.

   1 more in Everything

3. Release Notes - 3rd Sep 2026 Sep 3, 2026 · issue 088

   Edgescan adds bulk asset scheduling improvements and global role cloning to organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Enables cloning a global role to a specific organization, scoping the same permissions to that organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves bulk asset workflow so that assessment scheduling confirmation only appears when actually setting or moving an assessment start date.
   • Enables cloning a global role to a specific organization, scoping the same permissions to that organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. Release Notes - Atomic (pre-release) seen Sep 1, 2026 · issue 062

   Edgescan Atomic adds live assessment timelines, path-traversal checks, multi-identity auth groundwork, and expanded injection/IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data. coverage across v0.1–v0.5.

   • Adds live assessment activity timeline in the platform: a running assessment now shows a readable, real-time timeline of tester activity while the assessment is in progress (v0.5.0).
   • Adds path-traversal detection: requests are manipulated to test whether files outside the intended directory can be read (v0.5.0).
   • Adds broader file-disclosure testing support (v0.5.0).
   • Introduces a separate, independent confirmation step for each potential finding before it is marked validated; findings that do not pass remain marked as suspected (v0.4.0).
   • Adds foundational multi-identity authenticated testing: an assessment can now carry multiple sets of credentials as named identities (v0.4.0).

   +19 more show less

   • Strengthens session persistence through multi-step and session-rotating application flows, broadening coverage of authenticated areas (v0.4.0).
   • Expands injection detection (cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., and similar) with more complete and durably recorded results (v0.4.0).
   • Extends access-control (IDOR) testing to more link and request types, and enables testing the same target as both a logged-in and anonymous user to expose access-control gaps (v0.4.0).
   • Expands business-logic detection in commerce flows, building on discount/coupon and quantity-manipulation checks (v0.4.0).
   • Adds phase indicator in the platform so assessments show which phase is currently running; access-control findings are categorised more accurately and results are saved even if an assessment ends early (v0.4.0).
   • Adds detection for quantity manipulation (e.g. negative values) to surface invalid order states in business-logic testing (v0.3.0).
   • Expands discovery phase to use robots.txt and sitemap entries to find additional testable areas (v0.3.0).
   • Adds business-logic testing agent team covering abuse of discount and coupon handling in commerce flows (v0.2.0).
   • Adds end-to-end automated assessments: the tester builds its own attack plan and produces findings without per-step human direction (v0.1.0).
   • Adds Credentials Vault integration so credentials can be passed to the harness for authenticated assessment of login-protected application areas (v0.1.0).
   • Adds injection modules covering cross-site scripting, SQL injection, and similar (v0.1.0).
   • Adds broken-access-control (IDOR) modules (v0.1.0).
   • Adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-adaptive testing: assessment behaviour adapts based on how the application and any web application firewall respond (v0.1.0).
   • Adds retesting capability that re-checks previously reported issues and reports whether they appear fixed or still present (v0.1.0).
   • Adds de-duplication and mapping to standard weakness categories for consistent triage (v0.1.0).
   • Adds live assessment stream so findings and activity can be watched as an assessment runs (v0.1.0).
   • Adds support for custom request headers in assessments (v0.1.0).
   • Adds export support for completed assessments (v0.1.0).
   • Adds pause and resume capability so assessments can safely stop and restart around maintenance windows or deployments (v0.1.0).

   24 details in Everything

5. Release Notes - 25th Aug 2026 Aug 25, 2026 · issue 062

   Edgescan adds EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. service-discovery filtering, per-location-type default scan profiles, and TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. support for authenticated DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.

   • Adds a new EASM/ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. filter to scope the host and domain list to assets where no services were discovered, enabling investigation without a full CSV export.
   • Adds support for two separate organisation-default scan profiles based on asset location type — one for URL-only unauthenticated web app assets and one for URL+Network — so new assets automatically inherit the correct profile.
   • Adds TOTP support in authenticated DAST scans, enabling scanning of applications protected by MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./time-based one-time passwords.

   3 details in Everything

6. Release Notes - 10th Aug 2026 Aug 10, 2026 · issue 062

   Edgescan adds bulk role permissions, POC assignment at asset creation, and new EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. filters for certificates, domains, ports, and APIs.

   • New EASM domain page filters let users narrow domains by open port, API presence, and API confidence for precise external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. triage.
   • New certificate filter in EASM allows filtering certificates by issue type.
   • Adds ability to assign asset owner, technical POC, and assessment notifier emails when creating a single asset, eliminating the need to configure them post-creation.
   • Bulk Actions on the organization index page now includes a create role permission option, enabling bulk permission assignment within an organization's scope.
   • Domain names are now included in EASM export files for records and services.

   +1 more show less

   • Adds a tooltip to clarify the difference between the index page export option and the bulk actions export option.

   6 details in Everything

7. Release Notes - 23rd July 2026 Jul 23, 2026 · release notes

   Edgescan adds bulk role creation, org-default scan profiles by location, and vulnerability expiry timeframes.

   └──▷ HOW TO FIND IT
   Create role permissions for multiple selected assets at once from the asset index.
   📍In the asset index, select assets and choose Bulk Actions › create role permission
   Set different default scan profiles for web apps based on whether they are URL-only or include network scope.
   📍In Organisation settings, configure separate Default Scan Profiles for URL-only and URL+Network asset location types
   Discard or lower risk of a vulnerability with an automatic reappearance after the risk acceptance period.
   📍When editing a vulnerability, set the expiry timeframe for discarding or lowering its risk
   • Adds create role permission option to Bulk Actions in asset index page for bulk creating role_permissions scoped to specific assets
   • Supports Separate Organisation Default Scan Profiles Based on Asset Location Type, allowing users to set org default scan profiles for unauthenticated web app assets (URL-only vs URL+Network)
   • Adds Setting timeframe on Edited vulnerabilities to automatically reappear when the business risk acceptance period ends

   3 details in Everything

8. Release Notes - 2nd July 2026 seen Jul 15, 2026 · issue 015

   Edgescan adds custom policy compliance insights, split retest permissions, self-service domain management, and a Credential Vault across this release.

   • New Custom Policy Compliance insight: upload company policy documents and see how vulnerabilities align with those policies.
   • New manage-retests permission lets admins delegate retest execution without granting access to start new assessments.
   • Self-service creation, renaming, and removal of internal domain suffixes directly on the Organizations Scanning tab.
   • Hostname validation on asset location entry prompts for a fully qualified domain name when a bare machine name is entered.
   • Super-user email alert when a new user is created via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., enabling prompt permission review.

   +11 more show less

   • Reports now list assets assessed during the report period with zero findings, confirming coverage rather than omitting them.
   • Scheduled export and report file names now include the scheduled task title for easier identification.
   • Vulnerability risk rating is now visible inside the retest window to aid prioritisation.
   • URLs in remediation advice are now rendered as clickable hyperlinks.
   • Vulnerability severity/risk/threat filters now support in / not in operators for multi-value inclusion and exclusion.
   • Licence Dashboard now includes a tooltip and link to a KB article explaining utilisation and forecast figures.
   • Duplicate base-URL detection warns users when a new asset location shares scheme and host with an existing asset.
   • Swagger API documentation page now links directly to token-creation instructions.
   • Shared Credentials feature is renamed to Credential Vault across the application and API.
   • Scheduled reports now support intuitive day-specific scheduling (e.g. 1st of every month, every Monday).
   • New 'clear extracted tokens on re-authentication' toggle in token mappings prevents stale tokens from breaking fresh authenticated scan sessions.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Shared Credentials feature is renamed to Credential Vault across the application and API; any integrations, scripts, or documentation referencing the old name will need to be updated.
9. Introduction to Shared Credentials, Browser Recordings and MFA in Edgescan seen Jul 13, 2026 · issue 014

   Edgescan adds Shared Credentials, Browser Recordings, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.-aware scanning workflows (Beta, GA Q2 2026).

   └──▷ HOW TO FIND IT
   Configure a reusable TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-enabled credential and attach it to a browser recording for fully automated MFA login during scans.
   📍In the console, go to Shared Credentials › Create Credential, enter username and password, enable MFA, upload or scan the OTP QR code to populate the OTP URI, save the credential. Then go to Browser Recordings › Create Recording, capture the login flow including the OTP input step, and map the otp_code field from the Shared Credential to the OTP input step. Finally, assign both the Shared Credential and the Browser Recording to the target asset under its Authentication Workflow settings.
   Push an out-of-band OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. code to Edgescan via API so an API-push MFA workflow can complete authentication during an assessment.
   copy

   $ curl -X POST https://<edgescan-instance>/api/v1/mfa/<mfa_record_id>/otp \
     -H 'Authorization: Bearer <api_token>' \
     -H 'Content-Type: application/json' \
     -d '{"otp_code": "<one_time_code>"}'

   • Introduces a central Shared Credentials library at the organisation level, letting practitioners create one credential set and assign it to any number of assets instead of re-entering credentials per asset.
   • Adds Browser Recordings that capture real browser login flows — including multi-page, JavaScript-heavy, and MFA-prompted flows — and replay them during authenticated assessments.
   • Supports mapping Shared Credential fields (username, password, otp_code) to specific input steps in a browser recording, enabling credential reuse across multiple assets with the same recording.
   • Enables MFA-aware credentials with support for TOTP/authenticator apps, email-based OTP, SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.-based OTP, and API-push/out-of-band MFA patterns.
   • Supports QR code upload or scan during Shared Credential setup to automatically populate OTP URI and related TOTP fields.

   +4 more show less

   • Exposes MFA API endpoints that allow external systems to push OTP codes to Edgescan, enabling out-of-band MFA coordination with browser recordings.
   • Adds Chrome and Snyk recording format support for browser authentication capture.
   • Automatically migrates existing asset-level credentials into the Shared Credentials model; credentials that cannot be precisely typed are preserved as usable Legacy entries.
   • Surfaces credential-to-asset and asset-to-credential usage visibility on both the Shared Credentials page and individual asset pages.

   9 details in Everything

10. Release Notes - 11th Mar 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds vulnerability detection history timeline, visible discard notes in reports, and expanded MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./credential workflow capabilities.

    └──▷ HOW TO FIND IT
    Review every re-detection event for a vulnerability during a retesting cycle to build an audit trail.
    📍In the Edgescan platform, open a vulnerability detail page and select the Vulnerability detection history timeline tab to see each re-detection entry logged by assessments.
    Ensure pentest due dates are tracked at asset creation time so teams can prioritise PT scheduling.
    📍In the Edgescan platform, go to Assets › Create Asset, complete the asset details, and populate the PT to be completed by date field before saving (Alpha/Beta feature).
    Speed up MFA credential setup by scanning an authenticator QR code directly from a webcam instead of manual entry.
    📍In the Edgescan platform, go to Shared Credentials › Create/Edit Credential, select OTP MFA, and choose Scan QR Code to capture the QR code via webcam and auto-populate the OTP secret (Alpha/Beta feature).
    • Adds a Vulnerability detection history timeline view that logs a new entry each time a vulnerability is re-detected during an assessment, providing richer retest audit trails.
    • Surfaces discard notes directly in the platform UI and in reports, and allows updating discard notes on already-discarded vulnerabilities.
    • Enables event notifications for changes to the superuser notes field.
    • Introduces a PT to be completed by due-date field in the asset creation workflow for pentest targets (Alpha/Beta).
    • Adds post-authentication stabilization options configurable within authentication workflows (Alpha/Beta).

    +3 more show less

    • Supports MFA QR code scanning via webcam to auto-populate OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. details in the shared credentials form (Alpha/Beta).
    • Supports uploading a QR code image to auto-populate OTP MFAOTP MFAAn authentication scheme that combines a one-time password — a code valid for a single login or short window — with a second factor, so stolen passwords alone cannot grant access. details in the shared credentials form (Alpha/Beta).
    • Enables bulk migration of legacy credentials to SharedCredentials, with ambiguous entries flagged as Legacy to preserve scan continuity (Alpha/Beta).

    8 details in Everything

11. Release Notes - 14th Apr 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds checkbox-based bulk discard for vulnerability management alongside existing filter-based bulk actions.

    └──▷ HOW TO FIND IT
    Discard a specific subset of findings by hand-picking them with checkboxes rather than relying solely on filter criteria.
    📍In the Vulnerabilities view, select individual findings using the checkboxes, then choose Bulk Discard from the actions menu to discard only the checked items.
    • Adds checkbox-based bulk discard option, letting users selectively discard individual findings alongside the existing filter-matched bulk-discard workflow.

    1 detail in Everything

12. Release Notes - 14th Jan 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds recorded login sequence uploads, single insight category views, and dark mode for insight graphs.

    └──▷ HOW TO FIND IT
    When configuring authenticated scans, upload a recorded login sequence so Edgescan can replay credentials automatically — useful for apps with complex SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. or multi-step login flows.
    📍In the platform, go to Configure Scanning › Credentials, record your login sequence using the browser recorder, then upload the recording file to associate it with your asset's scan workflow.
    When presenting to a CISO, isolate a single insight category to focus the dashboard view without noise from other report types.
    📍In the platform, navigate to Insights and select a single category (e.g., CISO Report) from the category filter to view only that insight group.
    • Enables users to record a login sequence and upload it to Edgescan for automated authentication during scanning.
    • Supports viewing a single insight category in isolation (e.g., CISO Report) within the Insights dashboard.
    • Adds dark mode support for insight graphs in the platform UI.

    3 details in Everything

13. Release Notes - 14th May 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds saveable Asset Export filters, duplicate credential detection, in-asset credential creation, and bulk workflow credential vault support.

    └──▷ HOW TO FIND IT
    When managing many assets at scale, supply credential vault IDs during a bulk asset create so scanners authenticate without manual per-asset configuration.
    📍In the platform, go to Assets › Bulk Create/Update, and include the Credential Vault ID column in your CSV upload to associate vault credentials with each asset in one operation.
    When auditing your credentials vault for redundancy, use the new duplicate filter to surface and consolidate repeated credentials before they cause scan conflicts.
    📍In the platform, go to Credentials Vault, apply the Duplicates filter to identify matching credentials, then use the compare and merge controls to consolidate them.
    When setting up a new asset scan, create and apply credentials inline without leaving the asset configuration view.
    📍In the platform, open an Asset › Scan Configuration, select Create Credential within the credentials section, fill in the credential details, and apply it directly to the asset scan.
    • Saves export column selections alongside saved Asset Export filters, eliminating the need to reconfigure columns when switching between filters.
    • Adds controls to identify, filter, compare, and merge duplicate credentials directly within the credentials vault.
    • Enables credential creation and application from the asset scan configuration view, removing the need to navigate away from the asset page.
    • Updates the AI Insight Licence Forecast Report with org-level visibility into licence usage, expiries, and growth forecasts for capacity planning and renewal management.
    • Adds a legend to complex Mermaid line graphs in Insights for easier series identification.

    +1 more show less

    • Extends credentials vault support to bulk asset creation and update workflows, allowing credential vault IDs to be supplied directly in bulk operations.

    6 details in Everything

14. Release Notes - 15th June 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds asset assessment date filtering, AI Insights UI refresh, scoped token mappings, and a raft of workflow enhancements.

    └──▷ HOW TO FIND IT
    Configure a custom scope directive for a token mapping to restrict a session token to a specific path, preventing it from leaking to out-of-scope endpoints.
    📍In the console, go to the asset's authentication settings, open Token Mappings, and add a custom Scope Directive tied to the relevant location specifier for the token.
    Filter vulnerabilities across multiple severity levels in a single view to prioritise remediation across Critical and High findings together.
    📍In the Vulnerabilities list, open the severity filter and select multiple severity levels (e.g. Critical and High) to apply a combined filter.
    Scope a scheduled assessments export to a single business unit and its child organizations for targeted reporting.
    📍In Scheduled Exports, create or edit an assessments export and set the Organization (with children) scope to the target organization before saving.
    • Adds Date of last assessment column and filter, letting users view and filter assets by the date of a specific assessment type (e.g. last pen-test date, last retest date).
    • Refreshes the AI Insights page with a look and feel consistent with the rest of the Edgescan interface.
    • Enables scoped scheduled assessment exports to a single organization and its descendants.
    • Adds multi-severity filtering so users can filter vulnerabilities by multiple severity levels simultaneously.
    • Adds retest-in-progress status to the asset badge (e.g. scanning, validating).

    +8 more show less

    • Requires a standardised reason (or free-text other) when disabling an asset, enabling clean aggregation of disabled-asset data.
    • Adds autocomplete suggestions to Blocker category and Blocker cause filter fields.
    • Supports naming an EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation at creation time.
    • Automatically starts scanning internal network assets immediately after onboarding when a valid network location specifier is present, removing the need for a manual support ticket.
    • Adds an Organization (with children) filter to the licensing page.
    • Supports correct display of configured pause-schedule hours for non-integer UTC offset timezones (e.g. IST +5:30, NPT +5:45).
    • Automatically scopes token mappings to their associated location specifiers by default, preventing sensitive tokens from being sent out-of-scope.
    • Supports custom scope directives for token mappings to enable complex session-management configurations in basic auth workflows.

    13 details in Everything

15. Release Notes - 16th Oct 2025 seen Jul 13, 2026 · issue 014

    Edgescan adds tester notes for retests, vulnerability definitions in reports, tag visibility, and new vuln filters.

    └──▷ HOW TO FIND IT
    Include inline vulnerability definitions in a report so reviewers don't need to cross-reference external documentation.
    📍In the console, go to Reports › Generate Report, then enable the Definitions option to embed each vulnerability's definition directly after its entry in the output.
    Scope vulnerability triage by filtering out out-of-scope findings or narrowing by asset status on the Vulnerabilities page.
    📍In the console, go to Vulnerabilities, open the filter panel, and apply the Out of Scope filter and/or the Asset Status filter to narrow results.
    Communicate context to the operations team before a retest by attaching notes at the assessment or vulnerability level.
    📍In the console, when initiating a retest assessment, enter guidance in the Tester Notes field under assessment or vulnerability notes before submitting.
    • Auto-populates the current asset when navigating to the Report section from an asset details page.
    • Adds a definitions option in report generation to display each vulnerability's definition inline, immediately after the vulnerability.
    • Adds a Tags column to the asset table for at-a-glance tag visibility.
    • Adds new vulnerability filter options: filter by out-of-scope status and by asset status.
    • Adds a tester notes field allowing users to provide notes to the operations team when initiating a retest assessment, via assessment and vulnerability notes.

    5 details in Everything

16. Release Notes - 24th Nov 2025 seen Jul 13, 2026 · issue 014

    Edgescan adds audit trail attribution, bulk asset report selection, and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

    └──▷ HOW TO FIND IT
    Review who initiated a retest on a specific vulnerability to support change-management and accountability workflows.
    📍In the console, navigate to the Audit Trail and filter by event type Retest or Vulnerability Test to see the triggering user alongside each assessment entry.
    Generate a consolidated report across a subset of assets in one action rather than running separate per-asset reports.
    📍In the console, go to Reports › Generate Report, use the bulk select checkbox to choose multiple assets, then proceed to generate the report.
    Restrict a team's access to only the assets and data relevant to their function by assigning a custom role.
    📍In the console, go to Settings › Roles, create or select a role with the desired resource permissions, then assign it to the target users under User Management.
    • Adds audit trail entries that identify which user triggered a retest or vulnerability assessment.
    • Enables bulk selection of multiple assets when generating reports.
    • Introduces role-based authorization support, allowing created and assigned roles to control access to resources within an Edgescan account.

    3 details in Everything

17. Release Notes - 28th May 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds asset-creation notifications, AI Insights asset filtering, configurable asset exports, and improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances./assessment-export filtering.

    └──▷ HOW TO FIND IT
    Receive an alert in your notification pipeline the moment a new asset is added to Edgescan — useful for triggering automated onboarding workflows.
    📍In the Edgescan console, go to Notifications › Events, create a new event, and select the Asset Created event type as the trigger condition.
    Generate a focused AI Insight scoped to a specific asset group (by ID or tag) without overwriting the shared organization Insight.
    📍In the Edgescan console, go to AI Insights, apply the Asset IDs or Tags filter to scope the data, then select Generate Personal Insight to produce an individual report.
    Produce a clean asset report without risk-over-time graphs — useful for executive summaries where trend charts add clutter.
    📍In the Edgescan console, go to Asset Reporting › Export, open the report configuration options, and uncheck Include risk-over-time graphs under the Asset List section before exporting.
    • Adds a new notification event triggered when an asset is created, enabling teams to react in real time to asset inventory changes.
    • Enables filtering of AI Insights data by asset IDs and tags, and supports generating personal Insights without affecting the organization-wide Insight.
    • Adds an option to omit risk-over-time graphs from the Asset List section of asset reports for cleaner exports.
    • Supports both numeric (e.g. 79) and full string (e.g. CWE-79) input when filtering vulnerabilities by CWE in the UI.
    • Applies active UI filters to Assessment Exports so the exported data matches exactly what is currently displayed.

    +1 more show less

    • Renames schedule sections in the UI to clearly distinguish Assessment Schedules from Scheduled Exports & Reports.

    6 details in Everything

18. Release Notes - 29th Apr 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds webhook note payloads and new CISO AI Insight reporting period and time-unit controls.

    └──▷ HOW TO FIND IT
    Capture full note text in a webhook consumer to automatically route triage notes into a ticketing system when an analyst adds a note in Edgescan.
    📍In the console, go to Integrations › Webhooks, select your webhook, and enable the note-added trigger — the event payload will now include the note content field.
    Scope a CISO AI Insight report to the last completed quarter for board-ready quarterly risk summaries.
    📍In the console, go to Insights › CISO Report, open the reporting period selector, and choose Last completed quarter.
    • Adds note content to webhook event payloads when the note-added trigger fires, enabling downstream systems to consume full note context.
    • Enables setting the CISO AI Insight report's time period to last completed quarter and similar discrete reporting intervals.
    • Displays FTE time-saved calculations in hours (instead of minutes) on the CISO AI Insight report for clearer workforce-impact communication.

    3 details in Everything

19. Release Notes - 29th Jan 2026 seen Jul 13, 2026 · issue 014

    Edgescan reports now surface EXF, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. scoring metrics alongside each vulnerability.

    └──▷ HOW TO FIND IT
    Generate a vulnerability report to see exploit feasibility (EXF), EPSS probability, and CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. status in a single export for faster triage.
    📍In the Edgescan console, navigate to Reports, generate a vulnerability report, and review the EXF, EPSS, and CISA KEV columns now included for each finding.
    • Adds EXF, EPSS, and CISA KEV indicators to generated vulnerability reports for richer prioritization context.

    1 detail in Everything

20. Release Notes - 30th Mar 2026 seen Jul 13, 2026 · issue 014

    Edgescan adds UX improvement to Roles permissions dropdowns, keeping selections open for faster multi-item configuration.

    • Improves Roles UI so permissions and resources dropdowns stay open after adding items, enabling faster multi-selection without repeated reopening.

    1 detail in Everything

21. Release Notes - 6th Nov 2025 seen Jul 13, 2026 · issue 014

    Edgescan adds Out of Scope discard reason, discard reason in exports, and an automatic retest queue.

    • Adds Out of Scope as a selectable discard reason when dismissing vulnerabilities.
    • Includes discard reason field in vulnerability exports for audit and reporting workflows.
    • New retest queue automatically schedules vulnerability retest requests that cannot fit into the current ongoing retest, eliminating manual retry loops.

    3 details in Everything

22. Release Notes - 8th Dec 2025 seen Jul 13, 2026 · issue 014

    Edgescan adds pentesting checklists in reports and retest/on-demand assessment start notifications.

    • Adds a penetration testing checklist to generated reports, summarising what was tested during an engagement.
    • Sends assessment start notifications when a user invokes a retest or on-demand assessment.
    • Includes a note in email notifications warning non-registered recipients that report links will not work for them.

    3 details in Everything

23. Release Notes - 9th July 2026 Jul 9, 2026 · release notes

    Edgescan adds hostname visibility in vulnerabilities, limited API tokens, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. suggestions, and UI enhancements

    └──▷ HOW TO FIND IT
    Identify affected hosts directly in vulnerability lists without switching tabs.
    📍Navigate to the Vulnerabilities page in the Edgescan UI; check that Hostname appears next to Location (IP) for each entry.
    Generate an API key with restricted permissions for automated scanning scripts.
    📍Go to User Settings › API Tokens, select Limited API Token, define the specific permission scope, and generate.
    Request AI-driven WAF hardening advice for detected app layer flaws.
    📍View an application layer vulnerability in the dashboard and click Insight for WAF to see generated rule suggestions.
    • Shows associated hostname(s) alongside Location (IP) on the Vulnerabilities page for direct host identification without cross-referencing the Hosts tab
    • Adds a created_by user filter on the user show page to audit account creation origins
    • Increases character limit and adds period delimiters for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. email addresses during credential setup
    • Allows replacing the standard cover title with a custom label and showing tested asset name(s) in Executive Summary Reports
    • Enables generating API keys with a narrow, limited set of permissions instead of full access

    +1 more show less

    • Provides AI-generated WAF rule suggestions for application layer vulnerabilities via the Insight for WAF feature

    6 details in Everything

24. Release Notes - 2nd July 2026 Jul 2, 2026 · release notes

    Custom policy compliance insights, manage-retests permission, and domain suffix management added to Edgescan

    • Generates compliance insights by uploading company policy documents to align with identified vulnerabilities
    • Grants manage-retests permission to delegate retesting without granting ability to start new assessments
    • Creates, renames, and removes internal domain suffixes directly on the Organizations Scanning tab via UI
    • Validates hostname input for location specifiers, rejecting bare machine names in favor of fully qualified domain names
    • Sends an email alert to super users when a new user is created via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. within their organization

    +11 more show less

    • Lists assets with zero findings in scheduled reports to confirm assessment coverage
    • Includes the scheduled task title in exported file and report names for identification
    • Displays vulnerability risk ratings directly in the retest window
    • Shows supported file formats in the Browser Recording upload tooltip
    • Makes URLs within remediation advice clickable hyperlinks
    • Supports filtering vulnerabilities by severity/risk/threat using in / not in operators instead of single value enumeration
    • Adds a link to the knowledge base article on the License Dashboard explaining utilization and forecast figures
    • Warns when creating or editing an asset with a URL that shares the same scheme and host as another asset's location
    • Provides a link to API token-creation instructions on the Swagger documentation page
    • Renames Shared Credentials to Credential Vault across the application UI and API
    • Adds a toggle to clear extracted tokens on re-authentication in token mappings for authenticated scans

    16 details in Everything

25. Release Notes - 15th June 2026 Jun 15, 2026 · release notes

    Edgescan adds multi-severity filtering, asset disable reasons, named EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigations, and non-integer UTC pause schedules.

    └──▷ HOW TO FIND IT
    Filter vulnerabilities by both Critical and High severity in the UI.
    📍In the assessment view, apply filters: Severity = Critical, High.
    Name your EASM investigation to keep assets organized from the start.
    📍Create a new investigation -> Enter a name -> Save.
    Pause scans in a timezone like IST (+5:30) without calculation errors.
    📍Settings › Schedule › Pause Schedule › Select IST (UTC+5:30) or similar offset.
    • Adds filter by multiple severity levels for vulnerabilities
    • Adds the ability to name an EASM investigation during creation
    • Enables pausing scan schedules in non-integer UTC offset timezones (e.g. IST +5:30)
    • Requires a reason when disabling an asset, with standardized options or free text

    4 details in Everything

26. Release Notes - 28th May 2026 May 28, 2026 · release notes

    Edgescan adds asset creation notifications, role filtering, and enhanced AI Insight controls

    └──▷ HOW TO FIND IT
    Filter vulnerabilities quickly using standard CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifiers without needing the full name.
    📍Use the vulnerability filter and enter CWE-79 or 79 to narrow results.
    • Adds a new event notification trigger for when assets are created.
    • Improves role filtering to hide inactive roles by default in assignment flows.
    • Enhances vulnerability filtering to accept either CWE numbers or the full CWE-## string format.

    3 details in Everything

27. Release Notes - 14th May 2026 May 14, 2026 · release notes

    Edgescan adds saved Asset Export filters, inline credential vault management, and bulk workflow support.

    └──▷ HOW TO FIND IT
    Save your current column selections for future export sessions to maintain consistency across filters.
    📍In the Asset Export view, configure columns and click Save Filter to persist the layout.
    Manage credential duplicates directly within the vault interface.
    📍Navigate to Credentials Vault › Identify Duplicates, then select Merge on matching entries.
    Add credentials directly from the asset page during bulk workflows instead of navigating to a separate vault section.
    📍On the Asset Bulk Create/Update screen, enter credential_vault_id fields to link existing vault entries.
    • Adds greater controls to identify, compare, and merge duplicate credentials in the credentials vault
    • Enables creation and application of credentials from the asset scan configuration view without navigating away from the asset page
    • Updates the AI Insight Licence Forecast Report to provide org-level visibility of licence usage, expiries, and growth forecasts
    • Adds a legend on complex mermaid graphs for line chart readability
    • Supports adding credential vault IDs in asset bulk create and update workflows

    5 details in Everything

28. Release Notes - 29th Apr 2026 Apr 29, 2026 · release notes

    Edgescan adds note content to webhook payloads and quarterly CISO reporting periods.

    └──▷ HOW TO FIND IT
    Configure a webhook integration that receives full note details when they are added to an assessment.
    📍In Settings › Integrations › Webhooks, create a new hook. Set Trigger to note-added. Ensure the payload configuration includes Note Content fields.
    Generate an AI CISO Insight report focused on the most recent fiscal quarter for executive review.
    📍In the CISO Report Insight view, open the Reporting Period dropdown and select Last completed quarter. Click Generate Report.
    • Includes note content in webhook event payloads when the note-added trigger fires
    • Allows setting the AI Insight CISO report period to last completed quarter or similar periods via the UI

    2 details in Everything

29. Release Notes - 14th Apr 2026 Apr 14, 2026 · release notes

    Edgescan adds bulk discard via checkboxes in addition to existing filter-based bulk discard.

    └──▷ HOW TO FIND IT
    Discard specific findings manually selected in the results list without clearing filters.
    📍In the Edgescan UI, go to Findings › Results, select the desired checkboxes, and click Bulk Discard.
30. Release Notes - 30th Mar 2026 Mar 30, 2026 · release notes

    UX improvements to Roles dropdowns and Shared Credentials feature status labeling

    • Permissions and resources dropdowns in the Roles UI now remain open after adding items and remove selected items from the visible list.
    • Shared Credentials feature badge updated from Alpha to Beta.

    2 details in Everything

31. Release Notes - 11th Mar 2026 Mar 11, 2026 · release notes

    Edgescan GA release adds vulnerability detection history timeline, visible discard notes, and superuser note event notifications.

    └──▷ HOW TO FIND IT
    Review why a vulnerability was re-detected by checking the timeline on the asset detail page.
    📍In the Edgescan console, go to Asset › Details and open the Vulnerability detection history tab to view the re-detection entries
    Ensure discard notes are visible in exported reports for audit trails.
    📍In the Edgescan console, generate a report and verify that discarded vulnerabilities display their note text in the output
    • Adds a Vulnerability detection history timeline view that logs a new entry each time a vulnerability is re-detected during retesting
    • Makes the Discard Vulnerability Notes action more visible in the platform UI and reports, and allows updating discard notes for already-discarded vulnerabilities
    • Enables event notifications when updates are made to superuser notes fields

    3 details in Everything

32. Release Notes - 12th Feb 2026 Feb 12, 2026 · release notes

    Edgescan adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. step recording for onboarding workflows.

    └──▷ HOW TO FIND IT
    Capture MFA interactions for users setting up accounts in the Edgescan portal.
    📍In the console, go to Settings › Onboarding and enable Record MFA steps.
    • Adds the ability to record Multi-Factor Authentication (MFA) steps during the user onboarding workflow.

    1 detail in Everything

33. Release Notes - 29th Jan 2026 Jan 29, 2026 · release notes

    Edgescan reports now include EXF, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. indicators for each vulnerability.

34. Release Notes - 14th Jan 2026 Jan 14, 2026 · release notes

    Edgescan adds recorded login sequence upload for automated auth and dark mode insight graphs

    • Allows users to record a login sequence and upload it to Edgescan for automated authentication.
    • Enables viewing insights graphs in dark mode.

    2 details in Everything

35. Release Notes - 8th Dec 2025 Dec 8, 2025 · release notes

    Edgescan adds Pentesting Checklist to reports, Jira auto-sync for disabled projects, retest notifications, and screenshot quality improvements

    • Adds a Pentesting Checklist section at the end of generated penetration test reports detailing what was tested
    • Enables Jira Cloud Boards to auto-sync even when the associated Project is disabled
    • Sends assessment start notifications for retest and on-demand assessments
    • Improves screenshot quality in reports to allow viewing of minute details

    4 details in Everything

36. Release Notes - 24th Nov 2025 Nov 24, 2025 · release notes

    Edgescan adds audit trail for retest triggers, bulk asset selection for reports, and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

    • Adds audit trail entry showing who triggered a retest or vulnerability test
    • Adds ability to bulk select assets when generating report
    • Enables authorization refactor with created and assigned roles to control resource access

    3 details in Everything

37. Release Notes - 6th Nov 2025 Nov 6, 2025 · release notes

    Edgescan adds Out of Scope discard reason, include it in exports, and introduces a Retest Queue for async scheduling.

    • Adds the Out of Scope option to vulnerability discard actions, allowing users to explicitly mark vulnerabilities as out of scope
    • Includes the discard reason (e.g., Out of Scope) in vulnerability export files
    • Creates a Retest Queue for the parallel retest system, automatically scheduling retests that do not fit into the currently ongoing window

    3 details in Everything

38. Release Notes - 16th Oct 2025 Oct 16, 2025 · release notes

    Edgescan adds report asset auto-population, vulnerability definitions in reports, tags column, new filters, and tester notes fields.

    • Report section now auto-populates the current asset when navigating from the asset details page
    • Added definitions option for report generation to display vulnerability definitions immediately after each finding
    • Added tags column to the asset table view
    • Added new filter options for vulnerabilities, including filtering by out-of-scope status and asset status
    • Added new field for tester notes when initiating a retest assessment

    5 details in Everything

39. Release Notes - 1st Oct 2025 Oct 1, 2025 · release notes

    Edgescan adds PDF export for AI Insights, notification bypass for admin credentials, and auto-archiving of inactive orgs.

    • Adds ability to download AI insights in PDF format
    • Adds notification bypass for credentials added by Edgescan admins
    • Automatically archives Assets/Organizations/Users and associated resources after 7+ days of inactivity
    • Marks out-of-scope vulnerabilities as 'discarded - out of scope'
    • Adds new filter to order vulnerabilities by last detected date

    5 details in Everything

40. Release Notes - 24th Sep 2025 Sep 24, 2025 · release notes

    Edgescan adds flexible date formats in UI, last edited metadata for credentials, staged asset notification controls, and improved scope config stability.

    • Adds support for flexible date formats across the entire UI to ensure unambiguous display
    • Displays the last edited date and editor name on the credentials modal within the asset details page
    • Allows configuration of credential-added event notifications to skip alerts when staging assets
    • Improves the initiate scanning/assessment start schedule flows for staged asset onboarding
    • Renames the permission label from Risk Accept Vulnerabilities to Discard Vulnerability

    +1 more show less

    • Enables scan result parsers to handle non-ASCII strings without export issues

    6 details in Everything

41. Release Notes - 9th Sep 2025 Sep 9, 2025 · release notes

    Adds last edited date and editor for credentials in asset details; fixes UI display issues.

    • Added Last Edited and By Whom fields to the credentials modal on the asset details page

    1 detail in Everything

42. Release Notes - 19th Aug 2025 Aug 19, 2025 · release notes

    Edgescan adds EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. support, superuser notes, asset-based user filtering, and batch retests to the UI.

    • Adds EUVD (EU Vulnerability Database) linkage to vulnerability entries so CVEs linked to EUVD entries are visible
    • Adds a notes field on vulnerabilities that is only visible to superusers
    • Adds filtering capability to show which users can view or edit specific assets based on cross-referenced permissions
    • Enables retesting all currently filtered vulnerabilities from the vulnerability index page in one action
    • Adds AND logic to existing filters for vulnerability locations, allowing multiple concurrent filter constraints

    5 details in Everything

43. Release Notes - 31st Jul 2025 Jul 31, 2025 · release notes

    Edgescan adds license upgrades from asset details, EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. mandatory task indicators, and enhanced vulnerability filtering/export.

    • Adds the ability to upgrade licenses directly from the asset details page
    • Adds visual indicators on EASM tasks to identify mandatory items
    • Adds the asset name column to the users table for visibility into user-asset access
    • Adds filtering and export support for the last detected date field on vulnerabilities
    • Adds autocomplete support for oversight tags filters in the UI

    +3 more show less

    • Adds improved error messaging when superusers attempt to delete other superusers
    • Adds multi-select filtering for vulnerability severity levels
    • Adds a permission replication feature for copying permissions between users

    8 details in Everything

44. Release Notes - 24th Jun 2025 Jun 24, 2025 · release notes

    Edgescan adds license suggestion notes, asset metadata filtering, and Jira ticket sync exclusion.

    • Adds the ability to attach notes or select alternative licenses when accepting a licence suggestion in the UI
    • Enables filtering assets by custom metadata fields from the asset list view
    • Requires a reason to be provided when disabling an asset via the UI
    • Adds a Last Detected on column to the Vulnerabilities index table
    • Displays current license utilization summary on the individual Asset show page

    +3 more show less

    • Splits the license utilization chart by license type and allows filtering metrics by type on the Licensing Dashboard
    • Enables inclusion of comprehensive vulnerability details (descriptions, remediation steps, screenshots, analyst comments) in Jira integration tickets
    • Allows exclusion of existing pre-integration Jira tickets from Edgescan's sync to preserve history

    8 details in Everything

45. Release Notes - 10th June 2025 Jun 10, 2025 · release notes

    Edgescan adds Org ID to license exports, EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation creation from ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. data, and configurable default jumpboxes.

    • Adds Org Id and Org name columns to Licence Utilization exports
    • Enables creation of EASM Investigations directly from existing ASM scan results
    • Sets Jumpbox and domain suffix as automatic defaults when only one exists in the organization

    3 details in Everything

46. Release Notes - 26th May 2025 May 26, 2025 · release notes

    Edgescan adds Jira Data Center integration, licensing filters, sitemap export, ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. asset creation, and vulnerability event re-sending.

    • Integrates Edgescan vulnerabilities into Jira Data Center for developer workflows.
    • Adds filtering of assets by Penetration_tests, licence status, auto renewal, and licence UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
    • Enables exporting sitemap data directly from the scope configuration page.
    • Allows creation of assets directly from ASM results.
    • Exposes a subset of vulnerability definitions in the user GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

    5 details in Everything

47. Release Notes - 12th May 2025 May 12, 2025 · release notes

    Edgescan adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. metrics to customer dashboards and asset tier classification fields

    • Adds SLA-related metrics to customer dashboards for performance tracking and compliance monitoring
    • Adds an asset tier field to asset records to classify assets by tier
    • Adds improved indicators to distinguish manually scanned assets from fully automated ones
    • Adds the ability to display the user who accepted a risk on a vulnerability report
    • Adds custom Jira Issue name formatting option <Finding Name> @ <Asset Name>

    5 details in Everything

48. Release Notes - 24th April 2025 Apr 24, 2025 · release notes

    Edgescan beta adds audit trail viewer, custom pause schedules, asset metadata fields, and column selection for exports.

    • New Audit trail viewer in limited Beta to track assignment/unassignment of licences and changes made to resources
    • Users can create and manage pre-defined pause schedules and assign these to assets
    • Asset management allows defining and editing additional metadata fields for categorization and filtering
    • Export functionality enables selecting specific columns to include in the output

    4 details in Everything

49. Release Notes - 9th April 2025 Apr 9, 2025 · release notes

    Edgescan adds asset filtering by status/licensing, org-hierarchy insights, last_vulnerability_assessment_date on Asset API, and custom field management via API

    • Adds last_vulnerability_assessment_date to the Asset API response for tracking assessment timing.
    • Enables filtering assets by licensing plan type to identify specific license requirements quickly.
    • Allows managing custom fields via the API for flexible asset metadata handling.
    • Implements an accordion structure for viewing insights and automatic inclusion of all org hierarchy data in Insights views.
    • Adds ability to filter Insights by organizations for granular reporting.

    5 details in Everything

50. Release Notes - 16th March 2025 Mar 16, 2025 · release notes

    Edgescan now groups on-demand and scheduled assessments in the Asset show panel.

51. Release Notes - 26th February 2025 Feb 26, 2025 · release notes

    Edgescan adds configurable report filters for assessment type and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scoring, plus improved plugin component support.

    • Adds the ability to specify assessment_type when filtering reports in the UI/API
    • Allows cvss scores to replace exf scoring in generated reports
    • Increases visibility into assessment progress status for paused assessments
    • Enhances Edgescan & Jira plugin to allow specifying component information

    4 details in Everything

52. Release Notes - 4th February 2025 Feb 4, 2025 · release notes

    Edgescan adds structural-only URL display in Sitemap asset scope configuration

53. Release Notes - 20th January 2025 Jan 20, 2025 · release notes

    New licence/organization filters in assessments export and improved notification delay defaults.

    • Adds a default 1-hour event notification delay for new asset blocker events via the UI

    1 detail in Everything

54. Release Notes - 12th December 2024 Dec 12, 2024 · release notes

    Edgescan adds AI summary views for license and asset blockers, plus scheduled export filters and pause schedules

    • Adds view to AI summary of licence information.
    • Adds view to AI summary of asset blockers information.
    • Added popup modal for ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. scheduling.

    3 details in Everything

55. Release Notes - 28th November 2024 Nov 28, 2024 · release notes

    Edgescan adds organization settings page, asset-level jumpbox configuration, and configurable notification delays.

    • Added new organizations page where I can set more organization settings
    • Added optional delay to notifications when configuring asset blocker events
    • Added jumpbox settings related to an asset and set the jumpbox on the asset details page

    3 details in Everything

56. Release Notes - 18th November 2024 Nov 18, 2024 · release notes

    Adds HTTP response code labels to EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation filtering

57. Release Notes - 1st November 2024 Nov 1, 2024 · release notes

    Edgescan adds Organization ID filter to licence utilization summary and fixes auto-renewal logic for active licences.

    • Changed auto renewal logic to create renewals only for active licences

    1 detail in Everything

58. Release Notes - 10th October 2024 Oct 10, 2024 · release notes

    Edgescan adds an in-platform license utilization modal and PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. attestation email notifications.

    • Added licence utilization modal to the assets page for viewing licences and expiry breakdowns without exporting a report
    • Added new permission to support licence utilization summary
    • Added email notification when PCI attestation information is missing

    3 details in Everything

59. Release Notes - 3rd October 2024 Oct 3, 2024 · release notes

    Adds ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. scheduled export capability and fixes licence auto-renewal logic

60. Release Notes - 18th September 2024 Sep 18, 2024 · release notes

    Edgescan adds vulnerability tagging, PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. report formatting fixes, and improved asset/license management logic

    • Adds the ability to tag vulnerabilities for better organization and filtering.
    • Allows users to accept or reject license upgrade suggestions from the interface.
    • Enables setting organizational default as the pause schedule value when creating an asset.

    3 details in Everything

61. Release Notes - 3rd September 2024 Sep 3, 2024 · release notes

    Edgescan adds immediate overdue assessment triggering and EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. domain visibility controls in Sept release.

    • Adds optional start assessment tasks for PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. frequency control
    • Allows overdue assessments to kick off immediately or be scheduled via new asset blocker workflows
    • Improve ability to indicate new domains in subsequent scans within EASM

    3 details in Everything

62. Release Notes - 23rd August 2024 Aug 23, 2024 · release notes

    Edgescan adds better support for JumpBoxes

63. Release Notes - 10th July 2024 Jul 10, 2024 · release notes

    Edgescan v2024-07-10 adds auto-renew toggle API, restricts IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. user creation, updates AI Insights data handling and UI.

    • Adds ability to toggle the auto renew all button via frontend endpoints
    • Restricts identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. from creating new user accounts, reserving account creation for clients
    • Removes access to onboarding forms as they are deprecated
    • Excludes inactive assets from Gen-AI Insights correlations
    • Displays additional organization and sub-organization details for each insight

    5 details in Everything

64. Release Notes - 26th June 2024 Jun 26, 2024 · release notes

    Edgescan adds CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. vulnerability correlation, AI insights (alpha), licensing visibility, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. domain configuration via UI

    • Adds Live host allowance utilization visibility on the licensing page in the services and constraints column.
    • Adds pen test count per asset view on the licensing page.
    • Enables configuration of NTLM domain directly via the user interface.
    • Releases Edgescan AI Insights (pre-alpha) to provide vulnerability analysis.

    4 details in Everything

65. Release Notes - 12th June 2024 Jun 12, 2024 · release notes

    Edgescan adds screenshot support in asset blocker notifications and new wizard for asset creation.

    • Added screenshots to asset blocker notifications for visual context
    • Added a new wizard to the asset creation workflow that prompts to create a hostname from a URL when only a URL location specifier is present
    • Added filterable false-positive data in the UI for asset scanning results
    • Added support for selecting assets across multiple pages in bulk actions within the asset table

    4 details in Everything

66. Release Notes - 22nd May 2024 May 22, 2024 · release notes

    Edgescan adds username like operator for cross-referencing and vulnerability publishing capabilities

    • Added like operator to enable flexible matching when cross-referencing usernames
    • Added ability to publish vulnerabilities directly during an assessment

    2 details in Everything

67. Release Notes - 13th May 2024 May 13, 2024 · release notes

    Adds pause schedule management for assets, retest magic links in emails, and API-based retest link generation

    • Pause Schedules can now be assigned to individual assets to control scanning windows

    1 detail in Everything

68. Release Notes - 11th April 2024 Apr 11, 2024 · release notes

    Edgescan adds asset context to vuln pages, AWS tag scanning, TLS grading, and license blocking controls.

    • Adds asset name and location columns/fields in the vulnerabilities table and on the vulnerability page for better context
    • Introduces an asset blocker that prevents authenticated scanning when the asset's license does not support it
    • Updates the licence history section to show status and hides upgraded licenses from the active list
    • Adds AWS tag-based filtering for internal scanning assets
    • Enables TLS grading in the EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. module

    +1 more show less

    • Improves handling of HTTP response truncation

    6 details in Everything

69. Release Notes - 26th March 2024 Mar 26, 2024 · release notes

    Edgescan adds URLs/hostnames to asset index, bulk async asset creation API, and export filters for assessment types

    • Adds urls and hostnames columns to the asset index page
    • Adds the next assessment type in the asset export report and search filter

    2 details in Everything

70. Release Notes - 12th March 2024 Mar 12, 2024 · release notes

    Edgescan adds scheduled report export, multi-org email support, investigation filtering, and asset export fields

    • Adds the ability to export the quarterly forecasting report via the platform
    • Allows using the same email address across multiple Edgescan organisations
    • Adds filter capability for investigations by schedule/scan status
    • Includes assignment_dates, asset status, and asset status description in the asset export
    • Updates domain services and records count on domains page

    5 details in Everything

71. Release Notes - 26th February 2024 Feb 26, 2024 · release notes

    Edgescan adds Insomnia file support for API assets, magic links for remediation, and HTTP defensive header grading for EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do.

    • Added support for Insomnia files in API asset uploads to allow importing API definitions directly from the Insomnia format
    • Added support for asset priority in the asset configuration modal to let users set importance levels for scanned assets
    • Added magic links in asset blockers to enable automated remediation by stakeholders who do not have access to the Edgescan platform
    • Added HTTP Defensive Header Grading to EASM to assess and display security posture of discovered web applications
    • Added EASM Licensing support to manage Extended Attack Surface Management entitlements within the platform

    5 details in Everything

72. Release Notes - 12th February 2024 Feb 12, 2024 · release notes

    Edgescan adds Postman collection API descriptors, bulk license unassignment, granular permission interface, and blocker-resume toggle.

    • Postman collection files are now supported as an API Descriptor format
    • A new user permissions interface allows for more granular assignment of permissions in bulk
    • Users can unassign a pooled licence from an asset even if another asset has consumption against it
    • Added greater support for EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation tagging

    4 details in Everything

73. Release Notes - 26th January 2024 Jan 26, 2024 · release notes

    Adds configurable chart types for Risk/Severity/threat and URL export from scan history UI

    • Customers can now export all crawled URLs from the last scan via a new button in the User Interface.
    • Allows configurable chart types for Risk, Severity & threat data visualizations.

    2 details in Everything

74. Release Notes - 9th January 2024 Jan 9, 2024 · release notes

    Edgescan updates query logic for non-closed vulnerabilities and export visibility for disabled assets

    • Adds ability to query vulnerabilities with status not equal to closed, combining risk accepted and open statuses into a single view
    • Ensures disabled assets appear in relevant exports and dashboards

    2 details in Everything

75. Release Notes - 19th December 2023 Dec 19, 2023 · release notes

    Edgescan adds EXF, CC/BCC notification support, and EXF detection for web scans.

    • Released Edgescan eXposure Factor (EXF).
    • Added CC and BCC fields to automated scan notifications in advanced options.
    • Added option to remove headers and footers in automated notifications via advanced options.
    • Adds notification of suspicious HTML comments and triggering keywords during web application scans.

    4 details in Everything