https://cybertoolchain.io/tools/levo New releases and features in Levo, tracked by The Cyber Toolchain. en Tue, 20 Oct 2026 07:55:22 GMT https://docs.levo.ai/changelog https://docs.levo.ai/changelog Tue, 20 Oct 2026 07:55:22 GMT Levo 1.3.x adds multi-GitHub-account linking, bulk AI triage, and a gateway path-bypass auth test⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds AI-assisted triage to bulk vulnerability selections, letting teams assess many findings at once.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an authentication-bypass test targeting gateway path-handling weaknesses. • Introduces Streamable HTTP transport support for the MCP server. • Adds a next-generation AI traffic tagger that attributes traffic to individual agents and sessions. • Adds a full Agent Detail view for inspecting discovered AI agents. • Discovers AI agents, models, and MCP tools from cloud providers. • Adds AI-driven authentication (AI-guided login with sign-in verification) for DAST web application scanning. • Deepens API discovery from source code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/october-20-2026 https://docs.levo.ai/changelog/october-20-2026 Tue, 20 Oct 2026 00:00:00 GMT Levo 1.4.0 makes authentication a first-class surface: per-endpoint auth visibility, autonomous posture findings, and exportable web scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Every API endpoint now shows how it authenticates directly in the inventory view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Application Insights gains a dedicated view for tracking weak authentication trends over time. • Web application scans can be saved and shared as a file. • Sensor tags are now propagated to the API inventory. • Custom-test findings are now easier to locate within the findings UI. Breaking changes: • Authentication columns in two CSV exports have been replaced — existing automation or tooling that parses those columns will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/october-13-2026 https://docs.levo.ai/changelog/october-13-2026 Tue, 13 Oct 2026 00:00:00 GMT Levo 1.3.0 adds multi-GitHub-account support, AI bulk triage, and a new authentication-bypass gateway test.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for connecting multiple GitHub accounts to a single organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds AI-assisted triage to bulk vulnerability selections. • Adds an authentication-bypass test for gateway path handling. • Improves endpoint trace listing load performance on large workspaces. • Improves AI-driven crawl efficiency by avoiding filter variants and focusing budget on real pages. • Improves AI-guided login to verify successful sign-in before a scan continues. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog https://docs.levo.ai/changelog Mon, 12 Oct 2026 08:08:12 GMT Levo adds license status visibility, bulk API endpoint merging, audit-format PDF exports, and a full AI-test authoring lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds license status display in-product with expiry warnings, a grace period, and clean end-of-access enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds bulk-merge for duplicate API endpoints in the API Surface view. • Adds an audit-format output option for the Vulnerabilities PDF, suitable for handing to auditors or customer security teams. • Adds a full create–validate–approve authoring lifecycle for custom AI-authored tests, binding every run to the exact human-reviewed code. • Enables web application scans to finish testing within budget while recording every distinct finding. Breaking changes: • License fields in the Workspace and Organization APIs have changed — any integration that reads those fields must be updated before upgrading to v1.2.135.7. • The API Surface export format has changed — any integration that reads it must be updated before upgrading to v1.2.135.4. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-7 https://docs.levo.ai/changelog/saas-1-2-135-7 Fri, 09 Oct 2026 00:00:00 GMT Levo 1.2.135.7 adds in-product license status with expiry warnings and enforces web scan test budgets while capturing all distinct findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Surfaces license status — including expiry warnings, a grace period, and end-of-access enforcement — inside the product UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enforces a test budget for web application scans, ensuring scans finish within budget while recording every distinct finding. Breaking changes: • License fields in the Workspace and Organization APIs have changed — any integration that reads those fields must be updated before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/october-6-2026 https://docs.levo.ai/changelog/october-6-2026 Tue, 06 Oct 2026 00:00:00 GMT Levo 1.2.135 adds bulk API endpoint merging and a full create-validate-approve lifecycle for custom AI-authored tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds bulk merge for duplicate API endpoints in the API Surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a full authoring lifecycle — create, validate, approve — for custom AI-authored tests, with every test run bound to the exact code a human reviewed. Breaking changes: • The API Surface export format has changed — integrations that read it must be updated before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-4 https://docs.levo.ai/changelog/saas-1-2-135-4 Tue, 06 Oct 2026 00:00:00 GMT Levo 1.2.135.4 adds bulk API endpoint merging and a full create-validate-approve lifecycle for custom AI-authored tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds bulk merge for duplicate API endpoints in the API Surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a full authoring lifecycle — create, validate, approve — for custom AI-authored tests, with each run bound to the exact code a human reviewed. Breaking changes: • The API Surface export format has changed — integrations that read the API Surface export must be updated before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-5 https://docs.levo.ai/changelog/saas-1-2-135-5 Tue, 06 Oct 2026 00:00:00 GMT Levo 1.2.135.5 adds an audit-format PDF export for Vulnerabilities and fixes auth-key viewing flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an audit-format option to the Vulnerabilities PDF export, producing a report suitable for handing to an auditor or a customer's security team.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Viewing a satellite, CLI, or test-runner auth key no longer redirects through the identity provider. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-3 https://docs.levo.ai/changelog/saas-1-2-135-3 Fri, 25 Sep 2026 00:00:00 GMT Levo 1.2.135.3 adds full test-category coverage by default, OTP support in web scans, endpoint merging, and API Surface report filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Default `levo test` runs now cover every test category instead of a subset, making a standard test run materially more complete without extra configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Web app scans can now prompt for a one-time code (OTP) mid-scan, enabling authenticated scanning of MFA-protected applications. • Duplicate API endpoints can now be merged into a single canonical endpoint in the API inventory. • Inactive APIs can now be excluded from API Surface reports. • The API Surface report gains new columns and filters requested by teams. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/september-22-2026 https://docs.levo.ai/changelog/september-22-2026 Tue, 22 Sep 2026 00:00:00 GMT Levo 1.2.135.2/1.2.135.3 adds WSO2 API Gateway integration, full-screen Service Graph, AI-assisted triage, and MFA support in DAST scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds one-click push of endpoints to WSO2 API Gateway from Levo.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a dedicated full-screen page for the Service Graph. • Adds second-factor (MFA) support for DAST scans. • Redesigns PDF reports for security testing results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-2 https://docs.levo.ai/changelog/saas-1-2-135-2 Tue, 22 Sep 2026 00:00:00 GMT Levo 1.2.135.2 adds WSO2 API Gateway integration, full-screen Service Graph, AI triage, and DAST second-factor support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds one-click push of endpoints to WSO2 API Gateway from the Levo platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a dedicated full-screen page for the Service Graph. • Adds AI-assisted triage directly from the vulnerability view. • Adds a redesigned PDF report format for scan results. • Reports tests that could not run as skipped rather than failed, reducing noise in security testing results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/september-15-2026 https://docs.levo.ai/changelog/september-15-2026 Tue, 15 Sep 2026 00:00:00 GMT Levo 1.2.135.1 adds per-app API security test tuning, bulk delete with RBAC, Beta Service Graph, form-encoded and unauthenticated-access test coverage, and quieter on-prem he⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a Beta Service Graph in the API catalog for visualizing service relationships.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-application tuning of API security testing settings. • Adds bulk delete of test runs under role-based access control. • Extends test coverage to form-encoded APIs. • Extends test coverage to unauthenticated-access probes. • Produces cleaner OpenAPI specs compatible with strict gateway imports. • Reduces alert noise for on-prem component health alerts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/saas-1-2-135-1 https://docs.levo.ai/changelog/saas-1-2-135-1 Tue, 15 Sep 2026 00:00:00 GMT Levo 1.2.135.1 adds per-app test config overrides, bulk scan delete, Service Graph (Beta), form-encoded body testing, and a new synchronous CreateFinding API mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `CreateFinding` API opt-in synchronous mode that returns event IDs on completion; default asynchronous behavior is unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-application security-test configuration overrides via a new Configuration tab on each application's Security Testing page, with settings marked as inherited from the environment or overridden for that application. • Adds `Active / Stale / Down` status filter on the On-Prem Deployments screen for Satellites, Taggers, Sensors, DAST Runners, and AI Gateways alongside the existing lifecycle filter. • Adds Service Graph (Beta) to the API catalog, visualizing call relationships between services; enabled per workspace from admin settings. • Adds bulk delete for API scans from the API Scans list, governed by the `Test Runs` delete permission in workspaces with roles enabled. • Adds `Test Runs` update and delete permissions, with Owner and Admin holding them by default; other roles require explicit grants. • Adds Admin-wide delete permissions across the platform, and grants Security Engineer the ability to delete endpoints. • Adds role and permission changes to the audit log under a new `Role` resource type, recording the role's identifier, permission set, and user-assignment actions as distinct events. • Extends Broken User Authentication tests to probe for unauthenticated access even when no authenticated baseline is available, reporting genuine resource-shaped responses as Medium, low-confidence 'unconfirmed' findings. • Extends API security testing to form-encoded request bodies, so URL-encoded form parameters are correlated and tested like any other structured body. • Consolidates component-health alerts for large fleets into a single email with a CSV listing components oldest-heartbeat first, instead of one email per detection wave. • Adds Install Satellite action to the Taggers tab on On-Prem Deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/september-1-8-2026 https://docs.levo.ai/changelog/september-1-8-2026 Tue, 08 Sep 2026 00:00:00 GMT Levo adds a new API discovery source, two new integrations, and an overhauled component health monitoring experience.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new API discovery source for broader API inventory coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces two new integrations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/q4-2025 https://docs.levo.ai/changelog/q4-2025 Thu, 23 Jul 2026 15:49:59 GMT Levo Q4 2025 adds web app scanning, AI security capabilities, a rebuilt notification system, and expanded API discovery. • New refreshed dashboard experience for improved operational visibility. • Completely rebuilt notification system for security alerts and events. • First wave of web application scanning capabilities. • New AI security capabilities for detecting AI-related risks. • Expanded API discovery to surface more of the attack surface. • Enhanced security testing controls for enterprise-scale operations. • New administrative controls to improve enterprise manageability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/june-2026 https://docs.levo.ai/changelog/june-2026 Mon, 01 Jun 2026 00:00:00 GMT Levo adds authentication testing upgrades, AI Security policy controls, new integrations, and a rebuilt scheduled reporting engine. • Major upgrades to authentication testing capabilities • New AI Security policy controls for configuration management • Faster performance across the platform • New integrations with external systems Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/may-2026 https://docs.levo.ai/changelog/may-2026 Fri, 01 May 2026 00:00:00 GMT Levo May 2026: redesigned Policy Hub, AI traffic tagger with agent attribution, and Streamable HTTP for MCP server. • Redesigned Policy Hub with identity-aware policies for finer-grained security controls. • Next-generation AI traffic tagger attributes traffic to individual agents and sessions. • New Agent Detail view surfaces per-agent activity and session context. • Adds Streamable HTTP transport support for the MCP server. • Deeper API discovery from source code expands coverage of detected endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/may-2026 https://docs.levo.ai/changelog/may-2026 Fri, 01 May 2026 00:00:00 GMT Levo adds Streamable HTTP to its MCP server and a redesigned Policy Hub with identity-aware policies for agent attribution. • Adds `Streamable HTTP` transport support for the Levo MCP server • Redesigned Policy Hub now supports identity-aware policies to tie traffic tags to specific agents and sessions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/april-2026 https://docs.levo.ai/changelog/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Levo adds AI agent/model/MCP discovery, AI Policies with guardrail alerting, and AI-driven DAST authentication. • Discovers AI agents, models, and MCP tools from cloud providers in the API catalog. • Introduces AI Policies with guardrail alerting for AI security enforcement. • Adds AI-driven authentication support for web application (DAST) scanning. • Expands reporting capabilities. • Ships new sensor deployment options. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/april-2026 https://docs.levo.ai/changelog/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Levo April 2026 introduces AI agent discovery, AI Policies/guardrail alerting, AI-driven DAST auth, and new reporting/deployment options • Adds AI agent, model, and MCP tool discovery from cloud providers to identify unauthorized assets • Introduces first AI Policies and guardrail alerting for automated control enforcement • Enables AI-driven authentication in web application scanning (DAST) for complex login flows • Expands reporting capabilities with new output formats or dashboards • Hardens sensors to improve detection reliability and reduce false positives • Ships new deployment options for enhanced infrastructure flexibility Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/march-2026 https://docs.levo.ai/changelog/march-2026 Tue, 31 Mar 2026 00:00:00 GMT Levo March 2026 adds DAST engine maturity, unified AI Gateway policies, async reporting, and configurable session management. • Enables scheduled and re-runnable web app scans via a new DAST scan action in CI/CD • Supports smart crawl depth with configurable per-scan depth and crawl-only mode for discovery • Allows AI/LLM-driven authentication for authenticated scans using cookies, local storage keys, and headers • Parses OpenAPI specs to broaden DAST vulnerability coverage including soft-404 and stored-XSS detection • Deploys on-prem scan runners with scheduled, org-isolated execution • Captures endpoint URL on DAST findings and adds a finding "Kind" filter (Web App Scans / Traffic / All) • Configures API discovery to skip specific HTTP methods via configurable ignored methods • Exports endpoints including created date and last-trace-received date with sorting by last trace arrival • Parses header parameters such as Content-Type and Accept automatically in API discovery • Adds a "Recently Discovered" filter at the application level for API Discovery • Streams live UI logs per test suite and provides quieter CLI output in non-interactive mode • Implements unified AI Gateway policy architecture with hot-reloaded policies from SaaS • Runs AI traffic through a forward-proxy governance pipeline for inline inspection • Enables live guardrail scanners in the AI Firewall via the AI Gateway and AI Firewall pages • Integrates Chrome extension AI Guardrails with LLM interception in enforce or observe modes • Sends AI Gateway traffic to the Levo Satellite for full API observability alongside other APIs • Forwards full LLM request bodies via a new Levo AI receiver and AI-proxy span processing for AI Discovery • Groups threats for easier triage with evidence surfaced in the Threat Feed and severity sorting • Applies bulk tag actions to findings and sorts findings by severity • Adds more filters on Findings and Applications pages, saved views on API Scans, and a stats API for consistent counts • Shows inline sample traces for PII with row selection, pagination by type, and auto-updating view • Creates findings with evidence from protection rules including Lua-based rules and deduplicates rate-limit findings • Adds bulk rule exclusions and custom header-injection rules with configurable content types and active WAF protection • Configures session inactivity and absolute timeouts with a banner explaining session end reason • Creates new organizations with a default "staging" environment for immediate traffic capture • Compares applications side by side with a new application comparison report available in the dashboard • Migrates reporting to an async pipeline for reliability at scale with additional report types and a new Reports page • Supports multiple CSV previews and adds solution field and detected AI endpoints to DAST scan report findings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/march-2026 https://docs.levo.ai/changelog/march-2026 Sun, 01 Mar 2026 00:00:00 GMT Levo adds scheduled DAST scans, AI-driven auth, live AI Gateway guardrails, and a new application comparison report. • Adds scheduled and on-demand DAST scan modes to the web application scanning engine. • Introduces AI/LLM-driven authentication for automated crawling of login-protected applications. • Enables smarter crawling in the DAST engine for broader application coverage. • Unifies AI Gateway policies with live guardrail enforcement. • Delivers a new application comparison report via a faster async reporting pipeline. • Supports configurable session management for scan and API monitoring workflows. • Adds sensor health notifications to alert on monitoring infrastructure issues. • Groups threats in the UI for clearer triage and prioritization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/february-2026 https://docs.levo.ai/changelog/february-2026 Sun, 01 Feb 2026 00:00:00 GMT Levo February 2026: CLI-driven DAST, AI Guardrails policies, agentless API discovery, and tagging across findings • Adds CLI-driven web application (DAST) scans for triggering scans from pipelines or the command line. • Includes evidence capture in DAST findings for proof-of-exploitation documentation. • Supports DOCX report export for DAST scan results. • Introduces a policy framework for AI Guardrails to define and enforce guardrail rules. • Enables multi-tenant and parallelized scanning in AI Guardrails for larger-scale coverage. • Adds tagging across findings and vulnerabilities for organization and filtering. • Separates threats into a dedicated feed for clearer triage. • Ships a new agentless API discovery CLI to discover APIs without deploying sensors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo https://docs.levo.ai/changelog/january-2026 https://docs.levo.ai/changelog/january-2026 Thu, 01 Jan 2026 00:00:00 GMT Levo ships Vigil AI firewall, DAST scanning, and external attack surface management in January 2026 • Introduces Vigil, an AI-native firewall for AI apps and MCP servers. • Launches web application scanning (DAST) capabilities. • Adds external attack surface management (EASM) capabilities. • Ships AI guardrails with end-to-end coverage. • Delivers AI discovery working end to end. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/levo