Plerion

No entries match these filters. Clear filters

1. CDR findings, easier to find and easier to read: Nov 4, 2026 · issue 130

   Plerion adds a two-view findings list separating configuration and CDR event findings, plus a narrative Event tab with a JSON toggle on CDR findings.

   • Plerion's findings list now has two views next to Group by: Configuration findings (opens by default, showing cloud, workload, and code configuration checks) and Event findings (showing CDR findings, newest first).
   • The Event tab on a CDR finding now shows a plain-language summary of who did what, where, and when, with a JSON toggle to view or copy the raw event.

   2 details in Everything

   • Updated integration CDR Event tab summaries for AWS services
2. Every asset, an owner: Nov 3, 2026 · issue 130

   Plerion: Assign a team, a person, or both to each asset so owners are notified when action is needed, and filter assets by owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Turn on AWS Security Incident Response case detections after updating your CDR StackSetStackSetAn AWS CloudFormation construct that deploys and manages stacks across multiple accounts and regions from a single template, letting cyber tools provision infrastructure at scale without per-account manual work., so your team is alerted whenever a case is opened or a comment is added.
   📍In Plerion, go to your profile settings and enable PLERION-CLOUDTRAIL-86, PLERION-CLOUDTRAIL-87, PLERION-CLOUDTRAIL-88, and PLERION-CLOUDTRAIL-89 (all are off by default). Then update your CDR StackSet to the latest template so that Security Incident Response events are forwarded to Plerion.
   • Discover owners automatically from existing tags, merge owners that are clearly the same, and keep them current as tags change.
   • Add ownership rules for assets your tags miss, by tag, integration, resource type, region or name, and see which assets nobody owns yet.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing CDR StackSet deployments must be updated to the latest template to send AWS Security Incident Response events to Plerion; without this update, PLERION-CLOUDTRAIL-86 through PLERION-CLOUDTRAIL-89 will not fire.
3. Say hello to a new Compute Engine secret check: Nov 3, 2026 · issue 129

   Plerion adds GCP Compute Engine secret and end-of-life checks, plus AWS Security Incident Response case detections in CDR⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Update your CDR StackSetStackSetAn AWS CloudFormation construct that deploys and manages stacks across multiple accounts and regions from a single template, letting cyber tools provision infrastructure at scale without per-account manual work. to the latest template to enable four new AWS Security Incident Response detections (PLERION-CLOUDTRAIL-86 through PLERION-CLOUDTRAIL-89) that fire when a case is created or updated, or when a comment is added or edited — detections are Medium severity and off by default, so turn them on in your profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Plerion adds a new GCP check (PLERION-GCP-340) that reads Compute Engine instance startup scripts from metadata keys startup-script, user-data, and the Windows startup and sysprep script keys, and fails the instance at Medium severity when a script holds a hard-coded credential — the finding names the metadata key, and the matched value is masked before storage.
   • Plerion adds a new GCP check (PLERION-GCP-341) that reads the public image license on a Compute Engine instance's boot disk and fails the instance at Medium severity when the OS is past end-of-life, covering Debian, Ubuntu, CentOS, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., Rocky Linux, AlmaLinux, Oracle Linux, SUSE, and Windows Server images.

   3 details in Everything

4. Continuous scanning for AWS accounts: Nov 2, 2026 · issue 129

   Plerion adds event-driven continuous scanning for AWS accounts, updating findings within minutes of CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. events, off by default and priced at 3 units per changed-asset scan.

   • New supported platformTurn on continuous scanning for an AWS account on the account integration's page (requires CDR to be set up first); it is off by default, re-scans on CloudTrail management events, and updates findings within minutes of each event.
   • Each continuous asset scan that finds a change costs 3 Plerion units; re-scans that detect no change are free; continuous scanning appears as its own type on the subscription usage chart.

   2 details in Everything

   • New vulnerability check CWPP service account template check
5. Top risks now cover Azure and GCP storage: Nov 1, 2026 · issue 127
   • New detection Publicly readable Azure blob container and Google Cloud Storage bucket top-risk detection
6. A public EBS snapshot share is never exempted as trusted: Oct 31, 2026 · issue 126
   • Updated detection Detect attempts to exfiltrate EBS snapshot by sharing it
   • Updated detection Detect attempts to exfiltrate AMI by sharing it
   • Updated detection Detect attempts to exfiltrate RDS snapshot by sharing it
7. IAM role fact check says Unknown when it cannot test the trust: Oct 30, 2026 · issue 125

   Plerion adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning for GitLab and Azure DevOps integrations and a new AWS SHIP lens on the Well-Architected page.

   • New detectionEnable static application security testingstatic application security testingStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for GitLab and Azure DevOps integrations to scan Java, Kotlin, TypeScript, Python, Go and other source files on default branch and merge or pull request scans, reporting injection flaws and weak cryptography as findings and inline comments; off by default.
   • New compliance frameworkPlerion's Well-Architected page now includes the AWS Security Health Improvement Program (SHIP) lens, grouping AWS Well-Architected Security best practices under SHIP's 11 security use cases with answers populated from Plerion findings.

   2 details in Everything

   • Updated vulnerability check IAM role publicly accessible fact check (PLERION-AWS-553) — Unknown state for untestable trust relationships
   • Retired vulnerability check Fourteen publicly-accessible fact checks retired — decisions now derived from configuration alone
   • Updated vulnerability check EBS snapshot publicly accessible fact check (PLERION-AWS-244) — batched queries and longer retries
   • Updated vulnerability check EC2 instance publicly accessible fact check (PLERION-AWS-194) — active HTTP probe through ALB listeners
8. Custom checks, now in Terraform: Oct 29, 2026 · issue 125

   Plerion adds a Terraform provider (plerionhq/plerion) for managing custom checks as code, with plan previews, dry runs, and import by slug or ID (Terraform 1.5+).

   • Updated vulnerability check Code Security checks now support exemptions
   • Updated integration Bitbucket integration adds SAST scanning
9. Exempt findings from your infrastructure as code: Oct 29, 2026 · issue 124

   Plerion now supports exemptions for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. findings, scoped to a full repository or a single file, persisting across future scans.

   • Exempt IaC findings by choosing Exempt on a finding or adding a name exemption to the code integration's profile, scoped to a repository (e.g. my-org/infra) or a single file (e.g. my-org/infra/s3.tf), persisting on every later scan.

   1 detail in Everything

   • Updated vulnerability check Code Security checks now support exemptions
10. Catch leaked AWS keys before someone runs up your Bedrock bill: Oct 28, 2026 · issue 123

    Plerion adds LLMjackingLLMjackingAn attack in which stolen cloud credentials are used to hijack access to large language model APIs, letting the attacker run inference at the victim's expense. detections, new Azure/GCP checks, and expands access-logging asset coverage across API Gateway, load balancers, VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. and EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds PLERION-CLOUDTRAIL-84 (Critical) to detect compromised AWS keys via AWS Health exposed/compromised access key reports, naming the key and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. user (requires us-east-1 in your CDR regions); PLERION-CLOUDTRAIL-85 (High) to detect deletion of Amazon Bedrock model invocation logging, a LLMjacking cover-track technique; PLERION-AWS-1252 (Low) to check whether CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. logs data events for AWS::BedrockMantle::Project, the endpoint for OpenAI-compatible and Anthropic Messages APIs, via an advanced event selector on a multi-region trail; and PLERION-AZURE-463 (Medium) to detect Azure Function App runtimes past Microsoft's end-of-support date, covering .NET, .NET isolated, Java, Node.js, PowerShell and Python, flagging Python 3.8/3.9, .NET 6, PowerShell 7.2, and Node.js 20 on next scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Promotes PLERION-GCP-18 (Medium) from a manual recommendation to an active finding: scans Cloud Function runtime and build environment variables for credentials (API keys, access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., private keys), naming the variable but never its value.
    • Expands the Access logging filter on the Assets page and the matching custom-report field to cover API Gateway (PLERION-AWS-494, PLERION-AWS-799, PLERION-AWS-801), load balancers (PLERION-AWS-791, PLERION-AWS-792, PLERION-AWS-795), VPCs (PLERION-AWS-37) and EKS clusters (PLERION-AWS-107).
    • Pleri (AI assistant) now names the specific file or package path carrying a CVE on each affected asset.
    • Widens PLERION-AWS-231 CloudFront general-logging check to pass distributions whose standard logging (v2) delivers via a CloudWatch Logs delivery to CloudWatch Logs, Amazon S3 or Amazon Data Firehose, and widens PLERION-AZURE-74 Key Vault logging check to pass vaults whose diagnostic setting enables the audit or allLogs category group, not only an explicit AuditEvent selection.
    • Adds PLERION-CLOUDTRAIL-84 (Critical) to detect compromised AWS keys via AWS Health exposed/compromised access key reports, naming the key and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. user (requires us-east-1 in your CDR regions); PLERION-CLOUDTRAIL-85 (High) to detect deletion of Amazon Bedrock model invocation logging, a LLMjacking cover-track technique; PLERION-AWS-1252 (Low) to check whether CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. logs data events for AWS::BedrockMantle::Project, the endpoint for OpenAI-compatible and Anthropic Messages APIs, via an advanced event selector on a multi-region trail; and PLERION-AZURE-463 (Medium) to detect Azure Function App runtimes past Microsoft's end-of-support date, covering .NET, .NET isolated, Java, Node.js, PowerShell and Python, flagging Python 3.8/3.9, .NET 6, PowerShell 7.2, and Node.js 20 on next scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !PLERION-AWS-835 (EFS access logging) is retired; its passed findings are removed on the next scan.
11. ECS cluster settings in your inventory: Oct 27, 2026 · issue 122

    ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. cluster configuration fields appear on each cluster asset after the next scan, enabling custom checks to test KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. and ECS Exec settings.

    • New supported platform Amazon ECS cluster settings inventory
12. Find every asset that runs a package: Oct 26, 2026 · issue 121

    Plerion adds package-based asset search with version range filtering to answer 'do we run this, and where?' across your inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    When a package release is reported as compromised, quickly find every asset in your inventory running a vulnerable version range.
    📍In the Plerion platform, go to Assets › Find by package, enter the compromised package name (or paste a list), then enter a version range such as >= 2.0, < 2.15.0 to see each affected asset with its exact version, environment, owner, and exposure.
    • Adds Find by package search on the Assets page to locate every asset running a given package, with version range filtering (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ >= 2.0, < 2.15.0) and results showing exact version, environment, owner, and exposure per asset.
    • Every package on an asset's SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. tab now links directly to the Find by package view for that package.
    • Adds Find by package search on the Assets page to locate every asset running a given package, with version range filtering (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ >= 2.0, < 2.15.0) and results showing exact version, environment, owner, and exposure per asset.

    1 more in Everything

13. changelog Oct 22, 2026 · issue 116

    Plerion adds Lambda Web Function inventory, four new Lambda checks, workload scanning, Sumo Logic integration, and APEC CBPRAPEC CBPRA voluntary privacy certification framework run by the Asia-Pacific Economic Cooperation that lets organizations demonstrate cross-border data transfer practices meet a baseline standard across member economies. compliance mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable the APEC CBPRCBPRCross-Border Privacy Rules, an APEC-led certification framework that lets organizations demonstrate compliance with data-privacy standards when transferring personal data across member economies. compliance framework to start mapping your cloud posture against its security safeguard requirements across AWS, Azure, GCP, and Kubernetes.
    📍In the Plerion console, go to Manage › Compliance › Manage frameworks, locate APEC Cross-Border Privacy Rules (CBPR) System Program Requirements, and toggle it on.
    Stream tenant audit logs to Sumo Logic in real time alongside findings, using the new workflow condition instead of the retired checkbox.
    📍In the Plerion console, open Workflows, select or create a workflow with a Sumo Logic action, click Add audit log condition, then save — audit events will post to your Sumo Logic HTTP Source as they occur.
    • Adds four new Lambda web function checks: PLERION-AWS-1246 (High) detects ApplicationManaged authentication-type Lambda web function endpoints that accept unauthenticated internet requests, naming the endpoints and domains, with failing web functions appearing in exposure views and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.; PLERION-AWS-1247 detects Lambda web functions whose resource policy grants external AWS principals (outside your Organization) invoke or management access, raising High for unrecognized accounts and Medium for trusted or conditional grants, showing principal, actions, and granting statement in Access Grants; PLERION-AWS-1248 (Medium) flags Lambda web function execution roles that allow every action on every resource with no condition, naming the role and policy statements; and PLERION-AWS-1249 (Low) flags Lambda web function execution roles with wildcard service-level permissions such as s3:* and no condition, naming the role and policy statements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Lambda Web Functions to asset inventory, showing each function's endpoints with authentication type and domain, revisions, execution roles, resource policy, and tags.
    • Adds a Sumo Logic workflow integration that posts findings as they open, change, and resolve (with a weekly full resend), supports Send tenant audit logs to stream audit events in real time, and provides a Sync now option for immediate delivery.
    • Adds Add audit log condition as a workflow condition for Sumo Logic actions, allowing tenant audit logs to be sent independently or alongside finding conditions; replaces the former Send tenant audit logs checkbox on the Sumo Logic action.
    • Adds APEC Cross-Border Privacy Rules (CBPR) System Program Requirements (November 2019) as a new compliance framework, mapping 6 of 73 requirements covering security safeguards, attack detection/response, and safeguard testing across AWS, Azure, GCP, and Kubernetes; enable it from Compliance under Manage frameworks.

    +2 more show less

    • Migrates check PLERION-AWS-1110 ('Agent registry publishes new records without review') to the new standalone Agent Registry service, collecting registries via agent-registry read permissions added in the latest Plerion stack; flags registries whose auto-approval rules include APPROVE_ALL.
    • Refreshes Global CBPR (September 2025 edition) mapping, expanding coverage across AWS, Azure, GCP, and Kubernetes for its 7 mapped requirements with checks for backups, encryption, exposure, audit logging, vulnerabilities, secrets, and alerting.
    • Adds four new Lambda web function checks: PLERION-AWS-1246 (High) detects ApplicationManaged authentication-type Lambda web function endpoints that accept unauthenticated internet requests, naming the endpoints and domains, with failing web functions appearing in exposure views and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.; PLERION-AWS-1247 detects Lambda web functions whose resource policy grants external AWS principals (outside your Organization) invoke or management access, raising High for unrecognized accounts and Medium for trusted or conditional grants, showing principal, actions, and granting statement in Access Grants; PLERION-AWS-1248 (Medium) flags Lambda web function execution roles that allow every action on every resource with no condition, naming the role and policy statements; and PLERION-AWS-1249 (Low) flags Lambda web function execution roles with wildcard service-level permissions such as s3:* and no condition, naming the role and policy statements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Lambda Web Functions to asset inventory, showing each function's endpoints with authentication type and domain, revisions, execution roles, resource policy, and tags.
    • Adds a Sumo Logic workflow integration that posts findings as they open, change, and resolve (with a weekly full resend), supports Send tenant audit logs to stream audit events in real time, and provides a Sync now option for immediate delivery.
    • Adds APEC Cross-Border Privacy Rules (CBPR) System Program Requirements (November 2019) as a new compliance framework, mapping 6 of 73 requirements covering security safeguards, attack detection/response, and safeguard testing across AWS, Azure, GCP, and Kubernetes; enable it from Compliance under Manage frameworks.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Send tenant audit logs checkbox on the Sumo Logic action is replaced by the Add audit log condition workflow condition; existing workflows that had the box ticked continue sending audit logs automatically.
14. Workload scanning covers Lambda web functions: Oct 21, 2026 · issue 115

    Lambda workload scanning now covers web function revisions with no new toggle required; unscanned functions surface the S3 bucket name for remediation.

    • Surfaces the S3 bucket name on any web function that cannot yet be scanned, guiding operators to share that bucket with Plerion the same way as for an AgentCore runtime deployed from a code zip.

    1 detail in Everything

    • Updated vulnerability check Lambda workload scanning extended to Lambda web functions
15. Say hello to a new Lambda check: Oct 20, 2026 · issue 114
    • New vulnerability check Lambda web function endpoint accepts requests without IAM authentication
16. Lambda Web Functions are now in your inventory: Oct 19, 2026 · issue 113
    • New integration AWS Lambda Web Functions inventory support
17. Global CBPR mapping refreshed: Oct 15, 2026 · issue 109

    Plerion adds Sumo Logic integration for findings and audit logs, and refreshes Global CBPRCBPRCross-Border Privacy Rules, an APEC-led certification framework that lets organizations demonstrate compliance with data-privacy standards when transferring personal data across member economies. compliance mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Route nightly workflow findings and real-time audit logs to Sumo Logic for centralised SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. correlation.
    📍In the platform, go to Integrations › Add Integration › Sumo Logic, enter your Sumo Logic HTTP Source URL, attach the integration as an action on a workflow, and tick Send tenant audit logs to stream audit events in real time. Use Sync now to push any pending changes immediately.
    • Adds a new Sumo Logic integration that posts to a Sumo Logic HTTP Source, sending workflow-selected findings as they open, change, and resolve, with every open finding resent weekly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables sending tenant audit logs to Sumo Logic in real time via the Send tenant audit logs option on the integration.
    • Provides a Sync now action on the Sumo Logic integration to push changes immediately on demand.
    • Refreshes the Global Cross-Border Privacy Rules (CBPR) System Program Requirements (September 2025 edition) mapping, expanding coverage across AWS, Azure, GCP, and Kubernetes for checks including backups, encryption, public/external exposure, audit logging, vulnerabilities, secrets, and alerting.
    • Adds a new Sumo Logic integration that posts to a Sumo Logic HTTP Source, sending workflow-selected findings as they open, change, and resolve, with every open finding resent weekly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables sending tenant audit logs to Sumo Logic in real time via the Send tenant audit logs option on the integration.
    • Provides a Sync now action on the Sumo Logic integration to push changes immediately on demand.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !If the Global CBPR framework has been enabled, posture scores for its 7 mapped requirements will change on the next scan due to the refreshed mapping.
18. APEC Cross-Border Privacy Rules requirements are now available: Oct 14, 2026 · issue 108

    Plerion adds APEC Cross-Border Privacy Rules (CBPRCBPRCross-Border Privacy Rules, an APEC-led certification framework that lets organizations demonstrate compliance with data-privacy standards when transferring personal data across member economies.) System Program Requirements as a new compliance framework mapping to AWS, Azure, GCP, and Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable the APEC CBPRAPEC CBPRA voluntary privacy certification framework run by the Asia-Pacific Economic Cooperation that lets organizations demonstrate cross-border data transfer practices meet a baseline standard across member economies. framework to start mapping your cloud posture against its requirements.
    📍In Plerion, go to Manage frameworks under Compliance, locate APEC Cross-Border Privacy Rules (CBPR) System Program Requirements, and toggle it on.
    • The APEC CBPR framework is off by default and must be enabled from Compliance under Manage frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

19. Agent Registry check follows Agent Registry to its new home: Oct 13, 2026 · issue 106

    Plerion migrates Agent Registry checks to AWS's new standalone Agent Registry service ahead of the 30 October 2026 Bedrock AgentCore API shutdown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Updates check PLERION-AWS-1110 ('Agent registry publishes new records without review') to run against registries in the new AWS Agent Registry service instead of the deprecated Bedrock AgentCore registry API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Reads new Agent Registry registries once the Plerion stack is updated to the latest version, which adds agent-registry read permissions.
    • Updates check PLERION-AWS-1110 ('Agent registry publishes new records without review') to run against registries in the new AWS Agent Registry service instead of the deprecated Bedrock AgentCore registry API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Registries created in AgentCore before 6 August are no longer checked and their open findings resolve — any findings from those legacy AgentCore registries will be automatically closed on upgrade.
20. changelog Oct 12, 2026 · issue 105

    Plerion adds 30+ new AWS checks spanning AgentCore IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, Multi-AZ resilience, deletion protection, quota usage, and Route 53 failover health.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds PLERION-AWS-1242: Route 53 hosted zone has a failover record without a health check (new, Medium) — finds hosted zones whose failover records lack a health check, causing Route 53 to treat the primary as always healthy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PLERION-AWS-1243: AWS service quota usage is at or above 80% (new, Medium) — covers EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. On-Demand Standard vCPUs, Elastic IPs, VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. per Region, and Lambda concurrent executions using 24-hour peak CloudWatch usage metrics.
    • Adds PLERION-AWS-1244: EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. managed node group uses subnets in a single Availability Zone (new, Low) — flags node groups where a single AZ outage removes every node.
    • Adds PLERION-AWS-1245: OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. domain does not have zone awareness enabled (new, Low) — flags domains where a single AZ outage takes out every node.
    • Adds PLERION-AWS-1197: RDS DB instance does not have deletion protection enabled (new) — instances inside a cluster are covered by the cluster check and skipped.

    +5 more show less

    • Adds PLERION-AWS-1198: EC2 instance does not have termination protection enabled (new) — Spot instances and instances in Auto Scaling groups are skipped.
    • Adds PLERION-AWS-1199: Auto Scaling group uses a single Availability Zone (new) — scanning appliance groups are skipped.
    • Adds PLERION-AWS-1200: VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. routes a subnet through a NAT gateway in another Availability Zone (new) — regional NAT gateways and VPCs without a NAT gateway are skipped.
    • Adds PLERION-AWS-1201: AgentCore code interpreter runs with an IAM execution role (new, Low) — flags custom interpreters where code injection could expose AWS credentials; AWS-provided interpreter is skipped.
    • Adds PLERION-AWS-1202: AgentCore browser runs with an IAM execution role (new, Low) — flags browsers where a forged request or malicious page could expose the role's credentials; AWS-provided browser is skipped.

    10 details in Everything

21. Sharper Reliability answers in Well-Architected workloads: Oct 8, 2026 · issue 097

    Plerion adds 39 live Reliability checks and 4 deletion-protection checks to Well-Architected AutoFill coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds checks PLERION-AWS-1197 (RDS DB instance deletion protection) and PLERION-AWS-1198 (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance termination protection) as new live-resource checks answering REL 9 and REL 11 in Well-Architected workloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extends PLERION-AWS-311 (RDS cluster deletion protection) and PLERION-AWS-614 (load balancer deletion protection) to run against live AWS accounts in addition to infrastructure-as-code templates.
    • Adds 39 live checks to the Reliability pillar covering backups for RDS, Aurora, DocumentDB, Neptune, ElastiCache, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions., and Redshift; snapshot encryption and sharing; RDS Multi-AZ; DynamoDB global tables; CloudFront origin failover; VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel redundancy; and SQS dead-letter queues.
    • Removes 33 retired checks and 15 misclassified security checks (such as IMDSv2 on Auto Scaling groups) from the Reliability pillar, raising AutoFill answer quality across 8 of 13 Reliability questions.
    • Adds checks PLERION-AWS-1197 (RDS DB instance deletion protection) and PLERION-AWS-1198 (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance termination protection) as new live-resource checks answering REL 9 and REL 11 in Well-Architected workloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !If you use AutoFill, Reliability pillar answers in Well-Architected workloads will change on the next daily run: 33 retired checks and 15 security checks have been removed, and 39 new live checks have been added.
22. Seventeen SageMaker privilege escalation checks are removed: Oct 6, 2026 · issue 096

    Plerion adds AI agent security inventory for Amazon Bedrock AgentCore and Agents Classic, plus KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key visibility on Bedrock assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Audit an Amazon Bedrock AgentCore runtime end-to-end — from its IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role to secrets in its container image — to understand the full blast radius if the agent is compromised.
    📍In Plerion, go to Agent Security › AgentCore Runtimes, select a runtime, then click through to Gateways, Tools, Memory, Guardrails, and IAM Role to trace the attack surface.
    Identify Bedrock or AgentCore resources that Plerion cannot fully inspect because a customer-managed KMS key is blocking read access.
    📍In Plerion, open any Amazon Bedrock or AgentCore asset page — if a customer-managed KMS key is restricting access, the page names the key so you can decide whether to grant Plerion read permission.
    • Adds Agent Security inventory covering Amazon Bedrock AgentCore runtimes and harnesses and Amazon Bedrock Agents Classic agents, letting you navigate from an agent to its gateways, tools, memory, guardrails, and IAM role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Scans container images and code inside AgentCore runtimes for exploitable vulnerabilities and secrets left in the image.
    • Raises findings for risky agent configuration, such as a gateway reachable without credentials or a memory store open to any AWS account.
    • When a customer-managed KMS key blocks Plerion from reading part of an Amazon Bedrock or AgentCore resource, the asset page now names the key and lets you decide whether to grant access.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Seventeen SageMaker privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. checks (PLERION-AWS-996 through PLERION-AWS-1012) are removed and no longer produce findings; these checks are also removed from the AWS Generative AI Lens, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001, NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold., OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. and Agentic Top 10, and AWS MSP Validation Checklist framework mappings.
23. Preferences and dashboards over the API: Oct 5, 2026 · issue 095

    Plerion exposes preferences and dashboards management via API, enabling programmatic control of home dashboards and sidebar navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds API key-authenticated endpoints to set a user's or user group's home dashboard and sidebar navigation, set the tenant default home dashboard, and list custom dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

24. 2026-10-05 Oct 5, 2026 · release notes

    Plerion adds APIs to manage user/home dashboards and list custom dashboards

    • /preferences API now allows setting a user’s or user group’s home dashboard and sidebar navigation, plus the tenant default home dashboard.
    • GET /dashboards/custom endpoint lists all custom dashboards for authenticated users.

    2 details in Everything

25. Know which vulnerabilities are likely to be exploited: Oct 4, 2026 · issue 094

    Plerion adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. exploit-likelihood scores to vulnerabilities, surfaced in dashboard, API, CLI, CSV, and workflow rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) score to every vulnerability, showing the probability of exploitation in the next 30 days as a percentage on the Vulnerabilities dashboard and code security issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables filtering and sorting of vulnerabilities by EPSS score in the Vulnerabilities dashboard.
    • Supports EPSS score as a condition in workflow and exemption rule configurations.
    • Surfaces EPSS scores in alerts, tickets, CSV downloads, the customer API, and the CLI.
    • Expands [PLERION-AWS-1195] AgentCore memory accessibility check to evaluate every read action an open policy allows, with findings rated High (ARN alone), Medium (ARN plus record or session ID), or Low (user and session IDs only).
    • Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) score to every vulnerability, showing the probability of exploitation in the next 30 days as a percentage on the Vulnerabilities dashboard and code security issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables filtering and sorting of vulnerabilities by EPSS score in the Vulnerabilities dashboard.
    • Supports EPSS score as a condition in workflow and exemption rule configurations.
    • Surfaces EPSS scores in alerts, tickets, CSV downloads, the customer API, and the CLI.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing [PLERION-AWS-1195] AgentCore memory findings previously rated High may be downgraded to Medium or Low on the next scan under the revised severity logic.
26. 2026-10-04 Oct 4, 2026 · release notes

    Plerion adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring to vulnerabilities and updates AgentCore memory findings [PLERION-AWS-1195]

    • Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) scores to vulnerabilities across the Vulnerabilities dashboard, code security issues, workflows, exemption rules, alerts, tickets, CSV downloads, the customer API and the CLI
    • Updates AgentCore memory finding logic for publicly accessible resources using [PLERION-AWS-1195], rating High/Medium/Low based on required access identifiers

    2 details in Everything

27. Say hello to a new AgentCore check: Oct 3, 2026 · issue 093
    • New vulnerability check AgentCore memory is publicly accessible
28. Threat mapping covers AI: Oct 2, 2026 · issue 090

    Plerion adds MITRE ATLAS AI FrameworkMITRE ATLAS AI FrameworkA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured vocabulary for AI-specific threat modelling. to Threat mapping alongside ATT&CK CloudATT&CK CloudA MITRE ATT&CK matrix covering adversary tactics and techniques specific to cloud environments, giving cyber tools a structured, vendor-neutral taxonomy to map detections or coverage against cloud-targeted attacks. and Containers matrices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Select the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATLAS AI Framework matrix to review AI-specific threat coverage for a cloud asset.
    📍In the Plerion console, navigate to an asset › Threat mapping tab › use the matrix picker to select MITRE ATLAS AI Framework.
    • Renames the Mitre attack tab on asset views to Threat mapping and adds the matrix picker there.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

29. 2026-10-02 Oct 2, 2026 · release notes

    Plerion adds MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling. threat mapping, broader Jira field support, expanded AWS identity inventory, and AgentCore scanning.

    • Adds the MITRE ATLAS AI FrameworkMITRE ATLAS AI FrameworkA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured vocabulary for AI-specific threat modelling. as a selectable matrix in the Threat Mapping UI for asset threat coverage.
    • Enables Jira workflow actions to set Priority, Labels, Components, Assignee, custom selects, and Jira Service Management Organizations fields from Plerion data or fixed values.
    • Adds inventory collection for Amazon Cognito user/identity pools, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Identity Center instances, permission sets, users/groups, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. providers, Roles Anywhere, Verified Permissions stores, and Directory Service directories.
    • Introduces Amazon Bedrock AgentCore Runtime as a distinct workload type in onboarding and integration settings.

    4 details in Everything

30. AgentCore runtimes get workload scanning: Oct 1, 2026 · issue 092

    Plerion now scans Amazon Bedrock AgentCore runtime container images for vulnerabilities, secrets, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds vulnerability, sensitive-data, and SBOM scanning for Amazon Bedrock AgentCore runtimes that run a container image, with results on the runtime's asset page — activated automatically when Lambda scanning is on for the integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ten new AWS checks (PLERION-AWS-1185 through PLERION-AWS-1194) covering low/medium/high/critical image vulnerabilities, low/medium/high/critical secret exposure, exploitable vulnerabilities, and known-exploited vulnerabilities for AgentCore runtime images.
    • Enables code-zip AgentCore runtimes to be scanned like Lambda functions by turning on Bucket ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. for the S3 bucket holding the zip and tagging it PlerionAccess: Granted.

    3 details in Everything

31. Azure workload scanning covers every workload family: Sep 30, 2026 · release notes

    Plerion v1.2.9 expands Azure workload scanning to Container Apps, Batch, VM data disks and OpenShift

    • Adds support for scanning Virtual Machine Scale Sets, Container Apps, Container Instances, Batch pools and App Service web apps in addition to existing virtual machines and functions coverage.
    • Adds 8 new Azure checks for exploitable and known-exploited vulnerabilities in Container App, Container Instance, Batch pool images and Batch application packages.

    2 details in Everything

32. Azure workload scanning covers every workload family: seen Sep 27, 2026 · issue 087

    Plerion Azure workload scanning expands to App Service, VM Scale Sets, Container Apps, Container Instances, and Batch pools⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable scanning for newly supported workload types on an Azure subscription so Container Apps and Batch pools are included in vulnerability and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. assessments.
    📍In the Plerion console, go to the subscription's Workload Scanning Settings and toggle on App Service web apps, Container Apps, Container Instances, and Batch pools.
    • Extends vulnerability, sensitive data, and SBOM scanning to Azure App Service web apps, Virtual Machine Scale Sets, Container Apps, Container Instances, and Batch pools — in addition to the virtual machines and functions already covered.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Covers Service Fabric node types through their underlying scale sets.
    • Samples Uniform-orchestration scale sets by image, scanning one member per distinct image.
    • Generates attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings for publicly exposed workloads with high or critical vulnerabilities (PLERION-AZURE-446).
    • Grants AcrPull to the appliance identity via the install script so container images in Azure Container Registries can be pulled for scanning.

    +3 more show less

    • Adds OpenShift, Service Fabric, and Batch resources to the inventory.
    • Adds six new Azure checks for exploitable and known-exploited vulnerabilities in container workload and Batch pool images: PLERION-AZURE-452 (Container App exploitable), PLERION-AZURE-453 (Container App known-exploited), PLERION-AZURE-454 (Container Instance exploitable), PLERION-AZURE-455 (Container Instance known-exploited), PLERION-AZURE-459 (Batch pool image exploitable), PLERION-AZURE-460 (Batch pool image known-exploited).
    • Enables each workload type individually under the subscription's workload scanning settings.
    • Extends vulnerability, sensitive data, and SBOM scanning to Azure App Service web apps, Virtual Machine Scale Sets, Container Apps, Container Instances, and Batch pools — in addition to the virtual machines and functions already covered.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Covers Service Fabric node types through their underlying scale sets.
    • Samples Uniform-orchestration scale sets by image, scanning one member per distinct image.
    • Generates attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings for publicly exposed workloads with high or critical vulnerabilities (PLERION-AZURE-446).
    • Grants AcrPull to the appliance identity via the install script so container images in Azure Container Registries can be pulled for scanning.

    +2 more show less

    • Adds six new Azure checks for exploitable and known-exploited vulnerabilities in container workload and Batch pool images: PLERION-AZURE-452 (Container App exploitable), PLERION-AZURE-453 (Container App known-exploited), PLERION-AZURE-454 (Container Instance exploitable), PLERION-AZURE-455 (Container Instance known-exploited), PLERION-AZURE-459 (Batch pool image exploitable), PLERION-AZURE-460 (Batch pool image known-exploited).
    • Enables each workload type individually under the subscription's workload scanning settings.

    1 more in Everything

33. api-docs-2981f275f2f9 Sep 26, 2026 · issue 086

    Plerion adds role-scoped API keys and a GET /v1/tenant/openapi endpoint that returns a filtered OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 spec for any key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Audit exactly which API operations a restricted key is permitted to call, without trial and error against live endpoints.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

34. api-docs-2981f275f2f9 Sep 25, 2026 · issue 085

    Plerion API now exposes GET /v1/tenant/openapi to return a role-scoped OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 spec for any API key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Audit exactly which API operations a restricted key is permitted to call before wiring it into an integration.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

    • Introduces role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for API keys, with built-in Tenant admin (full access) and Tenant read-only roles plus support for custom roles that restrict which operations and integrations a key can reach; unauthorized requests receive 403 Forbidden with body {"message":"Forbidden"}.

    1 detail in Everything

35. api-docs-2981f275f2f9 Sep 24, 2026 · issue 084

    Plerion: Introduces role-based API key permissions: Tenant admin keys can call every operation, while Tenant read-only and custom roles restrict which operations and integrations a key may access, with unauthorized requests refused as 403 Forbidden.

    ⤢ ⤢
    └──▷ TRY IT
    Audit exactly which API operations a restricted key is allowed to call — useful when provisioning a least-privilege integration key.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

36. api-docs-2981f275f2f9 Sep 23, 2026 · issue 083

    Plerion API keys gain role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and a new GET /v1/tenant/openapi endpoint that returns a role-scoped OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Verify exactly which API operations a least-privilege key is allowed to call before deploying an integration.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

    • Adds GET /v1/tenant/openapi endpoint that returns the full API reference as an OpenAPI 3.1 document scoped to the calling key's permissions — operations the role cannot call are omitted; send Accept: application/yaml to receive YAML instead of the default JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

37. Tag an integration in Plerion: Sep 23, 2026 · issue 083

    Plerion adds per-integration tags (API-accessible), two new S3 checks, and standalone SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Tag an integration via the UI when you cannot set tags in AWS Organizations — the tag immediately overrides the same key on the AWS account side and updates all groups using it.
    📍In the Plerion console, open the integration's settings page › scroll to the new Tags section › enter a key (autocompleted from keys already on other integrations) and a value › save.
    Enable SCIM provisioning so your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can automatically create, update, and deprovision Plerion users.
    📍In the Plerion console, go to Admin › Security › Single sign-on › SCIM provisioning, copy the SCIM base URL, then configure your identity provider to authenticate using a readWrite organization API key.
    • Adds a Tags section to each integration's settings page where you can define key-value tags that override AWS account tags with the same key — tag groups update within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes integration tags through the API: every integration returned by the API now carries its tags along with the source of each tag.
    • Adds new S3 check PLERION-AWS-1182: S3 bucket default encryption does not use a customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key — passes buckets encrypted with aws:kms or aws:kms:dsse under an owned key; fails buckets on AES256, no encryption, or an AWS-managed SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates.-KMS key (including the console's AWS managed key (aws/s3)); Medium severity.
    • Adds new S3 check PLERION-AWS-1181: S3 Multi-Region Access Point does not block public access — passes only when all four Block Public Access flags are enabled on the access point; Medium severity.
    • Adds SCIM provisioning: point your identity provider at the SCIM base URL under Admin > Security > Single sign-onSingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. > SCIM provisioning and authenticate with a readWrite organization API key.

    +2 more show less

    • Separates just-in-time provisioning from SCIM: the Create users at first sign-in setting now operates independently, with no dependency on SCIM state.
    • Raises PLERION-AWS-532 (S3 cross-account access) from Medium to High severity; all open findings on the check move to High on the next scan, and the check is now filed under data at risk, access control, and cross-account categories.
    • Adds a Tags section to each integration's settings page where you can define key-value tags that override AWS account tags with the same key — tag groups update within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds new S3 check PLERION-AWS-1182: S3 bucket default encryption does not use a customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key — passes buckets encrypted with aws:kms or aws:kms:dsse under an owned key; fails buckets on AES256, no encryption, or an AWS-managed SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates.-KMS key (including the console's AWS managed key (aws/s3)); Medium severity.
    • Adds new S3 check PLERION-AWS-1181: S3 Multi-Region Access Point does not block public access — passes only when all four Block Public Access flags are enabled on the access point; Medium severity.
    • Adds SCIM provisioning: point your identity provider at the SCIM base URL under Admin > Security > Single sign-onSingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. > SCIM provisioning and authenticate with a readWrite organization API key.

    3 more in Everything

38. api-docs-2981f275f2f9 Sep 22, 2026 · issue 082

    Plerion: Adds GET /v1/tenant/openapi endpoint that returns this API reference as an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 document scoped to the calling key's role — operations the role cannot call are omitted; send Accept: application/yaml to receive YAML instead of the default JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Discover exactly which API operations a given key is permitted to call, useful for auditing least-privilege keys before handing them to an integration.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

39. 2026-09-22 Sep 22, 2026 · release notes

    Plerion adds S3 check for public internet access points and fixes multiple S3 finding descriptions

    • Adds PLERION-AWS-1180 to detect S3 access points with NetworkOrigin: Internet
    • Updates PLERION-AWS-875 to detect website hosting via redirect rules

    2 details in Everything

40. api-docs-2981f275f2f9 Sep 21, 2026 · issue 081

    Plerion API now exposes GET /v1/tenant/openapi to return a role-scoped OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 spec for any API key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Discover exactly which API operations a given key is permitted to call — useful for auditing least-privilege keys or generating a scoped SDK.
    copy

    $ curl --request GET \
      --url "https://$PLERION_API_URL/v1/tenant/openapi" \
      --header "Authorization: Bearer $PLERION_API_KEY" \
      --header "Accept: application/yaml"

    • Introduces role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for API keys, supporting Tenant admin (full access) and Tenant read-only roles plus custom roles; requests outside the role's permissions return 403 Forbidden with {"message":"Forbidden"}.

    1 detail in Everything

41. API keys now hold a role: Sep 21, 2026 · issue 081

    Plerion API keys now carry a role, and a new IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scan upload permission gates POST /v1/tenant/shiftleft/iac/scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit what API operations a specific key is allowed to call — useful when scoping a least-privilege integration key.
    copy

    $ curl -s -H 'Authorization: Bearer <your-api-key>' https://api.plerion.com/v1/tenant/openapi

    Upload an IaC scan result using a key whose role carries the CodeRepository:RequestScan permission.
    copy

    $ curl -s -X POST https://api.plerion.com/v1/tenant/shiftleft/iac/scan \
      -H 'Authorization: Bearer <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d @scan-results.json

    Assign a least-privilege role to an API key at creation time so it cannot perform write operations.
    📍In the Plerion console, go to API keys › Create key, set Role to Tenant read-only, then save. To update an existing key, select it from the API keys list and choose a different role.
    • Adds role assignment to every tenant API key; new keys can be created with Tenant read-only or a custom role, and an existing key's role can be changed from the API keys list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /v1/tenant/openapi endpoint that returns the API reference scoped to the calling key's role, so a key can discover exactly what it is permitted to call.
    • Gates IaC scan uploads behind a new CodeRepository:RequestScan permission on POST /v1/tenant/shiftleft/iac/scan; custom roles can add it via Request code scans under Manage integrations.

    3 details in Everything

42. Say hello to a new Redshift check: Sep 21, 2026 · issue 081

    Plerion adds four new checks: Redshift enhanced VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. routing, Security Hub AI Best Practices, Kinesis channel encryption, and Organizations member-account exit controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds check PLERION-AWS-329 (High severity) that fails any Redshift cluster whose EnhancedVpcRouting setting is off, ensuring COPY and UNLOAD traffic to S3 stays inside the VPC and is visible to security groups, network ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., endpoint policies, and VPC Flow Logs; maps to AWS Foundational Security Best Practices Redshift.7, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Controls v8, and NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds check PLERION-AWS-1177 (Medium severity) that fails any AWS region where the Security Hub AI Security Best Practices standard is not in READY state, covering 31 automated controls for Amazon Bedrock, Amazon Bedrock AgentCore, and Amazon SageMaker; maps to the AWS Well-Architected Machine Learning Lens and Generative AI Lens.
    • Adds check PLERION-AWS-1176 that fails any Kinesis Data Streams channel encrypted with an AWS-owned key rather than a customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key; Plerion now collects Kinesis channels as a new asset type.
    • Adds check PLERION-AWS-1178 (High severity) that fails any AWS organization where at least one active member account is not covered by an unconditional SCPSCPSecure Copy Protocol, a file-transfer method built on SSH that encrypts data in transit; cyber tools use it to move files to or from remote hosts without exposing credentials or content. Deny of both organizations:LeaveOrganization and account:CloseAccount.
    • Expands check PLERION-AWS-791 ('Application Load Balancer does not have access logging enabled') to pass ALBs that deliver access logs to CloudWatch Logs in addition to those logging to S3.
    • Adds check PLERION-AWS-329 (High severity) that fails any Redshift cluster whose EnhancedVpcRouting setting is off, ensuring COPY and UNLOAD traffic to S3 stays inside the VPC and is visible to security groups, network ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., endpoint policies, and VPC Flow Logs; maps to AWS Foundational Security Best Practices Redshift.7, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Controls v8, and NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds check PLERION-AWS-1177 (Medium severity) that fails any AWS region where the Security Hub AI Security Best Practices standard is not in READY state, covering 31 automated controls for Amazon Bedrock, Amazon Bedrock AgentCore, and Amazon SageMaker; maps to the AWS Well-Architected Machine Learning Lens and Generative AI Lens.
    • Adds check PLERION-AWS-1176 that fails any Kinesis Data Streams channel encrypted with an AWS-owned key rather than a customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key; Plerion now collects Kinesis channels as a new asset type.
    • Adds check PLERION-AWS-1178 (High severity) that fails any AWS organization where at least one active member account is not covered by an unconditional SCPSCPSecure Copy Protocol, a file-transfer method built on SSH that encrypts data in transit; cyber tools use it to move files to or from remote hosts without exposing credentials or content. Deny of both organizations:LeaveOrganization and account:CloseAccount.

    1 more in Everything

43. API keys now hold a role: Sep 21, 2026 · release notes

    API keys now hold roles; POST /v1/tenant/shiftleft/iac/scan requires new permission

    └──▷ TRY IT
    Check what actions your current API key is authorized to perform.
    copy

    $ curl -H "Authorization: Bearer <your-api-key>" https://<tenant>.plerion.com/v1/tenant/openapi

    • Adds role-based access to API keys with GET /v1/tenant/openapi returning the key's specific API reference.
    • Adds CodeRepository:RequestScan permission required for POST /v1/tenant/shiftleft/iac/scan scans.

    2 details in Everything

44. Custom reports are now custom dashboards, and you can assign one as a homepage: Sep 17, 2026 · issue 077

    Plerion renames custom reports to custom dashboards and adds homepage assignment, widget builder, and per-user home dashboard override.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Assign a custom dashboard as the default landing page for a user group so they see role-specific findings on sign-in.
    📍In the console, go to Settings › Custom dashboards, open the dashboard you want to set as the landing page, click Assign as homepage, then select the target users or user groups and confirm.
    Override an admin-assigned homepage with a personal dashboard so your preferred view loads on every sign-in.
    📍In the console, go to Profile › Home dashboard, select your preferred dashboard from the list, and save. Clear the selection at any time to revert to the admin-assigned dashboard.
    • Adds Assign as homepage action in Settings > Custom dashboards to designate a dashboard as the landing page for selected users and user groups on sign-in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Add widget panel of ready-made widgets and Build your own flow with Show me, Broken down by, and Shown as fields for creating custom dashboard widgets.
    • Adds Profile > Home dashboard setting that lets individual users override any admin-assigned homepage dashboard, with clearing restoring the assignment.

    3 details in Everything

45. Onboard with Terraform and scan in a service account you own: Sep 16, 2026 · issue 076

    Plerion Terraform onboarding now supports all three workload scanning modes, including operator-owned service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Terraform onboarding now supports all three workload scanning deployment models, including a service account you own and Plerion operates, keeping scanning inside your organization without appliances in scanned accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Two Terraform templates provision a service account setup: one grants Plerion the required access, and one deploys per-region resources (appliance network, auto-scaling scan pool, and snapshot encryption key), both registering with Plerion automatically during terraform apply with no manual console steps.

    2 details in Everything

46. 2026-09-16 Sep 16, 2026 · release notes

    Plerion v2026-09-16 introduces new integration capabilities, including Terraform-based infrastructure provisioning and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI client connectivity.

    • Adds terraform apply-based onboarding templates to provision a workload scanning service account within your own organization
    • Adds a Plerion MCP server that exposes Public API operations and the pleri_chat tool for direct interaction from Claude, Cursor, VS Code, Windsurf, Zed, and Kiro CLI

    2 details in Everything

47. SCIM provisioning: Sep 15, 2026 · issue 075

    Plerion adds SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, user groups with role inheritance, org-scoped API keys, and break-glass admin accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 provisioning support so Okta, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., or any SCIM 2.0 identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can create, update, and deactivate Plerion users, with existing users matched by email address and adopted automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds user groups that grant roles to every member, syncable from an identity provider over SCIM or created directly in Plerion.
    • Adds organization API keys scoped to the whole organization with read or readWrite access, used by identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for SCIM provisioning.
    • Adds break-glass admin accounts — organization admins who can always sign in with a password and cannot be deactivated by an identity provider, with at least one required when SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. or SCIM is enabled.

    4 details in Everything

48. Google Cloud workload security: Sep 10, 2026 · issue 070

    Plerion adds Google Cloud workload security scanning for Compute Engine, Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Cloud Functions with keyless WIFWIFWorkload Identity Federation is a Google Cloud mechanism that lets external workloads authenticate to Google APIs using short-lived tokens from a trusted identity provider, eliminating the need to manage long-lived service account keys. access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Scans inside GCP workloads — Compute Engine instances, managed instance groups, and custom images — for vulnerabilities, software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., and secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extends workload scanning to Cloud Run services and Cloud Functions (1st and 2nd gen) for vulnerabilities, SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., and secrets.
    • Runs all GCP workload scans inside a dedicated scanning project within your own organization, keeping data in-boundary.
    • Authenticates to GCP without keys via workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. federation (WIF).

    4 details in Everything

49. The Kubernetes collector manager runs on arm64: Sep 8, 2026 · issue 068

    Plerion Kubernetes collector manager now ships as a multi-arch image supporting arm64 (Graviton) alongside amd64.

    • Publishes the Kubernetes collector manager as a multi-architecture image for both amd64 and arm64, enabling deployment on Graviton node pools without requiring a dedicated x86 node or nodeSelector configuration.

    1 more in Everything

50. 2026-09-08 Sep 8, 2026 · release notes

    Plerion v2026-09-08 adds arm64 collector manager support and AWS Organizations-based integration groups via Settings.

    • arm64 platform support for the collector manager image (Graviton node pools)
    • Settings > Integration groups to define AWS account groupings by Organizations tag keys

    2 details in Everything

51. Vulnerability auto-triage (experimental): Sep 7, 2026 · release notes

    Plerion adds experimental vulnerability auto-triage to lower severity for limited-harm weaknesses

    • Enables experimental vulnerability auto-triage that lowers severity for weaknesses with limited harm potential (e.g., kernel CVEs in containers, memory-only exhaustion, physical access faults) across profiles.

    1 detail in Everything

52. Kubernetes identities now carry privilege context: Aug 27, 2026 · release notes

    Plerion v2026-08-27 adds Kubernetes privilege context and 10 new identity checks to cloud posture monitoring

    └──▷ HOW TO FIND IT
    Receive notifications when any Kubernetes workload runs with escalated privileges.
    📍In Plerion Settings › Notifications, create a rule where Check ID is in [PLERION-K8S-177, PLERION-K8S-178, PLERION-K8S-179, PLERION-K8S-180, PLERION-K8S-181, PLERION-K8S-182, PLERION-K8S-183, PLERION-K8S-184, PLERION-K8S-185, PLERION-K8S-186]
    • Tags Kubernetes service accounts, nodes, workloads, and role bindings with administrator, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., or overly permissive privileges so they appear in existing asset filters, risk scores, and notification rules.
    • Propagates administrator privileges from a service account to every Deployment, DaemonSet, StatefulSet, Job, CronJob, and Pod where the account's token is mounted in the pod.
    • Introduces 10 new checks ([PLERION-K8S-177] through [PLERION-K8S-186]) for detecting cluster administrator bindings, privilege escalation paths, overly permissive accounts, and node-level privilege issues.

    3 details in Everything

53. Review external access to AWS with resource access grants: Aug 21, 2026 · issue 052

    Plerion adds external access inventory and in-product access reviews across 97 AWS resource types and four sharing mechanisms.

    └──▷ HOW TO FIND IT
    Suppress the first-scan wave of untrusted-access findings by pre-loading known-good external principals before reviewing findings one by one.
    📍In Plerion, go to Settings › Profiles › Trusted principals and add the AWS account IDs, federated identities, or AWS services that your organization intentionally grants access to.
    • Builds an external access grant inventory for every tenant, analyzing 97 AWS resource types across four sharing mechanisms: resource policies, role trust policies, Resource Access Manager (RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed.) shares, and cross-account permissions set directly as an attribute.
    • Supports exporting access grants to a spreadsheet for offline access reviews.
    • Enables end-to-end access reviews inside Plerion: assign a team accountable for a grant, record a Keep, Remove, Review later, or Trust until review decision, add notes, and set a future review date.
    • Maintains a full audit history of every decision change per grant, with a Past due preset to surface grants whose review date has passed.
    • Raises a finding for every asset that grants access to an external principal not confirmed as trusted, with trusted principals configurable in Settings > Profiles > Trusted principals.

    5 details in Everything

54. Review external access to AWS with resource access grants: Aug 21, 2026 · issue 008

    Plerion adds external access inventory and in-product access reviews across 97 AWS resource types and four sharing mechanisms.

    └──▷ HOW TO FIND IT
    Suppress the first-scan wave of untrusted-access findings by pre-loading known-good external principals before reviewing findings one by one.
    📍In Plerion, go to Settings › Profiles › Trusted principals and add the AWS account IDs, federated identities, or AWS services that your organization intentionally grants access to.
    • Builds an external access grant inventory for every tenant, analyzing 97 AWS resource types across four sharing mechanisms: resource policies, role trust policies, Resource Access Manager (RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed.) shares, and cross-account permissions set directly as an attribute.
    • Supports exporting access grants to a spreadsheet for offline access reviews.
    • Enables end-to-end access reviews inside Plerion: assign a team accountable for a grant, record a Keep, Remove, Review later, or Trust until review decision, add notes, and set a future review date.
    • Maintains a full audit history of every decision change per grant, with a Past due preset to surface grants whose review date has passed.
    • Raises a finding for every asset that grants access to an external principal not confirmed as trusted, with trusted principals configurable in Settings > Profiles > Trusted principals.

    5 details in Everything

55. Detection exemptions, now over the API: Aug 20, 2026 · issue 051

    Plerion adds API access to detection exemptions — read, write, or clear without opening the platform.

    • New API endpoints to read, write, and clear detection exemptions on any detection without using the platform UI.
    • Exemption matching supports asset name, tags, region, principal, or API Gateway route as match criteria.
    • Existing findings on the dashboard are re-evaluated immediately when exemptions are written, rather than waiting for the next scan.
    • List profiles via the API first — the default profile covers only integrations that have no profile of their own.

    4 details in Everything

56. Detection exemptions, now over the API: Aug 20, 2026 · issue 008

    Plerion adds API access to detection exemptions — read, write, or clear without opening the platform.

    • New API endpoints to read, write, and clear detection exemptions on any detection without using the platform UI.
    • Exemption matching supports asset name, tags, region, principal, or API Gateway route as match criteria.
    • Existing findings on the dashboard are re-evaluated immediately when exemptions are written, rather than waiting for the next scan.
    • List profiles via the API first — the default profile covers only integrations that have no profile of their own.

    4 details in Everything

57. 2026-08-20 Aug 20, 2026 · release notes

    Plerion adds API endpoints to manage detection exemptions by asset properties.

    • Adds ability to read, create, and clear detection exemptions via the API without using the UI
    • Enables exemption matching on asset name, tags, region, principal, or API Gateway route
    • Re-evaluates existing dashboard findings immediately when exemptions are updated

    3 details in Everything

58. Plerion’s compliance frameworks, rebuilt against today’s detections: seen Aug 17, 2026 · issue 048

    Plerion rebuilds 40 compliance frameworks with 15,250 mappings, adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS Benchmark v7.0.0, and retires superseded editions.

    • Rebuilds 40 compliance frameworks from scratch against the current detection catalog, producing 15,250 control-to-detection mappings across AWS, Azure, GCP, and now Kubernetes (29 frameworks).
    • Promotes 18 frameworks to their publisher's latest edition, including PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0.1, NIST SP 800-53 Rev 5 Release 5.2.0, CSA CAIQ v4.1, UK NCSC CAF 4.0, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev 5 CR26 baselines.
    • Adds CIS Amazon Web Services Foundations Benchmark v7.0.0 with all 70 recommendations mapped to Plerion detections, including six new AWS Organizations controls (centralized root access, authorization guardrails, organizational unit structure, delegated administrators) and a check for reaching AWS services over VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoints, each tagged with CIS Level 1 or Level 2 profile.
    • Retires 23 superseded framework editions — including PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS 4.0 and 3.2.1, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2013, and FFIEC CAT — removing them from the framework list while preserving existing mappings.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Compliance posture percentages will shift in both directions across all 40 rebuilt frameworks because the control-to-detection mappings were reconstructed rather than patched.
    • !23 retired framework editions (including PCI DSS 4.0, PCI DSS 3.2.1, NIST CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1, ISO/IEC 27001:2013, CIS AWS Foundations Benchmark v4.0.1, and FFIEC CAT) are removed from the framework list; FFIEC CAT has no successor framework.
59. Plerion’s compliance frameworks, rebuilt against today’s detections: seen Aug 17, 2026 · issue 008

    Plerion rebuilds 40 compliance frameworks with 15,250 mappings, adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS Benchmark v7.0.0, and retires superseded editions.

    • Rebuilds 40 compliance frameworks from scratch against the current detection catalog, producing 15,250 control-to-detection mappings across AWS, Azure, GCP, and now Kubernetes (29 frameworks).
    • Promotes 18 frameworks to their publisher's latest edition, including PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0.1, NIST SP 800-53 Rev 5 Release 5.2.0, CSA CAIQ v4.1, UK NCSC CAF 4.0, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev 5 CR26 baselines.
    • Adds CIS Amazon Web Services Foundations Benchmark v7.0.0 with all 70 recommendations mapped to Plerion detections, including six new AWS Organizations controls (centralized root access, authorization guardrails, organizational unit structure, delegated administrators) and a check for reaching AWS services over VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoints, each tagged with CIS Level 1 or Level 2 profile.
    • Retires 23 superseded framework editions — including PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS 4.0 and 3.2.1, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2013, and FFIEC CAT — removing them from the framework list while preserving existing mappings.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Compliance posture percentages will shift in both directions across all 40 rebuilt frameworks because the control-to-detection mappings were reconstructed rather than patched.
    • !23 retired framework editions (including PCI DSS 4.0, PCI DSS 3.2.1, NIST CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1, ISO/IEC 27001:2013, CIS AWS Foundations Benchmark v4.0.1, and FFIEC CAT) are removed from the framework list; FFIEC CAT has no successor framework.
60. 2026-08-17 Aug 17, 2026 · release notes

    Plerion adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS Foundations v7.0.0 and FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. KSI frameworks, updates compliance mappings

    • Adds CIS Amazon Web Services Foundations Benchmark v7.0.0 framework with 70 recommendations mapped to detections, including six new AWS Organizations controls and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint checks.
    • Adds FedRAMP 20x Key Security Indicators framework covering 46 indicators across AWS, Azure, GCP, and Kubernetes for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. 20x certification path.
    • Updates compliance frameworks to PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0.1, NIST SP 800-53 Rev 5 Release 5.2.0, CSA CAIQ v4.1, UK NCSC CAF 4.0, and FedRAMP Rev 5 CR26 baselines with rebuilt control-to-detection mappings.
    • Adds Kubernetes checks to 29 frameworks alongside existing AWS, Azure, and GCP support.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Retires PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS 4.0, 3.2.1, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2013, FFIEC CAT, and CIS AWS Foundations Benchmark v4.0.1 frameworks.
    • !Posture percentages may shift due to rebuilt control-to-detection mappings.
61. Pleri now raises pull requests in Azure DevOps: seen Aug 11, 2026 · issue 042

    Pleri can now open, review, and abandon pull requests in Azure DevOps repositories to remediate IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. issues.

    • Pleri can check pull request status, request a review, or abandon a pull request with a reason inside Azure DevOps.

    1 detail in Everything

62. GCP AI coverage widens further: seen Aug 8, 2026 · issue 039

    Plerion adds 46 new GCP AI posture checks across Vertex AI, Model Armor, Dialogflow CX, Cloud TPU, and more.

    • Adds 46 new posture checks spanning Vertex AI, Vertex AI Workbench, Colab Enterprise, Agent Engine, Vertex AI Search, Gemini Enterprise, Model Armor, Dialogflow CX, Cloud TPU, and Gemini Code Assist.
    • Adds project-level org-policy guardrails covering Vertex AI Workbench access and Model Garden model use.
    • Extends asset discovery to 16 new GCP resource types behind the newly supported AI services.

    3 details in Everything

63. GCP AI coverage widens further: Aug 7, 2026 · release notes

    Plerion adds 46 new posture checks and asset discovery for Vertex AI, Colab Enterprise, and Agent Engine on GCP.

    • Adds 46 new posture checks covering Vertex AI, Vertex AI Workbench, Colab Enterprise, Agent Engine, Vertex AI Search, Gemini Enterprise, Model Armor, Dialogflow CX, Cloud TPU, and Gemini Code Assist to expand GCP AI security coverage.
    • Introduces project-level org-policy guardrails for Vertex AI Workbench access and Model Garden model use to enforce organizational policies at the project boundary.

    2 details in Everything

64. 2026-08-07 Aug 7, 2026 · release notes

    Plerion adds 46 new posture checks for Vertex AI, Gemini Enterprise and related GCP services.

    • Adds coverage for 46 new posture checks across Vertex AI, Vertex AI Workbench, Colab Enterprise, Agent Engine, Vertex AI Search, Gemini Enterprise, Model Armor, Dialogflow CX, Cloud TPU, and Gemini Code Assist
    • Adds project-level org-policy guardrails for Vertex AI Workbench access and Model Garden model use
    • Expands asset discovery to 16 new GCP resource types behind the newly covered services

    3 details in Everything

65. Connect your entire GCP organization at once: seen Aug 4, 2026 · issue 035

    Plerion adds GCP organization-wide onboarding via a single generated command with keyless Workload Identity Federation.

    • Onboards an entire Google Cloud organization from a single generated command using keyless access via Workload Identity Federation — no service account keys required.
    • Provides an equivalent Terraform template for organizations preferring infrastructure-as-code onboarding.
    • Automatically discovers every project in the organization, including projects created after initial onboarding, with the option to include all automatically or select individually.
    • Scans organization-level resources including organization details, organization-level IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy, folders, organization policies, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Service Controls service perimeters.
    • Revoke all Plerion access to the GCP organization by deleting a single resource.

    5 details in Everything

66. Onboard AWS accounts with Terraform: seen Aug 4, 2026 · issue 035

    Plerion adds native Terraform onboarding for AWS and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue./secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. for Kubernetes workloads.

    • New Terraform template provisions the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role and policies as native Terraform resources and registers the AWS integration automatically — no CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack, no manual console step — with a choice of running workload scanning inside your own account or through a Plerion-managed service account.
    • Workload scanning now builds a software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) for every container image across Kubernetes Deployments, DaemonSets, StatefulSets, Pods, Jobs, and CronJobs, surfaced on each asset's SBOM tab.
    • Secret scanning detects API keys, tokens, and passwords inside container images and reports them with severity on the asset's Sensitive data tab, so practitioners know what to rotate first.
    • Scan types (SBOM, secret scanning) can be selected at cluster-connect time or changed at any point from the integration's workload scan settings.

    4 details in Everything

67. 2026-08-04 Aug 4, 2026 · release notes

    Plerion adds Terraform provisioning and Kubernetes workload scanning with SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and secret detection.

    • Provisions Plerion integration and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. resources via a new Terraform template, eliminating manual console steps
    • Builds Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) for container images in Kubernetes Deployments, DaemonSets, StatefulSets, Pods, Jobs, and CronJobs
    • Reports secrets like API keys, tokens, and passwords in container images on the asset’s Sensitive data tab with severity ratings
    • Allows configuring scan types (SBOM and secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.) during cluster connection or via integration workload scan settings

    4 details in Everything

68. CIS benchmark coverage for Google Cloud: seen Aug 3, 2026 · issue 034

    Plerion adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Cloud Platform Foundation Benchmark v5.0.0 mapping for Google Cloud posture tracking.

69. Connect your entire GCP organization at once: Aug 3, 2026 · release notes

    Plerion adds keyless GCP organization onboarding via generated script, Terraform template, and org-level scanning.

    • Adds a single command-line onboarding script that discovers the GCP organization, creates a Plerion service project, and configures Workload Identity Federation for keyless access.
    • Adds an equivalent Terraform template to automate the same keyless organization onboarding infrastructure as code.
    • Extends scanning coverage to include the GCP organization resource itself (organization details, folder structure, org-level IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy, organization policies, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Service Controls service perimeters).

    3 details in Everything

70. 2026-08-03 Aug 3, 2026 · release notes

    Plerion 2026-08-03 adds keyless GCP organization onboarding via Workload Identity Federation and org-level scanning for folders, org policies, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Service Controls.

    • Adds a single-generated command to onboard an entire Google Cloud organization using Workload Identity Federation without service account keys
    • Adds support for Terraform-based infrastructure-as-code onboarding of GCP organizations equivalent to the generated script
    • Enables scanning of organization-level resources including folders, organization policies, and VPC Service Controls service perimeters

    3 details in Everything

71. 2026-08-02 Aug 2, 2026 · release notes

    Plerion adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Cloud Platform Foundation Benchmark v5.0.0 mapping via compliance settings.

72. A Well-Architected lens for Google Cloud: Jul 19, 2026 · release notes

    New Google Cloud Well-Architected lens maps posture to the six pillars using existing findings.

    • Adds a new Well-Architected assessment lens for Google Cloud that evaluates workloads across operational excellence, security, reliability, cost optimization, performance, and sustainability.

    1 detail in Everything

73. 2026-07-19 Jul 19, 2026 · release notes

    Adds Google Cloud Well-Architected Framework lens to map posture against six pillars

74. GCP coverage leaps forward, now with AI Security Posture Management: Jul 18, 2026 · release notes

    Plerion GCP release adds AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. with 38 new posture checks, live endpoint verification for high-risk exposures, and support for Vertex AI, Model Armor, Document AI, AlloyDB,

    • Adds 38 new posture checks across GCP resources including Vertex AI, Model Armor, Document AI, AlloyDB, Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., Spanner, Cloud Functions, Cloud Composer, Filestore, Datastream, Dataflow, Cloud Workstations, Secret Manager, Cloud TPU, and Batch.
    • Promotes 3 existing posture checks to continuous runtime scanning instead of static configuration assessment.
    • Enables active live endpoint verification for high-risk exposures (public GKE control plane, public AlloyDB instance, anonymously invocable Cloud Run service) to confirm internet reachability before generating findings.

    3 details in Everything

75. 2026-07-18 Jul 18, 2026 · release notes

    Plerion 2026-07-18 adds AI Security Posture Management with 32 new GCP resource types and 38 posture checks

    • Adds discovery and assessment of 32 new GCP resource types including Vertex AI, Model Armor, and Document AI
    • Adds 38 new posture checks for GCP coverage extending to AlloyDB, Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., Spanner, Cloud Functions, Cloud Composer, Filestore, Datastream, Dataflow, Cloud Workstations, Secret Manager, Cloud TPU, and Batch
    • Promotes 3 existing posture checks to continuous runtime scanning

    3 details in Everything

76. Secure your AI agents on Amazon Bedrock AgentCore: Jul 13, 2026 · release notes

    Plerion adds inventory and detections for Amazon Bedrock AgentCore agents to catch insecure configurations.

    • Adds full inventory of AgentCore estate including gateways, runtimes, memory, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and tools
    • Introduces new detections for public invoke access, weak authorizers, non-enforcing policies, and insecure endpoints

    2 details in Everything

77. 2026-07-13 Jul 13, 2026 · release notes

    Plerion adds Amazon Bedrock AgentCore inventory and detection checks for agents and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools

    • Adds bedrock-agentcore integration to inventory gateways, runtimes, memory, and MCP servers/tools connected via Amazon Bedrock AgentCore
    • Adds new detections for public invoke access, weak authorizers, non-enforcing policies, and insecure endpoints in the Bedrock AgentCore estate

    2 details in Everything

78. Know which findings are running out of time: Jul 3, 2026 · release notes

    Plerion adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. status and filtering for findings to track resolution deadlines

    • Failed findings now display SLA status (within SLA, nearing breach, or breached) with time remaining until resolution deadline
    • Users can filter the findings dashboard by SLA status to prioritize findings closest to breaching

    2 details in Everything

79. 2026-07-03 Jul 3, 2026 · release notes

    Plerion adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. status tracking and dashboard filtering for failed findings

    • SLA status field added to failed findings showing within SLA, nearing breach, or breached states
    • Findings dashboard gains Filter by SLA status capability to isolate items closest to breaching

    2 details in Everything

80. Refreshed MITRE ATT&CK Cloud coverage: Jul 1, 2026 · release notes

    Plerion updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Cloud Matrix to v19.1

81. A new MITRE threat matrix: Jun 27, 2026 · release notes

    Plerion adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Containers Matrix to threat mapping

82. 2026-06-27 Jun 27, 2026 · release notes

    Plerion 2026-06-27 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Containers Matrix threat mapping.

83. 2026-06-26 Jun 26, 2026 · release notes

    Plerion adds AWS Well-Architected Financial Services Lens to map posture against industry best practices.

84. 2026-06-22 Jun 22, 2026 · release notes

    Plerion 2026-06-22 adds new ISMS-P compliance mapping capability

    • New ISMS-P option in compliance settings to map posture controls

    1 detail in Everything

85. 2026-06-19 Jun 19, 2026 · release notes

    Adds AWS Well-Architected reviews for Generative AI and Machine Learning workloads in Plerion.

    • Supports the AWS Well-Architected Generative AI Lens
    • Supports the AWS Well-Architected Machine Learning Lens

    2 details in Everything

86. Well-Architected reviews for your AI and ML workloads: Jun 19, 2026 · release notes

    Plerion adds Well-Architected reviews for Generative AI and Machine Learning lenses using existing Plerion findings

    • Adds support for the AWS Well-Architected Generative AI Lens to review generative-AI workloads
    • Adds support for the AWS Well-Architected Machine Learning Lens to review machine-learning workloads
    • Pmaps existing Plerion findings to answer questions in the new Well-Architected reviews

    3 details in Everything

87. CWPP scanning, fully managed by Plerion: Jun 18, 2026 · release notes

    Plerion adds fully managed CWPP scanning with host appliances across all supported regions

    • Adds CWPP scanning as a fully managed service option that removes the need for customer-hosted scanning infrastructure.
    • Enables onboarding of AWS accounts via a single selection step, after which Plerion hosts the scanning appliances in its own accounts.

    2 details in Everything

88. 2026-06-18 Jun 18, 2026 · release notes

    Plerion adds fully managed CWPP scanning where Plerion hosts infrastructure and scans across supported regions

    • Adds CWPP scanning mode that hosts appliances in Plerion accounts to allow scanning without running infrastructure in the customer's account

    1 detail in Everything

89. Refreshed LGPD compliance coverage: Jun 16, 2026 · release notes

    Plerion adds Kubernetes checks to LGPD compliance coverage alongside AWS, Azure, GCP

    • Expands LGPD coverage from two to nine data-protection articles

    1 detail in Everything

90. 2026-06-16 Jun 16, 2026 · release notes

    Plerion expands LGPD compliance coverage to nine articles with Kubernetes, AWS, Azure, and GCP checks

    • Broadens LGPD compliance coverage from two to nine data-protection articles
    • Adds Kubernetes checks alongside existing AWS, Azure, and GCP for LGPD posture

    2 details in Everything

91. Measure your AI systems against four security frameworks: Jun 14, 2026 · release notes

    Plerion adds four new security framework mappings: ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001, NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold. 1.0, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. (2025), and OWASP Top 10 for Agentic Apps (2026).

    • Maps cloud and code posture to ISO/IEC 42001 via compliance settings.
    • Maps cloud and code posture to NIST AI Risk Management Framework (NIST AI RMF 1.0) via compliance settings.
    • Maps cloud and code posture to OWASP Top 10 for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Applications (2025) via compliance settings.
    • Maps cloud and code posture to OWASP Top 10 for Agentic Applications (2026) via compliance settings.

    4 details in Everything

92. 2026-06-14 Jun 14, 2026 · release notes

    Plerion adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001, NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold., and OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code./Agentic Top 10 compliance mapping

    • Adds compliance mapping to ISO/IEC 42001 for cloud and code posture tracking
    • Adds compliance mapping to NIST AI Risk Management Framework (NIST AI RMF 1.0) for AI system measurement
    • Adds compliance mapping to OWASP Top 10 for LLM Applications (2025)
    • Adds compliance mapping to OWASP Top 10 for Agentic Applications (2026)

    4 details in Everything

93. Trace any cloud asset back to the code that created it: Jun 3, 2026 · release notes

    Plerion adds bidirectional GitHub-AWS code-to-cloud linking and Pleri remediation context

    • On any asset detail page, view the responsible GitHub repository with a direct link to trace cloud assets back to their source code
    • In Code Security, open any repository and use the new Assets tab to see every AWS asset it manages

    2 details in Everything

94. 2026-06-03 Jun 3, 2026 · release notes

    Plerion 2026-06-03 adds Code-to-Cloud visibility linking AWS assets to source repositories

    • Adds bidirectional linking between AWS assets and GitHub repositories via the Assets tab in Code Security
    • Enables Pleri remediation suggestions to factor in linked repository context for findings
    • Supports CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., CDK, and Terraform infrastructure-as-code formats by default for all GitHub integrations

    3 details in Everything

95. Exempted findings now stay out of your dashboard counts: May 4, 2026 · release notes

    Dashboard metrics now exclude exempted findings across public assets, vulnerabilities, and privileges

96. 2026-05-04 May 4, 2026 · release notes

    Dashboard cards now respect exemptions to show only actionable findings.

    • Dashboard cards and slide-over panels now exclude exempted assets for public assets, critical/exploited vulnerabilities, overly permissive privileges, admin privileges, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and failed findings.

    1 detail in Everything

97. Spot privilege escalation in your IAM policies: Apr 29, 2026 · release notes

    New PLERION-AWS-1013 check detects privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. techniques in IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies with detailed context and highlighting.

    • Adds PLERION-AWS-1013 check to identify IAM roles, users, groups, and managed policies allowing privilege escalation actions.
    • Provides contextual view breaking down escalation technique, escalated permissions, and required vs. helpful actions for the attack.
    • Displays a new policy tab that highlights offending lines within each policy.

    3 details in Everything

98. Let there be (less) light ☀️🌙: Mar 26, 2026 · release notes

    Plerion adds Dark/Light mode toggle in profile menu

99. 2026-03-05 Mar 5, 2026 · release notes

    Plerion adds 86 new AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. checks for Amazon SageMaker and Bedrock covering encryption, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., network exposure, and runtime config.

    • Adds 86 new AI-SPM checks for Amazon SageMaker and Bedrock assets including encryption status, IAM privileges (admin/overly permissive), VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. egress bypass detection, root access enablement, data capture status, and privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths.

    1 detail in Everything

100. CloudFormation updates, minus the manual effort: Mar 3, 2026 · release notes

     Plerion introduces Auto stack update with changelog review, version skipping, and cryptographic verification

     • Adds Auto stack update capability for controlled rollouts of Plerion stacks
     • Allows reviewing changelogs before applying updates
     • Enables skipping specific versions during the auto-update process
     • Implements cryptographic verification for update integrity
     • Uses isolated execution environments for safe deployment

     5 details in Everything

101. 2026-03-03 Mar 3, 2026 · release notes

     Adds Auto stack update with changelog review and cryptographic verification to Plerion

102. Meet your new workload scanning metronome: Dec 11, 2025 · release notes

     Plerion introduces a new scheduling interface for workload scanning, letting users choose between daily, recommended, or custom intervals to better control coverage cadence.

103. Go global with the new global filter: Nov 28, 2025 · release notes

     Platform-wide context setting via new top-level filter controls.

     • Adds global filters for environment, asset group, and integration.

     1 detail in Everything

104. Attack paths for Azure environments Oct 8, 2025 · release notes

     Plerion adds attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis for Azure environments

     └──▷ HOW TO FIND IT
     Explore how risks link across your Azure environment to identify where to focus fixes.
     📍View the attack paths in action
     • Enables exploration of risk links across Azure environments via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.

     1 detail in Everything

105. 2025-10-08 Oct 8, 2025 · release notes

     Plerion 2025-10-08 adds attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visualization for Azure environments.

     • Enables exploration of risk links across Azure infrastructure via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

     1 detail in Everything