https://cybertoolchain.io/tools/runzero New releases and features in runZero, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 00:00:00 GMT https://help.runzero.com/docs/release-notes/#512611030 https://help.runzero.com/docs/release-notes/#512611030 Tue, 03 Nov 2026 00:00:00 GMT runZero now collects more attributes over the BACnet protocol⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • runZero now collects more attributes from BACnet protocol devices during scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Thu, 29 Oct 2026 07:54:58 GMT runZero adds LonTalk protocol support and now lets operators cap AI tool-call limits per turn via environment variables and the API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Configure AI tool-call limits per turn for self-hosted deployments via the `RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN` and `RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN` environment variables (defaults: 8 and 20), and set per-account or per-organization limits through the AI configuration pages or the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • runZero now supports the LonTalk protocol for asset discovery. • Improves the `search` operator across the asset, service, software, and vulnerability inventories: it is now case-insensitive, exact-match searches like `domain:=corp.example.com` now find assets that have that domain among others, and `product:=` and `domain:=` now match assets with no products or no domains. • Alert channel searches using `settings:`, `notification_count:`, and `user_email:` now work; `settings:` matches a channel's email recipients and `notification_count:` accepts numeric comparisons such as `notification_count:>5`. • Improves search in scan templates and external reports to support `AND`, `OR`, and `NOT` operators; in scan templates a plain word searches template names and descriptions, and an unsupported keyword is reported as an error. • Tag editing is now available directly in the asset details card on the Vulnerability details page. • The `GET /api/v1.0/account/sites`, `GET /api/v1.0/account/orgs`, and `GET /api/v1.0/account/credentials` APIs now return a 422 error naming the problem when a search cannot be parsed, rather than returning every record. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610290 https://help.runzero.com/docs/release-notes/#512610290 Thu, 29 Oct 2026 00:00:00 GMT runZero adds `has_owner` search support to the vulnerability inventory and avoids probing Allen-Bradley/Rockwell 1785-ENET devices⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Search the vulnerability inventory by asset owner using the new `has_owner` search term.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Vulnerability checks now account for eMudhra compromised certificate use. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610271 https://help.runzero.com/docs/release-notes/#512610271 Tue, 27 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610220 https://help.runzero.com/docs/release-notes/#512610220 Thu, 22 Oct 2026 00:00:00 GMT runZero 5.1.261022.0 expands search operators across inventories and adds `notification_count:` numeric comparisons for alert channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Alert channel searches now support `notification_count:` with numeric comparisons such as `notification_count:>5`, and `settings:` now matches a channel's email recipients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Scan template searches now support `AND`, `OR`, and `NOT` operators; a plain word searches template names and descriptions, and an unsupported keyword is reported as an error. • External report searches now support `AND`, `OR`, and `NOT` operators. • The `domain:` search is now case-insensitive in the asset, service, software, and vulnerability inventories, and an exact match such as `domain:=corp.example.com` finds assets that have that domain among others. • The searches `product:=` and `domain:=` now match assets with no products or no domains in the asset, service, software, and vulnerability inventories. • Certificate search `ocsp_stapling:false` now matches certificates served over HTTPS without OCSP stapling, equivalent to `has_ocsp_stapling:false`. • Asset details card on the Vulnerability details page now offers inline tag editing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Tue, 20 Oct 2026 07:54:52 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610200 https://help.runzero.com/docs/release-notes/#512610200 Tue, 20 Oct 2026 00:00:00 GMT runZero 5.1.261020.0 adds LonTalk protocol support and makes AI tool-call limits configurable via env vars and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN` and `RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN` environment variables for self-hosted operators to set platform-wide AI tool-call limits (defaults: 8 and 20).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes AI tool-call limits for accounts and organizations using their own AI provider via the AI configuration pages and through the API. • Adds LonTalk protocol support for asset discovery. • Expands self-hosted console environment variable documentation to cover AI provider, MCP session, access control, screenshot, and TLS trust settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610130 https://help.runzero.com/docs/release-notes/#512610130 Tue, 13 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512610090 https://help.runzero.com/docs/release-notes/#512610090 Fri, 09 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Mon, 05 Oct 2026 07:55:48 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Sun, 04 Oct 2026 07:49:18 GMT runZero adds asset merge history view to the Manage menu on the asset details screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the ability to view merge history for an asset from the 'Manage' menu on the asset details screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512609290 https://help.runzero.com/docs/release-notes/#512609290 Tue, 29 Sep 2026 00:00:00 GMT runZero 5.1.260929.0 adds merge history view for assets via the 'Manage' menu.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds merge history view for an asset via the 'Manage' menu on the asset details screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Sat, 26 Sep 2026 12:45:33 GMT runZero: Software and Vulnerabilities collected from integrations are now retired when that integration data expires. • Issue owners now receive an email with a direct link when assigned an Issue. • AWS, Azure, and GCP imports now include additional asset types. • runZero optimized MAC merging so large scan jobs now process faster. • runZero now processes directory and device data concurrently, improving task performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Fri, 25 Sep 2026 13:13:04 GMT runZero adds OCSF 1.9.0 and CycloneDX CBOM exports, API vulnerability suppression, OAuth for MCP, and custom-role API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `OCSF 1.9.0` export to the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events via the inventory export menu and the Export API; unmapped fields appear under the event's `unmapped` object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Cryptographic Bill of Materials (`CBOM`) export in CycloneDX JSON format along with a detailed report. • Adds API support for suppressing and unsuppressing vulnerabilities, vulnerability groups, and findings. • Adds OAuth support to the MCP service, including using Export Tokens and Organization Keys as OAuth Client Secrets in addition to API Clients. • Enables assigning custom roles to API keys, default user roles, group permissions, SSO defaults, and MCP connections. • Allows users to create API clients with custom permissions capped by their own access rights; account-level API clients now support granular authentication scopes in addition to roles. • Adds a configuration option on the scan page to toggle the promiscuous ARP probe. • Adds Mermaid-based charting and diagram support to the AI Threads feature. • Allows scripts to run in console instances in addition to Explorers and the CLI. • Allows authoring and testing of custom integration scripts in-product using an AI model of choice. • Scripts now support settings shared across protocols such as HTTP and TLS. • Users can now submit scripts for inclusion as native runZero sources. • Adds the Annotator role to the list of default roles selectable in SSO settings. • Adds the 'Dashboards' column to the query library, showing how many personal dashboards use a saved query and whether it is also used on other dashboards. • Allows users to reprocess tasks directly from the user interface. • Allows users to close an Issue from the Issue Details page. • Users can now share standard reports through the External Reporting feature. • Users can now sort Findings by name. • Task summaries now indicate when a task involved more than 1,000 asset changes. • WS-Discovery XAddr endpoints now contribute to asset hostnames. • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities. • runZero now labels AI Threads and AI Artifacts as AI-generated following EU guidance, embedding the label in exported reports, downloaded files, and generated custom-integration scripts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Thu, 24 Sep 2026 07:52:00 GMT runZero: Custom integration script library now covers more than 100 products, available in the console with individual scripts modifiable or usable as templates. • Custom roles granting 'Saved queries' read can now view the Queries page and table without inventory access; roles granting write or manage can create, edit, copy, import, and delete saved queries. • Scripts are now available to all administrators, even those with narrow access scopes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Wed, 23 Sep 2026 13:12:54 GMT runZero: Custom roles granting 'Saved queries' read can now view the Queries page and table without inventory access; write or manage roles can create, edit, copy, import, and delete saved queries. • Software and Vulnerabilities collected from integrations are now retired when that integration data expires. • runZero now populates MAC vendor information for legacy MAC prefixes. • AWS, Azure, and GCP imports now include additional asset types. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Tue, 22 Sep 2026 07:44:48 GMT runZero adds vulnerability suppression API, OCSF 1.9.0 export, CBOM CycloneDX JSON, OAuth for MCP, and custom API key roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds vulnerability suppression and unsuppression via the runZero API, covering vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an OCSF 1.9.0 export from the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, available from the inventory export menu and the Export API; fields without an OCSF equivalent are preserved under the event's `unmapped` object. • Adds a Cryptographic Bill of Materials (CBOM) as a new CycloneDX JSON export and detailed report. • Adds OAuth support to the MCP service, including the ability to use Export Tokens and Organization Keys as OAuth Client Secrets, in addition to API Clients. • Supports assigning custom roles to API keys, default user roles, group permissions, SSO defaults, and MCP connections. • Enables creating API clients with custom permissions capped by the creating user's own access rights; account-level API clients can now use granular authentication scopes in addition to roles. • Adds a configuration option on the scan page to toggle the promiscuous ARP probe. • Adds Mermaid-based charting and diagram support to the AI Threads feature. • Enables running custom integration scripts on console instances in addition to Explorers and the CLI. • Adds an in-product script authoring and testing environment using the AI model of your choice. • Scripts now support settings shared across protocols like HTTP and TLS. • Allows users to submit scripts for inclusion as native runZero sources. • The reports page now displays a paginated, searchable list of all analysis task-based reports with delete support. • Adds a 'Dashboards' column to the query library showing how many personal dashboards use a saved query and whether it appears on other dashboards. • The list of default roles selectable in SSO settings now includes the Annotator role. • WS-Discovery XAddr endpoints now contribute to asset hostnames. • Adds the ability to sort Findings by name. • Adds the ability to close an Issue directly from the Issue Details page. • Users can now reprocess tasks directly from the user interface. • Users can now share standard reports through the External Reporting feature. • Task summaries now indicate when a task involved more than 1,000 asset changes. • Issue owners now receive an email with a direct link when assigned an Issue. • runZero now labels AI Threads and AI Artifacts as AI-generated, embedding the label in exported reports, downloaded files, and generated custom-integration scripts. • Users can now re-invite an external user who already has access to the account. • runZero optimized MAC merging so large scan jobs now process faster. • runZero now processes directory and device data concurrently, improving task performance. • Vulnerability exports now run faster. • Background MCP connections no longer count against API usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512609150 https://help.runzero.com/docs/release-notes/#512609150 Tue, 15 Sep 2026 00:00:00 GMT runZero API gains endpoints to suppress and unsuppress vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds API endpoints to suppress and unsuppress vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Mon, 14 Sep 2026 07:43:18 GMT runZero: Makes MCP connections compatible with Claude Desktop and similar tools, with background MCP connections no longer counting against API usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Sun, 13 Sep 2026 07:42:22 GMT runZero adds custom roles for API keys and MCP connections, sub-asset visibility, and direct task reprocessing from the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables account-level API clients to use granular authentication scopes in addition to roles, capped by the creator's own access rights. • Supports reprocessing tasks directly from the user interface. Breaking changes: • Hostname discovery no longer falls back to NetBIOS domains — assets that previously resolved hostnames via NetBIOS domain fallback will no longer do so. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Sat, 12 Sep 2026 07:43:07 GMT runZero adds custom roles for API keys and MCP connections, reprocessing tasks from the UI, and SAML certificate expiry warnings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Allows custom roles to be assigned to API keys, default user roles, group permissions, SSO defaults, and MCP connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients. • Tasks can now be reprocessed directly from the user interface. • Account administrators now receive email warnings before SAML certificates expire. • Recent assets now include sub-assets identified through protocol gateways. • WS-Discovery XAddr endpoints now contribute to asset hostnames. • MAC vendor information is now populated for legacy MAC prefixes. • AWS, Azure, and GCP cloud imports now include additional asset types. • Dragos and Wiz imports now apply more complete fingerprinting and OS CPE matching when available. • Task summaries now clearly indicate when a task involved more than 1,000 asset changes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Fri, 11 Sep 2026 10:38:50 GMT runZero: Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients. • Sub-assets identified through protocol gateways now appear in Recent Assets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Thu, 10 Sep 2026 07:40:40 GMT runZero: Enables account-level API clients to use granular authentication scopes in addition to roles, with permissions capped by the creating user's own access rights. • Background MCP connections no longer count against API usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512609080 https://help.runzero.com/docs/release-notes/#512609080 Tue, 08 Sep 2026 00:00:00 GMT runZero 5.1 adds custom roles for API keys and MCP connections, granular auth scopes for account-level API clients, and UI-driven task reprocessing. • Enables custom roles to be assigned to API keys, default user roles, group permissions, SSO defaults, and MCP connections. • Allows account-level API clients to use granular authentication scopes in addition to roles. • Lets users create API clients with custom permissions capped by their own access rights. • Background MCP connections no longer count against API usage, and the MCP experience works with Claude Desktop and similar tools. • Tasks can now be reprocessed directly from the user interface. • Account administrators now receive email warnings before SAML certificates expire. • Recent assets now include sub-assets identified through protocol gateways. • Task summaries now clearly indicate when a task involved more than 1,000 asset changes. • WS-Discovery XAddr endpoints now contribute to asset hostnames. • MAC vendor information is now populated for legacy MAC prefixes. • AWS, Azure, and GCP imports include additional asset types. • Dragos and Wiz imports now apply more complete fingerprinting and OS CPE matching when available. Breaking changes: • Hostname discovery no longer falls back to NetBIOS domains — assets whose hostnames were previously derived from NetBIOS domains will have those hostnames removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Wed, 02 Sep 2026 07:36:20 GMT runZero adds MCP OAuth, CBOM CycloneDX export, WMI scripting, Mermaid charting, and Issue lifecycle alert conditions • Alert rules now support conditions for Issue lifecycle events, enabling automated responses to Issue state changes. • Large scan jobs process faster after optimization for MAC merging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Tue, 01 Sep 2026 15:14:21 GMT runZero 5.1.260826.0 adds MCP OAuth, CBOM Cyclone JSON export, Censys v3, and a 100+ script custom integration library • The MCP service now supports OAuth, including `Export Token` and `Organization Key` as OAuth Client Secrets, in addition to API Clients. • The Cryptographic Bill of Materials (CBOM) is now exportable as a Cyclone JSON format and detailed report. • The Censys integration now supports the Censys Platform v3 API. • Custom Integration scripts now support WMI (WinRM, SMB, DCERPC) for deep Windows host collection. • Custom Integration scripts now support custom application protocols over TCP, UDP, and Unix streams. • Custom Integration scripts now support shared common settings for protocols like HTTP and TLS. • Custom Integration scripts can now define detailed credential fields and validation rules. • Custom Integration scripts now track a maturity mode (alpha, beta, stable) for filtering. • Scripts can now be run in console instances in addition to Explorers and the CLI. • Scripts can be authored and tested in-product using an AI model of choice. • The community custom integration script library now covers more than 100 products and is accessible directly in the console. • The AI Threads feature now supports charting and diagrams via Mermaid. • The AI Artifacts feature now supports full-page viewing. • AI-generated content (threads, artifacts, exported reports, downloaded files, and custom integration scripts) is now labelled as AI-generated, following EU guidance. • The MCP service and in-product AI Threads now share the same tools. • Scripts are now available to all administrators, even those with narrow access scopes. • Scripts can be submitted for inclusion as native runZero sources. • The `Annotator` role has been added to the list of default roles selectable in SSO settings. • Dashboard query library now shows how many personal dashboards each saved query is used on, and whether it is used on other dashboards, in a `Dashboards` column. • A configuration option has been added to the scan page to toggle the promiscuous ARP probe. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512609010 https://help.runzero.com/docs/release-notes/#512609010 Tue, 01 Sep 2026 00:00:00 GMT runZero 5.1 adds External Reporting sharing for standard reports, alert rules for Issue lifecycle events, and `comment:` search in Issues inventory. • Adds `comment:` keyword for searching Issue comments in the Issues inventory. • Alert rules now support conditions based on Issue lifecycle events. • Standard reports can now be shared via the External Reporting feature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Tue, 25 Aug 2026 13:21:59 GMT runZero adds OCSF 1.9.0 asset inventory export as Device Inventory Info and Live Evidence Info events • Adds OCSF 1.9.0 export for the asset inventory, producing `assets.ocsf.jsonl` and `assets.ocsf.json` files from the inventory export menu and the Export API; assets export as Device Inventory Info events, observed services as Live Evidence Info events, with unmapped fields preserved under the event's `unmapped` object. • Organization overview report now shows total asset counts in the sites summary, consistent with the sites table in the runZero Console. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512608250 https://help.runzero.com/docs/release-notes/#512608250 Tue, 25 Aug 2026 00:00:00 GMT runZero 5.1.260825.0 adds a toggle for the promiscuous ARP probe on the scan configuration page. • Adds a configuration option on the scan page to toggle the promiscuous ARP probe on or off. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Tue, 18 Aug 2026 09:05:54 GMT runZero adds AWS Inspector findings for EC2/Lambda, broader IPMI vulnerability detection, and improved geolocation and reporting. • The AWS integration now supports AWS Inspector findings for EC2 and Lambda assets. • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities. • The scanner now detects a broader range of IPMI vulnerabilities. • Asset geolocation now uses location data from additional integration-sourced attributes. • Connector tasks now honor the configured attribute and vulnerability expiration thresholds during import. • The `Refingerprint` asset action now also re-evaluates service fingerprints for improved accuracy. • Custom integrations can now continue processing results even if a single device causes errors. • Directory and device data are now processed concurrently, improving task performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512608181 https://help.runzero.com/docs/release-notes/#512608181 Tue, 18 Aug 2026 00:00:00 GMT runZero 5.1 adds OCSF 1.9.0 export for asset inventory, surfacing assets and services as standardized events. • Adds OCSF 1.9.0 export for the asset inventory, producing `assets.ocsf.jsonl` and `assets.ocsf.json` files downloadable from the inventory export menu and the Export API. • Exports assets as Device Inventory Info events and their observed services as Live Evidence Info events under the OCSF schema. • Preserves fields without an OCSF equivalent under the event's `unmapped` object, ensuring no asset data is silently dropped on export. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512608141 https://help.runzero.com/docs/release-notes/#512608141 Fri, 14 Aug 2026 00:00:00 GMT runZero 5.1 expands IPMI vulnerability detection, improves asset geolocation, and re-evaluates service fingerprints via the Refingerprint action. • The `Refingerprint` asset action now also re-evaluates service fingerprints for improved accuracy. • Asset geolocation now uses location data from additional integration-sourced attributes. • The scanner detects a broader range of IPMI vulnerabilities. • Directory and device data are now processed concurrently, improving task performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512608130 https://help.runzero.com/docs/release-notes/#512608130 Thu, 13 Aug 2026 00:00:00 GMT runZero 5.1 adds AWS Inspector findings for EC2 and Lambda, plus a searchable paginated reports page. • Adds AWS Inspector findings support for EC2 and Lambda assets via the AWS integration. • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities. • The AWS integration now skips linked organizational accounts that are closed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/ https://help.runzero.com/docs/release-notes/ Sun, 02 Aug 2026 10:19:06 GMT runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, Git Smart Protocol scanning, Jira owner sync, and Purdue-level inventory search. • New site details page lets users with organization access view site details and subnet definitions. • Adds ability to sync issue owners with Jira. • Goals widget now includes a Pending metric showing baseline assets not matching the target query, with click-through to inventory. • Tanium integration now supports specifying multiple sensors. • Scanner now supports services using the Git Smart Protocol. • Software and vulnerability inventory now support `purdue_level` and `lowest_purdue_level` search terms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#512607312 https://help.runzero.com/docs/release-notes/#512607312 Fri, 31 Jul 2026 00:00:00 GMT runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, enhanced integration framework, ITSM remediation handoffs, and improved Dragos OT enrichment. • Adds compliance-friendly AI workflows for querying and surfacing asset data insights. • Introduces autonomous discovery mode for automated, continuous attack surface intelligence. • Enhanced integration framework with refined merge logic to accelerate custom integrations. • Streamlined remediation handoffs available directly inside runZero or via ITSM integration. • Improved Dragos integration enriches OT/ICS asset context and reduces data silos. • Connected AWS accounts now skip task processing for disabled AWS regions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502607281 https://help.runzero.com/docs/release-notes/#502607281 Wed, 29 Jul 2026 00:00:00 GMT runZero 5.0 adds Jira issue-owner sync, Git Smart Protocol scanning, Purdue-level search terms, and multi-sensor Tanium support. • New site details page lets organization-level users view site details and subnet definitions. • Adds ability to sync issue owners with Jira. • Goals widget now includes a Pending metric showing baseline assets that don't match the target query, with click-through to those assets in inventory. • Tanium integration now supports specifying multiple sensors. • Scanner now supports services using the Git Smart Protocol. • Software inventory adds support for `purdue_level` and `lowest_purdue_level` search terms. • Vulnerability inventory adds support for `purdue_level` and `lowest_purdue_level` search terms. • Active and passive data collection for the AMQP protocol now offers improved coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502607230 https://help.runzero.com/docs/release-notes/#502607230 Thu, 23 Jul 2026 00:00:00 GMT runZero 5.0.260723.0 adds Purdue level visibility for Dragos-enriched OT/ICS assets. • Displays Purdue Model levels for assets sourced or enriched from Dragos integration, enabling OT/ICS network segmentation visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502607140 https://help.runzero.com/docs/release-notes/#502607140 Tue, 14 Jul 2026 00:00:00 GMT runZero 5.0.260714.0 adds crown jewel status and Purdue level to the Dragos integration. • Adds crown jewel status and Purdue level fields to assets surfaced via the Dragos integration. • Vulnerability groups inventory now displays a meaningful error message when a search contains unsupported terms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502607070 https://help.runzero.com/docs/release-notes/#502607070 Tue, 07 Jul 2026 00:00:00 GMT runZero 5.0.260707.0 adds per-source stale threshold overrides and a software count drill-down link in asset inventory. • Supports per-integration stale threshold overrides for the stale integration attribute expiration feature, configurable in organization and account settings; integrations without an override continue to use the global setting. • Software count column in the asset inventory now links directly to the software inventory for faster drill-down. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502607020 https://help.runzero.com/docs/release-notes/#502607020 Thu, 02 Jul 2026 00:00:00 GMT Dragos integration gains serial-number-based asset matching with SentinelOne; suppressed vulnerabilities now count as Resolved in Issue status. • Dragos integration now matches assets with SentinelOne data using asset serial number (bidirectionally). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606300 https://help.runzero.com/docs/release-notes/#502606300 Tue, 30 Jun 2026 00:00:00 GMT runZero 5.0.260630.0 adds valueless tag search to asset inventory queries. • Supports searching for assets with a tag that has no value (e.g., `tag:test=`) to distinguish unvalued tags from valued ones like `tag:test=example`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606250 https://help.runzero.com/docs/release-notes/#502606250 Thu, 25 Jun 2026 00:00:00 GMT runZero 5.0.260625.0 adds AWS VPC Endpoint asset discovery and external issue sharing. • Adds AWS VPC Endpoint asset creation to the AWS integration, enabling visibility into VPC Endpoint resources. • Enables external sharing of issues directly from the issues datagrid. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606250---detect,-prioritize,-remediate,-verify,-report https://help.runzero.com/docs/release-notes/#502606250---detect,-prioritize,-remediate,-verify,-report Thu, 25 Jun 2026 00:00:00 GMT runZero 5.0 delivers end-to-end exposure management: remediation tracking, verified closure, recurring reports, and broader OT/IT vulnerability detection. • New Exposure Management dashboard as the default landing view, surfacing prioritized exposures with separation of OT/IoT streams, MTTR tracking, issue status totals, reopened-issue trends, vulnerability status trends by severity, and a Goals progress widget. • Adds Remediation Workflows: create a Remediation Issue in one click from an exposure, finding, or vulnerability group, with auto-populated fields and push-to-Jira integration including custom state-to-state mapping. • Enables verified remediation closure: runZero preserves a compressed snapshot of the original exposure state and compares it against live discovery on scheduled scans to confirm fixes, with automatic reopened-issue tracking. • Adds searchable, sortable Recurrences and Last Recurrence columns to the Issues inventory, and due-date alert rules that fire email or webhook notifications when a Remediation Issue exceeds a configured number of days past due. • Adds Recurring External Reporting: schedule weekly or monthly interactive HTML snapshot reports from supported dashboards and views, deliverable by email to recipients without a runZero account, with CSV, JSON Lines, JSON, and PNG export options. • New version-based vulnerability rollups match OS, hardware, and software versions against known advisories and report a consolidated 'Missing Patches for [Vendor] [Product]' finding per asset, aggregating all affected CVEs with KEV signal promotion to High severity. • Adds out-of-band blind vulnerability detection using runZero-hosted services in US and EU regions, requiring no customer-side infrastructure. • Adds end-of-life and end-of-support detection for common network devices (Cisco, Juniper, HPE/Aruba) derived from existing discovery fingerprints without additional scanning or credentials. • Exposes version-based reporting control per organization via the public Account API using the `vmatch_enabled` setting. • Expands fingerprint coverage by approximately 1,100 fingerprints (649 added, 469 updated) across enterprise IT, industrial/OT platforms (Siemens, Schneider Electric, Rockwell Automation), and consumer IoT devices since version 4.9. • Adds an explicit `archived` filter to vulnerability search, preserving vulnerabilities referenced by active issues from stale-vulnerability cleanup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606250 https://help.runzero.com/docs/release-notes/#502606250 Thu, 25 Jun 2026 00:00:00 GMT runZero v5.0.260625 adds VPC Endpoint asset creation, external issue sharing via the issues datagrid, and accurate multi-site finding counts. • AWS integration can now create assets for VPC Endpoints • Issues datagrid allows sharing issues externally • "Findings Overview" widget now accurately counts findings appearing in multiple sites • Rapid7 InsightVM Cloud task runs no longer exclude non-critical vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606250---detect%2C-prioritize%2C-remediate%2C-verify%2C-report https://help.runzero.com/docs/release-notes/#502606250---detect%2C-prioritize%2C-remediate%2C-verify%2C-report Thu, 25 Jun 2026 00:00:00 GMT runZero 5.0 adds Exposure Management dashboard, Jira integration via External Tickets, and version-based patch rollups • Adds `vmatch_enabled` Account API setting to control version-based reporting at the account level. • Integrates with Jira as an External Ticket destination for Remediation Issues, supporting custom state-to-state mapping. • Introduces `Missing Patches for [Vendor] [Product]` rollups that aggregate CVEs by asset OS/software versions (on by default). • Adds Out-of-band testing for blind vulnerability classes using runZero-hosted services in US and EU regions. • Expands End-of-life detection to include Cisco, Juniper, and HPE/Aruba network devices from discovery fingerprints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606220 https://help.runzero.com/docs/release-notes/#502606220 Mon, 22 Jun 2026 00:00:00 GMT runZero v5.0.260622 adds CVE recurrence tracking to Issues and MDE hostname sync via hyperv.host • Vulnerability recurrence tracking now works for the new Issues feature • The MDE integration can now set asset hostnames from the hyperv.host value Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606180 https://help.runzero.com/docs/release-notes/#502606180 Thu, 18 Jun 2026 00:00:00 GMT runZero 5.0.260618.0 adds all-asset alert queries, on-demand alert runs, expanded GE-SRTP ports, ADB STLS metadata, and richer InsightVM integration. • Adds option in alert rule queries to cover all assets, not just live assets. • Enables on-demand execution of alert rules without waiting for a scheduled run. • Expands scanner coverage to additional default ports for the GE-SRTP protocol. • Captures metadata from ADB STLS service responses during scanning. • Includes asset hostnames in the Rapid7 InsightVM Cloud Integration. • Improves asset correlation to disallow extensively reused IPs (e.g., from VPN systems) as match criteria. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606180 https://help.runzero.com/docs/release-notes/#502606180 Thu, 18 Jun 2026 00:00:00 GMT runZero 5.0.260618.0 adds on-demand alert execution and global asset coverage in alert queries. • Alert rule queries now have an option to cover all assets instead of just live assets • You can now run an alert rule on demand. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606170 https://help.runzero.com/docs/release-notes/#502606170 Wed, 17 Jun 2026 00:00:00 GMT runZero 5.0.260617.0 adds issue type and external ticket link columns to the Issues table. • Adds 'Type' and 'External Ticket Link' columns to the Issues table for quicker triage and cross-tool traceability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero https://help.runzero.com/docs/release-notes/#502606170 https://help.runzero.com/docs/release-notes/#502606170 Wed, 17 Jun 2026 00:00:00 GMT runZero 5.0.260617 adds Issue type and external ticket link to Issues table; fixes Users search. • The Issues table now displays the issue type and an external ticket link column. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runzero