https://cybertoolchain.io/tools/sysdig-secure New releases and features in Sysdig Secure, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 07:54:54 GMT https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Thu, 29 Oct 2026 07:54:54 GMT Sysdig Secure adds PHP standalone binary scanning and risk acceptance for non-package components across CLI Scanner, Registry Scanner, and Agentless Host Scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extend risk acceptance to every component type in CLI Scanner v1.31.0, so accepted risks now apply to vulnerabilities in standalone binaries and other components that are not packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Registry Scanner v0.13.0 now adds standalone binary scanning, identifying applications not installed by a package manager — including PHP compiled from source — so distroless and scratch images can surface new findings after upgrade. • Registry Scanner v0.13.0 adds license detection for packages in scanned images, available in Technical Preview, under `License Classification`. • Agentless Host Scanning now identifies PHP in standalone binary scanning, including PHP compiled from source such as the official Docker Hub `php` images, with no new deployment steps required. Breaking changes: • Registry Scanner v0.13.0 standalone binary scanning may surface new findings on images (distroless, scratch) that previously showed none — review results after upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Wed, 21 Oct 2026 07:51:56 GMT Sysdig Secure adds SIEM forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds SIEM forwarding rules to replace the `Data to Send` field, letting you attach one or more rules to each integration with a data type and optional filters — such as severity or policy name for Runtime Policy Events, or type for Activity Audit — so only matching data is forwarded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Rules` column to the integrations list showing the number of forwarding rules configured per integration. Breaking changes: • The `Data to Send` field in SIEM & Data Platforms integrations is replaced by forwarding rules; existing integrations relying on that field will need to be reconfigured with the new rules model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Mon, 05 Oct 2026 07:55:32 GMT Sysdig Secure: Adds a Supply Chain Findings page (Technical Preview) listing license and end-of-life findings across pipeline, registry, and runtime resources, with filtering by severity, stage, finding type, license category, or license name, and grouping by package, image, or runtime resource Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Sun, 04 Oct 2026 07:49:03 GMT Sysdig Secure adds Vulnerability Catalog, Supply Chain Findings (Preview), and AI-powered Threat Evaluation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an Evaluation column to the Threats page (requires Secure AI entitlement) ranging from 'Malicious' to 'Benign' with 'Suspicious' in between, sortable and filterable, plus a confidence level in the Threats Detail panel. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Thu, 17 Sep 2026 07:37:42 GMT Sysdig Secure: Risk acceptances scoped to an operating system or CPU architecture are now evaluated against the scanned asset's platform in the CLI Scanner. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Wed, 16 Sep 2026 07:42:13 GMT KSPM Analyzer v1.49.5 reduces node IOPS by excluding kubelet pod volume mounts from CIS Linux Benchmark filesystem scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves CIS Linux Benchmark filesystem scans in KSPM Analyzer v1.49.5 by excluding kubelet pod volume mounts, reducing IOPS on nodes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Sun, 16 Aug 2026 08:54:04 GMT Sysdig Secure adds image layer analysis, base image allow/deny list rules, and CNI plugin detection for CIS benchmark automation. • Adds a `Vulnerability Policies` tab to the Resource Details drawer in Vulnerability Findings, showing how each resource was evaluated against configured policies, with a details panel listing CVEs, components, or remediation guidance and inline exception creation. • Adds a `Layers` tab to the Resource Details drawer for container image resources, showing the image layer stack grouped by base image or `Application Layers`, with the Dockerfile instruction and per-severity vulnerability counts per layer. • Adds a `Layer` filter to the CVE list in Vulnerability Findings so practitioners can slice findings directly by image layer. • KSPM Analyzer v1.49.3 adds detection of Container Network Interface (CNI) plugins in use on each Kubernetes node, enabling automatic evaluation of CIS Kubernetes Benchmark v2.0.0 recommendation 5.3.1 without manual attestation. • Sysdig CLI Scanner v1.29.0 adds support for `Base Image Allow List` and `Base Image Deny List` image configuration rules, so vulnerability policies governing base images are now evaluated by the CLI Scanner. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/ Thu, 23 Jul 2026 16:01:01 GMT Sysdig Secure adds multi-bucket Custom Storage support and a redesigned Posture Overview & Findings experience. • Adds Custom Storage: connect multiple S3 or S3-compatible buckets (MinIO, Google Cloud Storage, etc.) for use across Captures, Response Actions, and Rapid Response — replacing the previous single shared S3 Capture Storage configuration. • Supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints for bucket authentication, with connection testing on save and per-bucket failure history. • Introduces a new Posture Overview page surfacing passing scores, 30-day trends, and hotspots across weakest categories, resources, and high-severity controls. • Introduces a new Posture Findings workspace with filtering, grouping, and remediation assignment to drive faster issue resolution. Breaking changes: • The previous single shared S3 Capture Storage configuration is replaced by the new Custom Storage system; existing Capture Storage settings will need to be reconfigured under Data Sources > Storage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-26-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-26-2026 Fri, 26 Jun 2026 00:00:00 GMT Sysdig Secure adds Azure Monitor Logs Ingestion API for Sentinel forwarding and refreshes Threats experience. • Supports the Azure Monitor Logs Ingestion API as a new authentication method for Microsoft Sentinel SIEM integration • Adds occurrence tabs to review previous or last threat occurrences from the same threat Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-9-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-9-2026 Tue, 09 Jun 2026 00:00:00 GMT Sysdig Secure adds EOL visibility in Vulnerability Management with Lifecycle column and Component Lifecycle rule type. • Adds a new Lifecycle column and filter in the Components tab of Sysdig Vulnerability Management to identify unsupported components alongside vulnerability data • Adds lifecycle metadata to CLI scanner JSON output and scan results API for pipeline integration • Adds a new Component Lifecycle rule type to Rule Bundles that can fail policy evaluations when a component is EOL or within 90 days of it Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-15-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-15-2026 Fri, 15 May 2026 00:00:00 GMT Adds Response Actions directly in the resource drawer for hosts, containers, files, K8s workloads, and AWS resources. • Enables performing Response Actions (Host, Container, File, Kubernetes, AWS) directly from the resource drawer without leaving the view • Allows reviewing Response History for a resource to inspect execution status, target information, and configuration details Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-5-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-5-2026 Tue, 05 May 2026 00:00:00 GMT New Response History page for viewing and managing response actions. • Adds the `Response History` page to visualize when, where, and by whom response actions were taken. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#march-25-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#march-25-2026 Wed, 25 Mar 2026 00:00:00 GMT Host Scanner v0.16.2 adds Talos Linux OS support for non-OS package vulnerability matching • Host Scanner v0.16.2 now supports Talos Linux OS with vulnerability matching for non-OS packages Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#march-17-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#march-17-2026 Tue, 17 Mar 2026 00:00:00 GMT Sysdig Secure adds managed Falco rules and policies to detect suspicious AI coding agent activity. • Adds detection rules for Codex, Gemini CLI, and Claude Code installation, unauthorized access, config directory access, risky CLI arguments, and sensitive file access Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-26-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-26-2026 Thu, 26 Feb 2026 00:00:00 GMT Sysdig Secure introduces Cloud Response Actions for AWS in Threat Detection, with Terraform provider updates. • Adds `Cloud Response Actions` for AWS, allowing containment and investigative actions directly from the Events feed. • New `Configure Threat Response on AWS` setup path is available. Breaking changes: • Cloud Detection and Response (CDR) is renamed to Threat Detection across UI and documentation. • All Sysdig Terraform modules for AWS, GCP, Azure, and OCI bumped to a new major version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-17-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-17-2026 Tue, 17 Feb 2026 00:00:00 GMT Adds Amazon Kinesis Data Streams and Kinesis Firehose integrations for streaming data out of Sysdig Secure • Adds support for streaming Sysdig data to Amazon Kinesis Data Streams via the UI under Integrations > SIEM & Data Platforms. • Adds support for streaming Sysdig data to Amazon Kinesis Firehose via the UI under Integrations > SIEM & Data Platforms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-3-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#february-3-2026 Tue, 03 Feb 2026 00:00:00 GMT New Posture and VM Findings pages with risk trends, hotspot analysis, and auto-sorting • Adds `Posture Overview` page showing passing scores, 30-day trends, and hotspots for weakest categories, resources, and high-severity controls • Adds `Findings` workspace for filtering, grouping, and assigning remediation in Posture management • Expands Program Dashboards to view risk trends by namespaces, cloud accounts, images, and repositories • Enhances context depth across image, OS, application, and package layers for vulnerability remediation • Sorts vulnerability findings by default to highlight critical, exploitable, and recently discovered items Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-27-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-27-2026 Tue, 27 Jan 2026 00:00:00 GMT KSPM Analyzer v1.47.0 adds Kubernetes 1.29–1.32 support and MCR Docker audit skip. • Added support for Kubernetes versions 1.29 through 1.32 with new compliance audits • Improved Docker audits to skip evaluation when Mirantis Container Runtime (MCR) is detected Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-24-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-24-2026 Sat, 24 Jan 2026 00:00:00 GMT Sysdig Secure agentless workload scanning adds support for LVM and multi-partition root volumes • Adds `LVM-based` instance support to Agentless Host Scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-19-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#january-19-2026 Mon, 19 Jan 2026 00:00:00 GMT Sysdig Secure adds Agentless scanning for AWS Lambda ZIP functions and new Runtime Action types for Automations. • Expands Agentless Workload Scanning to support AWS Lambda functions packaged as ZIP archives • Adds Kill Process, File acquire, File quarantine, Kubernetes Rollout restart, Kubernetes Volume snapshot, Kubernetes Get Logs, and Kubernetes Network isolate as new Runtime Actions in Automations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#november-3-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#november-3-2026 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-29-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-29-2026 Sysdig Secure adds Vulnerability Findings automations that group alerts by resource or image, reducing per-finding notification noise⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Sysdig Secure now supports Vulnerability Findings automations that group findings by resource or image, sending one Slack or email notification — or creating one Jira ticket — per resource or image rather than per finding (Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-22-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-22-2026 Sysdig CLI and Registry Scanners gain PHP binary detection, extended risk acceptance, and license classification (Technical Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds PHP to the applications identified by CLI Scanner standalone binary scanning, including PHP compiled from source such as in official Docker Hub php images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends risk acceptance to every component type in the CLI Scanner, so accepted risks now apply to vulnerabilities in standalone binaries and other non-package components. • Adds standalone binary scanning to the Registry Scanner, enabling detection of applications not installed by a package manager — including PHP compiled from source — in distroless and scratch images. • Adds license detection for packages in Registry Scanner scanned images, available in Technical Preview. Breaking changes: • Registry Scanner v0.13.0: images that previously showed no findings (such as distroless and scratch images) may show new findings after upgrading due to standalone binary scanning being enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-14-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-14-2026 Sysdig Secure adds SIEM forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds forwarding rules to SIEM & Data Platforms integrations, replacing the `Data to Send` field, with per-rule filters including severity and policy name for Runtime Policy Events and type for Activity Audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Rules` column to the integrations list showing the number of active forwarding rules per integration. Breaking changes: • The `Data to Send` field in SIEM & Data Platforms integrations is replaced by forwarding rules; existing configurations using that field will need to be migrated to the new rules model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-05-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-05-2026 Sysdig Secure now sources CVSS scores for non-OS packages from the GitHub Advisory Database, delivering earlier scores across 11 ecosystems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Sources severity and CVSS scores for non-OS package vulnerabilities from the GitHub Advisory Database, falling back to NVD when GitHub has no score, covering Java, JavaScript, Python, Go, Rust, PHP, Ruby, .NET, Erlang, Dart, and Swift packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Severity ratings on existing non-OS package findings may change (commonly from High to Medium) after upgrade; vulnerability policies that trigger on High or Critical may now pass or fail on different packages following the next scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-02-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-02-2026 Sysdig adds a Vulnerability Catalog to look up any tracked CVE — even with no findings in your environment — via UI and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the CVE Catalog API to programmatically retrieve CVE metadata and environment-impact data, available on SaaS now and on-premises from version 7.10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the CVE Details drawer, opened by selecting a CVE in the Vulnerability Catalog, showing CVE metadata and whether the CVE affects your environment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-01-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#october-01-2026 Sysdig Secure adds a Supply Chain Findings page (Technical Preview) surfacing license and end-of-life issues across pipeline, registry, and runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `Attack Surface > Supply Chain Findings` page (Technical Preview) listing license and end-of-life findings across pipeline, registry, and runtime resources, with filtering by severity, stage, finding type, license category, or license name, and grouping by package, image, or runtime resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Supply Chain Findings` tab to the Resource Details drawer and the Component Details drawer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#september-29-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#september-29-2026 Sysdig Secure adds AI-powered Threat Evaluation column with Malicious/Suspicious/Benign scoring and confidence levels to the Threats page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `Evaluation` column to the Threats page, ranging from Malicious to Suspicious to Benign, enabling sort and filter by evaluation to prioritize the most critical threats first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a confidence level indicator in the Threat Detail panel alongside the Evaluation score, reflecting the amount of context available for each threat — requires the Secure AI entitlement. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#september-16-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#september-16-2026 Sysdig CLI Scanner v1.30.0 adds standalone binary scanning, license reporting, and Hummingbird OS support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds standalone binary scanning via `--detect-unknown-executables` to identify and report vulnerabilities in applications not installed by a package manager, including executables the scanner does not recognize.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for Binary Allow List and Binary Deny List rules, so vulnerability policies that allow or deny specific binaries are now evaluated by the CLI Scanner. • Adds per-package license data (including license category) to the JSON scan result under the v1 schema, available via `--output json`, in Technical Preview. • Adds `--show-licenses` to print the ten most frequent licenses and their occurrence counts in console output, and `--full-licenses-table` to show every license found, in Technical Preview. • Adds support for the Hummingbird OS distribution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-13-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-13-2026 Sysdig Secure adds image layer analysis, vulnerability policy results in the resource drawer, and base image allow/deny list rules. • Adds a 'Vulnerability Policies' tab in the Resource Details drawer (opened from Vulnerability Findings) showing how each resource was evaluated against configured Vulnerability Policies, with a details panel per rule surfacing CVEs, affected components, and remediation guidance, plus in-drawer exception creation. • Adds a 'Layers' tab in the Resource Details drawer for container image resources, displaying the full image layer stack grouped by base image or 'Application Layers', with per-layer Dockerfile instruction and vulnerability counts by severity — select a layer to filter the Vulnerabilities tab, or use the new 'Layer' filter to slice the CVE list directly. • Adds 'Layer Number' and 'Layer Command' fields to the Findings Details drawer to identify which layer introduced an affected component. • Adds 'Base Image Allow List' and 'Base Image Deny List' rules under Image Configuration in rule bundles, accepting base image pull strings to approve or block entire registries or namespaces in a single entry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-12-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-12-2026 KSPM Analyzer v1.49.3 auto-evaluates CIS Kubernetes Benchmark 5.3.1 by detecting CNI plugins on each node. • Adds automatic detection of Container Network Interface (CNI) plugins in use on each Kubernetes node, enabling CIS Kubernetes Benchmark v2.0.0 recommendation 5.3.1 to be evaluated automatically instead of requiring manual attestation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-11-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-11-2026 Sysdig CLI Scanner v1.29.0 adds support for Allow/Deny Base Image supply chain rules in vulnerability policies. • Adds support for Allow Base Image and Deny Base Image supply chain rules in the CLI Scanner, so vulnerability policies that allow or deny specific base images are now evaluated locally. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-3-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#august-3-2026 Sysdig Secure vulnerability policy scopes now allow the same attribute in multiple AND-joined conditions for Admission Control and Runtime stages. • Vulnerability policy scopes for the Admission Control and Runtime stages now support using the same attribute in more than one condition, enabling include and exclude patterns on a single attribute (e.g., all non-production clusters except one), with conditions joined by AND. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-29-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-29-2026 Sysdig CLI Scanner v1.28.0 adds NixOS and Arch Linux package detection plus dnf/microdnf support. • Adds detection of NixOS (`nix`) packages in the CLI Scanner. • Adds detection of Arch Linux packages in the CLI Scanner. • Adds `dnf` and `microdnf` to the package manager detection policy rule. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-16-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-16-2026 Sysdig Secure now supports multiple S3/S3-compatible custom storage buckets across Captures, Response Actions, and Rapid Response. • Supports connecting multiple S3 or S3-compatible buckets (MinIO, Google Cloud Storage, and others) for use across Captures, Response Actions, and Rapid Response. • New Custom Storage configuration supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints, with connection testing on save and per-bucket failure history. Breaking changes: • The previous single shared S3 Capture Storage configuration is replaced by Custom Storage; existing setups must be migrated to the new multi-bucket configuration under Integrations > Data Sources > Storage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-14-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-14-2026 Sysdig Secure adds column customization for Vulnerability Management Findings reports. • Enables selection and reordering of columns in newly created Vulnerability Management Findings reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#april-15-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#april-15-2026 Agentless Host Scanning now covers Windows, Fedora, and AWS Bottlerocket hosts via snapshot-based scanning. • Adds agentless snapshot-based host vulnerability scanning for Windows hosts. • Adds agentless snapshot-based host and container vulnerability scanning for Fedora hosts. • Adds agentless snapshot-based host and container vulnerability scanning for AWS Bottlerocket hosts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-1-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-1-2026 Registry Scanner v0.12.0 adds OCI image format and multi-architecture bundle scanning across all supported registries. • Supports scanning of OCI image manifests (`application/vnd.oci.image.manifest.v1+json`), covering single-platform images published in OCI format. • Supports OCI image indexes and Docker manifest lists (`application/vnd.oci.image.index.v1+json` and `application/vnd.docker.distribution.manifest.list.v2+json`), resolving multi-architecture images to a platform-specific manifest for scanning. • Recognizes image manifests that omit the optional `mediaType` field (e.g., those produced by buildah), which were previously skipped as unsupported. • Adds intelligent multi-architecture platform selection: prefers `linux/amd64`, then any `linux/*`, then the first scannable manifest; skips attestation manifests and `unknown/unknown` entries. • Publishes the Registry Scanner job image as a multi-architecture manifest (`linux/amd64` and `linux/arm64`), enabling native support for ARM-based clusters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-9-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#july-9-2026 Host Scanner adds Google COS/GKE node vulnerability coverage and improved Ruby gem file-level attribution. • Supports Google Container-Optimized OS (COS): Host Scanner now identifies installed packages on COS hosts (e.g., GKE nodes), extending vulnerability scanning to those workloads. • Improves Ruby package detection: Host Scanner tracks source `.rb` files within installed gems, enabling more precise file-level vulnerability attribution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-25-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-25-2026 Sysdig CLI Scanner v1.27.2 adds detection support for Google Container-Optimized OS (COS) packages. • Adds detection of Google Container-Optimized OS (COS) packages in vulnerability scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-26-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-26-2026 Sysdig Secure refreshes the Threats UI with bulk actions and resource focus, and adds Azure Monitor Logs Ingestion API for Sentinel. • Adds bulk actioning on Threat aggregations, allowing review of multiple occurrences at once from a single pane. • Threats now scoped to a single resource, surfacing context-aware risk signals per asset. • New occurrence tabs let practitioners toggle between the latest and prior threat occurrences within the same view. • Supports the Azure Monitor Logs Ingestion API for Microsoft Sentinel SIEM integration, replacing the deprecated HTTP Data Collector API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-9-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#june-9-2026 Sysdig Secure adds end-of-life visibility and policy enforcement for OS and Go runtime components in Vulnerability Management. • Adds end-of-life (EOL) visibility for operating systems and the Go runtime in Vulnerability Management, surfacing lifecycle status alongside vulnerability data in the Resource Details drawer, Components tab, Findings Details drawer, CVE Details drawer, and scan result side panels. • New Lifecycle column and filter in the Components tab lets practitioners quickly identify components no longer receiving vendor support. • CLI scanner JSON output and the scan results API now include lifecycle metadata, enabling pipeline and integration consumers to act on EOL status programmatically. • New Component Lifecycle rule type in Rule Bundles enables policy evaluations to fail when a component has reached its EOL date or is within 90 days of it. • Sysdig CLI Scanner v1.27.1 adds end-of-life support for Vulnerability Management. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-15-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-15-2026 Sysdig Secure adds Response Actions directly in the resource drawer for hosts, Kubernetes workloads, and AWS resources. • Enables Response Actions (threat hunting, incident containment) directly from the resource drawer without navigating away from the resource view. • Supports host, container, and file Response Actions for hosts when Host Shield is configured. • Supports Kubernetes Response Actions for workloads when Cluster Shield is enabled. • Supports Cloud Response Actions for AWS resources when Cloud Response Actions are deployed. • Adds a Response History panel in the resource drawer to review past actions, execution status, target info, and configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-26-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-26-2026 Sysdig CLI Scanner v1.27.0 adds Flashpoint KEV tag and Flashpoint CVSSv3 Temporal score to vulnerability output. • Adds Flashpoint KEV (Known Exploited Vulnerabilities) tag to CLI Scanner vulnerability output for faster exploit-aware triage. • Adds Flashpoint CVSSv3 Temporal score to CLI Scanner vulnerability output, surfacing real-world exploitability context alongside base scores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-5-2026 https://docs.sysdig.com/en/release-notes/saas-sysdig-secure-release-notes/#may-5-2026 Sysdig Secure adds Response History page for auditing all Response Actions across events, automations, and APIs. • New Response History page centralizes all Response Actions taken manually, via Automations, or through APIs — showing what was done, where, when, and by whom. • Enables retrieval of collected artifacts and reversal of containment actions performed in error from a single audit view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sysdig-secure