https://cybertoolchain.io/tools/trend-vision-one New releases and features in Trend Vision One, tracked by The Cyber Toolchain. en Wed, 04 Nov 2026 00:00:00 GMT https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-tag-based-filtering https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-tag-based-filtering Wed, 04 Nov 2026 00:00:00 GMT Trend Vision One Agentless Vulnerability & Threat Detection adds tag-based filtering for AWS scans and excludes TrendAI Lambda functions by default⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add tag-based filtering for AWS scans to include resources, exclude resources, or both, so only matching resources are scanned — configured via the Configuration tab of Agentless Vulnerability & Threat Detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • EBS volumes are now filtered by the tags of the attached EC2 instance (not the EBS volume itself), ECR images by the tags of the ECR repository (not the image), and Lambda functions by their own tags — with Lambda layers scanned alongside any matched function. • TrendAI Lambda functions are now excluded from scanning by default; re-enable scanning for them via a new option on the Configuration tab of Agentless Vulnerability & Threat Detection. • The audit log now reports the defined include/exclude tags, whether TrendAI Lambda functions are excluded or scanned, and the count of matched resources against total detected resources. Breaking changes: • TrendAI Lambda functions are now excluded from Agentless Vulnerability & Threat Detection scans by default; existing deployments that relied on scanning these functions must re-enable the option on the Configuration tab. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-gcp-template-version-2-5-0 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-gcp-template-version-2-5-0 Mon, 02 Nov 2026 00:00:00 GMT Trend Vision One File Security Storage adds dual/multi-region bucket scanning, location-specific destination buckets, and configurable Cloud Run scaling for Google Cloud⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Configure location-specific destination buckets for clean, malicious, and failed files separately in the Google Cloud template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Configure Cloud Run scaling and CPU allocation for the Scanner and Post-Scan Action services; scale-to-zero and request-based billing are enabled by default. • Scan dual-region and multi-region Cloud Storage buckets (requires a matching File Security Storage service update and a scanner deployed in an eligible region). • Receive failure reports for scan requests that exceed the retry limit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update Mon, 26 Oct 2026 00:00:00 GMT Trend Vision One Agentless Vulnerability & Threat Detection adds VPC deployment support for AWS via CloudFormation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Deploy Agentless Vulnerability & Threat Detection directly into your own AWS Virtual Private Cloud (VPC) via CloudFormation for greater network isolation and control, configured through Cloud Security → Cloud Accounts → AWS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update Mon, 26 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-aws-october-2026-update Mon, 26 Oct 2026 00:00:00 GMT Agentless Vulnerability & Threat Detection can now be deployed directly into your AWS VPC via CloudFormation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports deploying Agentless Vulnerability & Threat Detection directly into your AWS Virtual Private Cloud (VPC) via CloudFormation, enabling greater network security control and resource isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-ai-scan-progress https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-ai-scan-progress Mon, 26 Oct 2026 00:00:00 GMT Trend Vision One AI Scanner streams partial results mid-scan with `partial-upload: true` and configurable `partial-frequency` on the visionone output destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `partial-upload: true` to the `visionone` output destination config to enable partial result uploads while an AI scan is still running.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `partial-frequency: <int>` to the `visionone` output destination config to control how often partial results are sent, as a completion-percentage threshold (defaults to 25%). • The TrendAI Artifact Scanner interactive configuration wizard exposes the `partial-upload` option when configuring outputs. • The AI Application Security dashboard shows a 'Scan in Progress' banner with completed-attack count, a progress bar, and a 'Cancel scan' button while a scan runs. • Results tables and widgets on the AI Application Security dashboard refresh automatically as new findings arrive during a running scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-FSS-azure-template-version-2-6-0 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-FSS-azure-template-version-2-6-0 Mon, 26 Oct 2026 00:00:00 GMT Trend Vision One File Security Storage Azure template 2.6.0 adds optional customer-managed Azure VNet support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds optional customer-managed Azure VNet support to the File Security Storage Azure deployment template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-runtime-malware-scan-ecs https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-runtime-malware-scan-ecs Wed, 21 Oct 2026 00:00:00 GMT Runtime Malware Scanning now covers Amazon ECS (EC2 and Fargate), with Terminate mitigation to stop affected tasks and block flagged images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends Runtime Malware Scanning to Amazon ECS clusters for both EC2 and Fargate launch types, adding real-time and scheduled malware detection previously available only for Kubernetes clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports `Terminate` mitigation for ECS: Container Security stops affected ECS tasks and blocks additional tasks from launching with a flagged image, using the same filter rules and log/terminate options as Kubernetes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-trendai-vision-one-iam-for-cegp https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-trendai-vision-one-iam-for-cegp Tue, 20 Oct 2026 00:00:00 GMT Cloud Email Gateway Protection gains directory sync via TrendAI Vision One™ IAM, supporting AD, Entra ID, Google Cloud Identity, Okta, and OpenLDAP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Existing Directory Synchronization Tool users can review migration eligibility and the migration report in the `IAM Connection` tab before switching, after which TrendAI Vision One™ IAM automatically cleans up legacy synchronized data and configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-version-1-651-10191318 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-version-1-651-10191318 Mon, 19 Oct 2026 00:00:00 GMT Trend Vision One Agentless Vulnerability & Threat Detection adds support for SCP-restricted environments in the AI Security stack on AWS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Support SCP-restricted AWS environments in the AI Security stack via the new `SentryBucketPublicAccessBlockOmit` CloudFormation parameter, which lets AI Security engine log buckets omit the bucket-level Block Public Access setting (defaults to `false`, so Block Public Access remains active unless changed).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-vdi-automated-tagging-condition https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-vdi-automated-tagging-condition Fri, 16 Oct 2026 00:00:00 GMT Trend Vision One adds VDI type condition (Persistent/Non-persistent) for automated tagging rules in Tag Management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `VDI type` condition to automated tagging rules in Tag Management, supporting `Persistent` and `Non-persistent` values for the `Devices` asset type to identify and tag VDI devices by persistence state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Restricts `VDI type` condition combinations to `Asset Group` and `CREM exception list` platform tags only, preventing duplicate-tag rule creation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-pa-connector-v-3-11-0-2190 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-pa-connector-v-3-11-0-2190 Fri, 16 Oct 2026 00:00:00 GMT Private Access Connector 3.11.0.2190 adds TCP MSS clamping and CIS-benchmark image hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Applies additional image hardening settings recommended by CIS benchmarks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-remote-support-access https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-remote-support-access Wed, 14 Oct 2026 00:00:00 GMT Support Settings splits remote support into granular proactive-access and diagnostics controls with Automatic or Manual approval per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds granular remote support controls under `Administration → Support Settings`, separating access into 'Proactive service console access' (read-only access for customer success advisors, solution engineers, incident response, and threat researchers) and 'Troubleshooting and diagnostics' (technical support console access, diagnostic package collection, and remediation utility deployment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Automatic` or `Manual` approval mode selectable per remote support task, giving administrators fine-grained control over each access type. • Enables TrendAI™ remote support as a master toggle before individual access types can be granted. • Diagnostic packages (logs, memory dumps, and endpoint state) collected from endpoint agents are stored in Azure in the US region for 21 days. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-355 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-355 Wed, 14 Oct 2026 00:00:00 GMT Helm Chart 3.5.5 adds unsupported-chart-version warnings on helm install/upgrade and upgrades the falco gRPC dependency to v1.67.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a warning during `helm install` or `helm upgrade` when an unsupported chart version is detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Upgrades the falco gRPC dependency from v1.44.0 to v1.67.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-password-attachment-end-user-input https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-password-attachment-end-user-input Wed, 14 Oct 2026 00:00:00 GMT Trend Vision One lets admins prompt email recipients for attachment passwords so protected files get scanned instead of skipped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an action in Email and Collaboration Security → Cloud Email and Collaboration Protection to request password-protected attachment passwords directly from recipients when the password is absent from the email, enabling scanning of previously unscannable attachments without administrator intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-service-gateway-appliance-firm-3035 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-service-gateway-appliance-firm-3035 Wed, 14 Oct 2026 00:00:00 GMT Service Gateway 3.0.35 expands appliance logs with service network diagnostics and improves upgrade history tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves appliance upgrade history visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-generic-caching-service-108 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-generic-caching-service-108 Wed, 14 Oct 2026 00:00:00 GMT Generic Caching Service 1.0.8 adds appliance-managed certificate bundle support for custom certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports appliance-managed certificate bundle for custom certificate configuration in the Generic Caching Service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-agent-support-golden-gate-270 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-agent-support-golden-gate-270 Wed, 14 Oct 2026 00:00:00 GMT Trend Vision One agent gains macOS Golden Gate (27.0+) support for Standard Endpoint Protection and XDR/EDR deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports deploying the Trend Vision One agent to macOS Golden Gate (27.0 and later) endpoints, including Standard Endpoint Protection and XDR for Endpoint (EDR) features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • The Trend Vision One agent will no longer support macOS Monterey (12.0) after December 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-dsc-ga-wn https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-dsc-ga-wn Mon, 12 Oct 2026 00:00:00 GMT Trend Vision One unifies Data Source and Log Management and Third-Party Integrations into a single Data Sources and Connectors hub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Data Sources and Connectors, a unified hub replacing the separate Data Source and Log Management and Third-Party Integrations capabilities, accessible under Agentic SIEM & XDR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-aisvs https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-aisvs Fri, 09 Oct 2026 00:00:00 GMT Trend Vision One AI Scanner adds OWASP AISVS 1.0 scoring with per-level pass rates across all 27 testable requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new AISVS attack preset in the TrendAI Artifact Scanner wizard to exercise all 27 testable OWASP AISVS 1.0 requirements spanning prompt injection, output safety, memory, orchestration, and adversarial robustness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Scores AI application scans against OWASP AISVS 1.0 at three ascending levels — Level 1 (baseline), Level 2 (sensitive data), and Level 3 (high-risk/critical) — each reporting a pass rate and a verdict of PASS, PASS (partially assessed), NOT ASSESSED, or FAIL. • Surfaces AISVS scores in the dashboard, executive summary, and exported reports, with drill-down from each level to the individual requirement, a link to the standard, and a direct jump to the failed attack in the results table. • Adds AISVS scoring access under AI Security → AI Application Security. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-AIScanner-timestamps https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-AIScanner-timestamps Fri, 09 Oct 2026 00:00:00 GMT AI Scanner gains time-series charts, per-scan timestamps, and a 180-day results retention window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Results over time' and 'Attack success rate over time' charts to the AI Scanner dashboard, showing distinct successful attacks broken down by severity across a selected target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-day and per-scan view toggle to the AI Scanner dashboard time-series charts, letting you plot aggregated per-day or per-month series or drill into individual scan runs. • Deduplicates successful attacks when multiple scans share a data point, filtering down to distinct results in the time-series view. • Extends AI Scanner scan results retention from 60 days to 180 days, enabling a broader historical view in the time-series charts. • Adds a timestamp to every AI Scanner scan result, surfacing the exact time a finding was produced in the results table and finding details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-ais-cert-auth https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-ais-cert-auth Fri, 09 Oct 2026 00:00:00 GMT AI Scanner gains mTLS client-certificate auth for custom AI endpoints, configured via `target.custom.tls` with `cert_env`, `key_env`, and `ca_env`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `target.custom.tls` config block with `cert_env`, `key_env`, and `ca_env` fields to supply client certificate and private key (PEM, via environment variables) for mTLS-authenticated custom AI endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports mTLS client-certificate authentication for custom AI endpoints, usable alone or combined with existing API key or cookie authentication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-dark-mode-light-mode https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-wn-dark-mode-light-mode Tue, 06 Oct 2026 00:00:00 GMT Trend Vision One adds a dark/light mode toggle in user Preferences, with dark mode as the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a dark/light mode toggle in the Preferences menu, accessible via the user icon at the top right of the console; selection is saved per account, with dark mode as the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-95 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-95 Mon, 05 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-network-encrypted-traffic-pqc https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-network-encrypted-traffic-pqc Sat, 03 Oct 2026 00:00:00 GMT Trend Vision One adds two Network Overview widgets for TLS and post-quantum cryptography visibility on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `Encrypted Traffic Summary` widget to Network Security → Network Overview, showing TLS version mix and post-quantum cryptography (PQC) usage across encrypted connections on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `Top Encrypted Traffic Regions` widget to Network Security → Network Overview, showing top source and destination countries for TLS-encrypted traffic on TippingPoint devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-gcp-template-version-2-3-1 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-gcp-template-version-2-3-1 Thu, 01 Oct 2026 00:00:00 GMT File Security Storage template v2.3.1 for Google Cloud adds scan activity filters by Cloud Provider, Account, Region, and grouped scan count tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds detailed scan error information to the Scan Activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds scan count tracking grouped by Bucket and Scan Type in the Scan Activity view. • Improves event forwarding throughput for faster scan result availability, especially for high-volume scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-azure-template-version-2-5-2 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-azure-template-version-2-5-2 Thu, 01 Oct 2026 00:00:00 GMT Trend Vision One: Adds filtering of scan activities by Cloud Provider, Account, and Region in the Scan Activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-aws-template-version-4-5 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-fss-aws-template-version-4-5 Thu, 01 Oct 2026 00:00:00 GMT Trend Vision One: Adds `extractFileCountLimit` parameter to control the maximum number of files inspected within a compressed archive (default: 30).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-mobile-app-workbench-alerts https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-mobile-app-workbench-alerts Thu, 01 Oct 2026 00:00:00 GMT TrendAI Vision One Mobile app adds Workbench alert review, Case Management creation, and case status updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Workbench alert management to the TrendAI Vision One Mobile app, with filtering by time range and display of severity and current status for each alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables opening a Case Management case directly from a Workbench alert in the Mobile app. • Enables updating case status from the TrendAI Vision One Mobile app, with changes reflected in the console. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-V1CS-amazon-ecs-2211 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-V1CS-amazon-ecs-2211 Wed, 30 Sep 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-risk-event-forward-s3 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-risk-event-forward-s3 Wed, 30 Sep 2026 00:00:00 GMT Trend Vision One can now forward risk events, alerts, and logs to AWS S3 buckets via the Google Security Operations SIEM connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports forwarding Cyber Risk Exposure Management risk events to AWS S3 buckets via the Google Security Operations SIEM connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports forwarding Workbench alerts, Observed Attack Techniques events, container vulnerabilities, device vulnerabilities, activity data, and audit logs to AWS S3 buckets via the Google Security Operations SIEM connector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-azure-activity-log-1-048 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-azure-activity-log-1-048 Tue, 29 Sep 2026 00:00:00 GMT Azure Activity Log 1.0.48 migrates its AML pipeline to v2 with an event-driven architecture for improved performance and scalability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Migrates AML pipeline to v2 with event-driven architecture for improved performance and scalability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-AIAS-authenticate-cookies https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-WN-AIAS-authenticate-cookies Mon, 28 Sep 2026 00:00:00 GMT AI Scanner adds streaming, session-cookie auth, and plain-text response support for custom AI endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `stream` option for custom AI Scanner targets to scan endpoints that return incremental responses (SSE or streamed text chunks), enabling coverage of chat-style APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • In JSON streaming mode, AI Scanner applies an existing response template to each SSE/streamed frame as a delta path (e.g. `choices[0].delta.content`) and concatenates extracted content in arrival order. • In text streaming mode, AI Scanner reads raw response bytes and joins them until the stream ends. • Adds `cookie` as a supported value for `auth_type`, allowing AI Scanner to authenticate against endpoints that require a browser or application session; credentials are read from `api_key_env` and sent in the `cookie` request header. • Adds `text` as a supported value for `response_format`, causing AI Scanner to treat the entire response body as raw text; response templates must include the `{{response}}` marker to insert the returned text into the response envelope. • Plain-text response handling works with both buffered and streaming endpoints, and can be combined with `cookie` auth or the `stream` option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-module-for-android-v2-0-01651 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-module-for-android-v2-0-01651 Mon, 28 Sep 2026 00:00:00 GMT ZTSA Module for Android/ChromeOS 2.0.0.1651 adds MDM phone-number fallback and new permission policy controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for using an MDM-provided phone number as fallback device information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds policy support for managing notification and storage permissions on Android/ChromeOS devices. • Improves ZTNA session stability and connection resilience. • Improves PAC and SWG traffic routing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-version-1-206-09221355 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-avtd-version-1-206-09221355 Fri, 25 Sep 2026 00:00:00 GMT Agentless V&TD for Azure gains Flex Consumption Plan migration, China region support, and expanded regional coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Migrates Agentless Vulnerability & Threat Detection and VNet Flow Logs from the Y1 Consumption Plan to the Flex Consumption Plan for non-China Azure regions, ahead of the Y1 plan retirement on September 30, 2028.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds China region support (China East 2, China North 2, China North 3) for Agentless Vulnerability & Threat Detection and VNet Flow Logs, including vulnerability and malware scanning for Azure Virtual Machines, Disks, Azure Container Registry images, and Azure Function Apps, plus VNet Flow Logs collection and forwarding to TrendAI Vision One. • Expands region support for Agentless Vulnerability & Threat Detection and VNet Flow Logs on Azure subscriptions. • Enforces `https_only` on Azure Agentless Vulnerability & Threat Detection and VNet Flow Logs Function Apps to strengthen transport security. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ubuntu-2604-64bit https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ubuntu-2604-64bit Thu, 24 Sep 2026 00:00:00 GMT Trend Vision One agent adds Ubuntu 26.04 64-bit (x86-64) support for Server & Workload Protection and XDR for Endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports deploying the Trend Vision One agent on Ubuntu 26.04 64-bit (x86-64) endpoints, including Server & Workload Protection and XDR for Endpoint (EDR) features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-mobile-security-app-v201651-android https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-mobile-security-app-v201651-android Wed, 23 Sep 2026 00:00:00 GMT Mobile Security for Business 2.0.1651 adds MDM-provided phone number fallback and improved ZTNA/SWG routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for the latest Android platform requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-sg-sps-version-2011 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-sg-sps-version-2011 Tue, 22 Sep 2026 00:00:00 GMT Service Gateway Smart Protection Services 2.0.11 adds support for the TrendAI Vision One agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for the TrendAI Vision One™ agent on Service Gateway Smart Protection Services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-local-response-filters-ga https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-local-response-filters-ga Mon, 21 Sep 2026 00:00:00 GMT Trend Vision One GA: local response filters auto-terminate processes on Windows endpoints to cut MTTD.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables local response filters for Windows endpoints that automatically terminate processes on detection, reducing mean time to detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Manages local response filters via `Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies` to integrate detection into security policy workflows. • Activates local response filters per-detection in `Agentic SIEM and XDR → Observed Attack Techniques` to convert individual event detections into automated responses. • Lists all enabled local response filters in `Agentic SIEM and XDR → Detection Model Management → Local response filters`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-94 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-94 Mon, 21 Sep 2026 00:00:00 GMT Zero Trust Secure Access On-Premises Gateway 1.0.94 adds Vertex Chat content inspection support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds content inspection support for Vertex Chat traffic through the on-premises gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-354 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-354 Thu, 17 Sep 2026 00:00:00 GMT Helm Chart 3.5.4 adds per-component toleration config keys, ArgoCD SCC normalization, and excluded-nodes billing support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `tolerations.<component>` per-component keys and `tolerations.defaults` fallback in Helm values to configure tainted-node tolerations (control-plane, GPU, spot/preemptible) for individual components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports excluded-nodes billing and protection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-service-gateway-appliance-firm-3034 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-service-gateway-appliance-firm-3034 Wed, 16 Sep 2026 00:00:00 GMT Service Gateway 3.0.34 adds Rocky Linux 9.8, package signature verification, Brazil site support, and new MicroK8s debug CLI commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds CLI commands to enable and disable MicroK8s debug logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds package signature verification before firmware upgrade and service installation. • Adds Brazil (BR) site FQDN support. • Extends custom CA support to the `sg-apl` service and Node.js-based services. • Upgrades appliance OS to Rocky Linux 9.8. • Enhances diagnostics collection with MicroK8s inspection reports and container image checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-version-control-pattern-schedules https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-version-control-pattern-schedules Wed, 16 Sep 2026 00:00:00 GMT Version Control Policies gains pattern update schedule management for TrendAI Vision One agent 202609+⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds pattern update schedule configuration to `Version Control Policies`, reachable via Endpoint Security → Endpoint Security Configuration → Version Control Policies, for agents on version 202609 and later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Engine updates now follow agent software update settings when managed through `Version Control Policies`, consolidating previously separate controls. • Enrollment into `Version Control Policies` now automatically enrolls all unenrolled Protection Manager instances in a single operation. Breaking changes: • Agents older than version 202609 continue to follow pattern update settings from Protection Manager, not from Version Control Policies — mixed fleets will have split management paths after this change. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-pa-connector-v-3-9-0-2162 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-pa-connector-v-3-9-0-2162 Wed, 16 Sep 2026 00:00:00 GMT Private Access Connector 3.9.0.2162 adds Proxmox platform support and richer Browser Access diagnostic logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enhances application access visibility with improved telemetry data in Secure Access history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds more detailed diagnostic logging for Browser Access to aid troubleshooting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-phishing-outlook-whatsnew https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-phishing-outlook-whatsnew Tue, 15 Sep 2026 00:00:00 GMT Trend Vision One adds Outlook Add-in integration so users can report phishing simulation emails directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Report Phishing` button via the Outlook Add-in so users can report suspicious or simulated phishing emails directly from Microsoft Outlook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Tracks which users reported simulated phishing emails within simulation analytics, adding a new response option to the phishing results filter. • Adds a new user status in simulation profiles describing the method used to report a phishing email. • Reduces user risk scores for users who demonstrate consistent, proactive phishing reporting behavior over time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-sa-openldap-whatsnew https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-sa-openldap-whatsnew Tue, 15 Sep 2026 00:00:00 GMT Trend Vision One Security Awareness adds OpenLDAP as an identity data source for user import and sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds OpenLDAP as a supported identity data source in Security Awareness, enabling direct user import and synchronization from LDAP-based directories for phishing simulations and training campaigns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-module-win-v-2381040 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-module-win-v-2381040 Mon, 14 Sep 2026 00:00:00 GMT Zero Trust Secure Access Module for Windows 2.38.1040 cuts device posture reporting interval from 5 minutes to 2 minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reduces the device posture reporting interval from 5 minutes to 2 minutes, enabling faster detection of posture changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-93 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ztsa-onprem-gateway-version-1-0-93 Mon, 14 Sep 2026 00:00:00 GMT Zero Trust Secure Access On-Premises Gateway 1.0.93 adds ChatGPT unauthenticated traffic inspection and an updated Prompt Scan engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for ChatGPT unauthenticated traffic inspection, enabling coverage of sessions where users have not signed into ChatGPT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adopts the latest Prompt Scan engine to improve detection accuracy for prompt injection and harmful prompts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-gmail-addin-support https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-gmail-addin-support Thu, 10 Sep 2026 00:00:00 GMT Trend Vision One adds a Gmail add-in so users can report suspicious emails and manage quarantine without leaving their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Gmail add-in that lets users report suspicious emails for analysis with a single click directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables self-service quarantine review and management for Gmail users when a quarantine mailbox is configured, reducing admin overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-353 https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-rn-helm-chart-353 Wed, 09 Sep 2026 00:00:00 GMT Helm Chart 3.5.3 adds resource limits for admission-controller and policy-operator and restricts audit-log-collector webhook ingress via NetworkPolicy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Updates Helm installation to use `oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security` as the primary installation source, with the GitHub container registry as the alternative.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trend-vision-one