https://cybertoolchain.io/tools/xfa New releases and features in XFA, tracked by The Cyber Toolchain. en Fri, 23 Oct 2026 11:17:56 GMT https://docs.xfa.tech/changelog https://docs.xfa.tech/changelog Fri, 23 Oct 2026 11:17:56 GMT XFA Desktop Application now supports NixOS, installable without root via nix profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NixOS support for the XFA Desktop Application, installable into a user's nix profile without root permissions, with auto-update and optional system-wide deployment via NixOS system configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog https://docs.xfa.tech/changelog Fri, 16 Oct 2026 08:14:37 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/10/13/nixos-support https://docs.xfa.tech/changelog/2026/10/13/nixos-support Tue, 13 Oct 2026 00:00:00 GMT XFA Desktop Application now supports NixOS, installable via system flake with automatic updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NixOS support for the XFA Desktop Application, installable via system flake with `nix flake update xfa` fetching the latest release and the running XFA switching over automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/09/25/antivirus-product-requirements https://docs.xfa.tech/changelog/2026/09/25/antivirus-product-requirements Fri, 25 Sep 2026 00:00:00 GMT XFA Beta lets you require specific antivirus products (Microsoft Defender, ClamAV, Windows Security Center partners) per OS in device policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the ability to require specific antivirus products in device policy for Windows (Microsoft Defender or any product registered with Windows Security Center) and Linux (ClamAV or Microsoft Defender for Endpoint), with suggestions drawn from your device inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Device details view, sign-in verification screen, and risk emails now surface which antivirus product is required vs. detected so users understand why a check fails. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/09/04/per-platform-os-policies https://docs.xfa.tech/changelog/2026/09/04/per-platform-os-policies Fri, 04 Sep 2026 00:00:00 GMT XFA now lets you set separate OS version requirements per platform — Windows, macOS, Linux, Android, iOS, and iPadOS each get their own policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports per-platform OS version policies, letting you set distinct warning or blocking thresholds for Windows, macOS, Linux, Android, iOS, and iPadOS independently.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a dedicated OS version policy for iPadOS, separate from iOS. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/09/02/personal-device-checks https://docs.xfa.tech/changelog/2026/09/02/personal-device-checks Wed, 02 Sep 2026 00:00:00 GMT XFA desktop app gains a personal security view for checking your own computer, with or without an org connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a personal view in the desktop app for checking your computer's security posture without being connected to an organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a setup wizard to guide users through initial configuration of personal device checks. • Adds per-organization views showing which checks each organization requires, kept separate from personal checks. • Enables adding personal checks alongside organization-required checks, with the ability to ignore individual personal findings independently of org requirements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/09/02/self-invite https://docs.xfa.tech/changelog/2026/09/02/self-invite Wed, 02 Sep 2026 00:00:00 GMT XFA adds self-invite so users can join their org via email one-time code without waiting for an admin invitation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables self-invite in `Awareness` settings (Beta) so users can join their organization by entering a work email and confirming with a one-time code, without an admin-sent invitation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/05/03/safe-browsing https://docs.xfa.tech/changelog/2026/05/03/safe-browsing Tue, 18 Aug 2026 08:55:49 GMT XFA adds eight browser-privacy device checks for Chrome and Firefox, with warn-or-block policy controls. • Adds Chrome Safe Browsing device checks (standard and enhanced modes) as configurable per-organization policies. • Adds Chrome Do-Not-Track device check as a configurable per-organization policy. • Adds Chrome DNS-over-HTTPS device check as a configurable per-organization policy. • Adds Firefox HTTPS-Only device check as a configurable per-organization policy. • Adds Firefox DNS-over-HTTPS device check as a configurable per-organization policy. • Adds Firefox Enhanced Tracking Protection device checks (standard and strict modes) as configurable per-organization policies. • Each new browser-privacy check supports warn or block enforcement actions, letting organizations match controls to their risk appetite. • Violations surface in the desktop tray menu and the device detail view in the dashboard, with one-click remediation links built into the agent. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/08/17/organization-default-language https://docs.xfa.tech/changelog/2026/08/17/organization-default-language Tue, 18 Aug 2026 08:55:49 GMT XFA lets organizations set a default language for emails and messages when a user's language is unknown. • Adds an organization-level default language setting under Settings > Organization, used for emails and messages when a user's own language cannot be detected or is not set on their profile. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/07/01/new-xfa-desktop-app https://docs.xfa.tech/changelog/2026/07/01/new-xfa-desktop-app Tue, 28 Jul 2026 16:00:35 GMT XFA desktop app gains a full security dashboard so end users can see every check and self-remediate without IT. • New full desktop app UI (macOS, Windows, Linux): users can open the menu-bar icon to see a complete device security overview. • Per-check pass/fail detail view shows every security check XFA runs with step-by-step remediation guidance for end users. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/27/claude-code-auto-mode https://docs.xfa.tech/changelog/2026/04/27/claude-code-auto-mode Thu, 23 Jul 2026 15:49:56 GMT XFA now detects Claude Code's `auto` and `bypassPermissions` modes as unsafe AI configurations alongside the legacy flag. • Extends Unsafe AI Mode detection to flag Claude Code's `auto` and `bypassPermissions` values in `permissions.defaultMode` within `~/.claude/settings.json` (or `~/.claude/settings.local.json`). • Devices configured with either flagged mode now appear in the Unsafe AI Mode check with remediation guidance surfaced to end users in the in-app guide. • Treats `bypassPermissions` as equivalent to `--dangerously-skip-permissions` and `auto` as the same risk class — both auto-approving all tool calls including shell commands and network requests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/07/08/policy-settings-and-discovery-redesign https://docs.xfa.tech/changelog/2026/07/08/policy-settings-and-discovery-redesign Thu, 23 Jul 2026 15:49:56 GMT XFA adds live Enforcement policy timing previews and a redesigned Discovery connection flow with provider picker. • Adds a threshold timeline and live timing summary to Enforcement policy editing, so you can see exactly when a device would be warned or blocked before saving. • Adds suggestion chips for common warn and block windows when configuring Enforcement policies. • Redesigns the Discovery overview with a two-column layout and a provider picker that routes directly to a step-by-step setup page for Microsoft, Google, or Okta. • Devices table on the Dashboard now shows whether a device's Last Seen came from the XFA agent or from Discovery. • Enables disconnecting a Microsoft Teams integration from the Integrations page, matching existing Slack disconnect capability. • Accounts blocked for billing can still open Settings to download invoices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/30/compliance-status-bar https://docs.xfa.tech/changelog/2026/04/30/compliance-status-bar Thu, 23 Jul 2026 15:49:56 GMT XFA dashboard gains a compliance status bar for at-a-glance policy-based device security health. • New compliance status bar on the dashboard surfaces compliant, warned, blocked, and uncovered devices at a glance. • Enables admins to identify devices with missing information that require verification before compliance status is finalized. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/22/custom-messages https://docs.xfa.tech/changelog/2026/04/22/custom-messages Thu, 23 Jul 2026 15:49:56 GMT XFA now supports custom messages on onboarding and sign-in cards, configurable per application from the Dashboard. • Adds custom text messages to the bottom of XFA's device onboarding and sign-in cards, with separate messages for each flow. • Enables configuration of onboarding and sign-in messages from the Applications page in the Dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/24/device-snooze https://docs.xfa.tech/changelog/2026/04/24/device-snooze Thu, 23 Jul 2026 15:49:56 GMT XFA adds Device Snooze to pause checks, notifications, and optionally MFA for individual devices with a time-limited exception. • Adds Device Snooze to grant individual devices a temporary exception, pausing device checks and awareness notifications for a chosen preset or custom date/time window. • Snoozed devices are hidden from overviews and analytics by default, with a 'Show snoozed devices' filter to surface them on demand. • Supports optional reason logging per snooze, and allows updating or removing a snooze from the same device action menu. • Enables explicit MFA inclusion in the snooze to also pause MFA for Enforcement sign-ins during the exception window. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/15/linux-bootstrap-install https://docs.xfa.tech/changelog/2026/04/15/linux-bootstrap-install Thu, 23 Jul 2026 15:49:56 GMT XFA Linux installation now requires a single curl command instead of manual package selection. • Adds a one-line bootstrap installer for Linux, eliminating the need to manually select and download a package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/07/22/guided-setup-and-device-posture https://docs.xfa.tech/changelog/2026/07/22/guided-setup-and-device-posture Thu, 23 Jul 2026 15:49:56 GMT XFA adds guided setup, device posture overview cards, rebuilt Statistics trends, and unattended remote access detection. • New Getting Started page walks through four tracked setup steps — from device discovery to compliance enforcement — so admins always know what to configure next. • Devices page now opens with Discovery, Awareness, and Enforcement status cards showing real-time counts (devices discovered, alerts sent, successful sign-ins) at a glance. • Statistics Trends rebuilt out of BETA: four metric tiles as tabs, unified chart with period/OS filter/chart-type controls inline, and custom date range support. • Device detail view now reports whether a device allows unattended remote access, with an explanation of what the check looks for and a link to act on it in policy. • Disconnected Discovery integrations now surface a red alert and a Reconnect button on the dashboard, and count toward the Discovery badge. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/06/02/lost-connection-status https://docs.xfa.tech/changelog/2026/06/02/lost-connection-status Thu, 23 Jul 2026 15:49:56 GMT XFA adds a 'Lost connection' device status with filtering and verification requests to surface endpoints that stopped reporting. • New 'Lost connection' status highlights devices where the XFA agent has stopped reporting a verified status in the Devices overview. • Filter by 'Lost connection' status in both the Devices and People views to quickly identify affected endpoints. • Request verification directly from the Dashboard to prompt users to reconnect the XFA app and resume device security status sharing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/07/03/teams-integration https://docs.xfa.tech/changelog/2026/07/03/teams-integration Thu, 23 Jul 2026 15:49:56 GMT XFA adds Microsoft Teams integration to deliver device risk alerts, enrollment invites, and sign-in verification directly to end users. • Connects XFA to a Microsoft Teams tenant so end users receive device risk alerts, new-device enrollment invitations, and sign-in verification requests as direct messages — no email required. • Enables per-category notification toggles so admins can independently enable or disable each message type. • Supports sending a test message per notification section to verify delivery before rolling out to users. • Delivers messages localized in English, Dutch, French, German, and Spanish. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/17/opal-sed-encryption https://docs.xfa.tech/changelog/2026/04/17/opal-sed-encryption Thu, 23 Jul 2026 15:49:56 GMT XFA Linux disk-encryption checks now recognize TCG OPAL 1.x/2.x self-encrypting drives alongside LUKS. • Detects TCG OPAL 1.x and 2.x self-encrypting drives (via sedutil-cli) as encrypted on Linux when drive locking is enabled, enabling accurate compliance reporting for hardware-encrypted devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/30/policy-stats-sidebar https://docs.xfa.tech/changelog/2026/04/30/policy-stats-sidebar Thu, 23 Jul 2026 15:49:56 GMT XFA policy detail pages now show a live compliance summary sidebar alongside policy settings. • Adds a compliance summary sidebar to policy detail pages, showing compliant, non-compliant, and missing-information device counts while editing policy settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/05/04/screenlock-timeout https://docs.xfa.tech/changelog/2026/05/04/screenlock-timeout Thu, 23 Jul 2026 15:49:56 GMT XFA adds screen lock timeout enforcement so admins can cap idle-lock delays on macOS, Windows, and Linux. • Adds maximum screen lock timeout enforcement: admins can set a maximum allowed timeout duration (in minutes) in their organization's policy, and XFA verifies the device's configured timeout does not exceed it. • Supports platform-specific timeout detection on macOS, Windows, and Linux. • Combines timeout check with existing screen lock enable/disable check — both must pass for a device to be compliant. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/22/slack-integration https://docs.xfa.tech/changelog/2026/04/22/slack-integration Thu, 23 Jul 2026 15:49:56 GMT XFA adds Slack integration to deliver device risk alerts, enrollment invites, and sign-in verification requests directly to end users. • Connects XFA to a Slack workspace so end users receive device risk alerts as direct messages without email. • Sends new-device enrollment invitations via Slack DM to streamline onboarding. • Delivers sign-in verification requests and safe-browsing policy notifications through Slack. • Admins can toggle each notification category on/off and configure per-section delivery frequency from the Integrations page. • Slack messages are localized in English, Dutch, French, German, and Spanish. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/07/15/mobile-checks-and-dashboard-polish https://docs.xfa.tech/changelog/2026/07/15/mobile-checks-and-dashboard-polish Thu, 23 Jul 2026 15:49:56 GMT XFA now warns or blocks risky mobile devices (jailbroken, rooted, dev-mode, rebooted) at sign-in, matching existing desktop policy enforcement. • Extends jailbreak, root, developer-mode, and recent-reboot signals from mobile devices into the access decision at sign-in, so risky mobile devices are warned or blocked per policy — matching existing desktop behaviour. • Adds a 'Watch demo' action in the Dashboard for Discovery and Enforcement sections, opening a guided tour without leaving the dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa https://docs.xfa.tech/changelog/2026/04/17/veracrypt-detection https://docs.xfa.tech/changelog/2026/04/17/veracrypt-detection Thu, 23 Jul 2026 15:49:56 GMT XFA now detects VeraCrypt system-drive encryption on Windows, reporting those devices as compliant automatically. • Supports VeraCrypt system (boot-drive) encryption on Windows as a compliant disk-encryption state, alongside BitLocker. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xfa