What changed, release by release.

DoS and DDoS detection from your own routers and hosts

A collector reads NetFlow, IPFIX and read-only SNMP counters from your routers and a Linux host agent reads kernel network counters. Learned baselines raise an alarm and an all-clear that closes the same incident, corroborated by the deception fabric. Detection only: it never mitigates and never writes to your network.

DORA and NIS2 on the incident

Classify an incident against the DORA major-incident criteria and the NIS2 significance test, run the reporting clocks, and render notifications from the incident's own fields. A management-body report in English and Montenegrin, per-tenant report branding and multi-recipient delivery.

Tamper-evident audit log and auditor evidence pack

Audit records are hash-chained and each day is closed by a signed anchor. A verifier, an audited export and an audit stream to your SIEM, plus an evidence pack mapped to DORA, ISO/IEC 27001 and NIS2 controls.

Customer-facing fraud protection

Seven financial indicator types (IBAN, BIC, card BIN, phone number, SMS sender ID, app package, social handle; full card numbers are refused). Takedown notices sent on the analyst's click with evidence, reminders and a measured time-to-takedown; a page canary that spots your login page being served from someone else's domain; a confirmed per-brand blocklist and a public fraud-alerts page; stealer-log exposure monitoring.

Fake apps, customer scam reports and social watch lists

Fake apps in the Apple App Store and Aptoide, a public report-a-scam page for your customers that reads QR codes in the browser, and watch lists for your own Telegram and YouTube presence. Every candidate is confirmed by corroboration or an analyst before it is published.

Sector sharing groups

Vetted sharing groups with per-indicator TLP, distribution and expiry, MISP in both directions, a TAXII inbox, revocation, and a payee-risk lookup for payment fraud under its own API scope.

Leaked secrets in public code

Your identifiers searched in public GitHub code, hits classified against a catalogue of 22 documented secret formats, stored masked and never tested. Your own organisation's GitHub secret-scanning alerts are mirrored too.

Three new decoy targets

An SSL-VPN remote-access gateway portal, an MCP server for AI agents whose toolset differs between boxes, and an SAP NetWeaver application server, each in its own small image.

Model training and AI evaluation that survive restarts

The triage model and AI evaluation runs now live in your tenant's own database. An evaluation runs as a background job that executes at most once and reports its progress.

First versioned release, signed with our own key

Images, the Helm chart and SBOM attestations are signed with the project's cosign key and verify against a published public key; nothing is written to a public transparency log. Each release carries CycloneDX SBOMs, vulnerability scan reports, the API specification and checksums for every file.

Upgrade and restore drills gate every release

A release ships only after the previous version has run against the new schema and a backup has been restored. Base images with a critical vulnerability are refused.

External attack-surface management

Declare your domains, ranges and ASNs and prove ownership. The platform discovers internet-facing assets from certificate transparency, DNS and RDAP, evaluates them against a closed catalogue of exposure rules, and matches software versions to known vulnerabilities ranked by EPSS and by what your own sensors see being probed. Active checks run only against assets you have proven and consented to, from a probe runner with a signed plan and a published opt-out page.

Your own osquery, patch compliance and endpoint vulnerabilities

Write and schedule osquery queries behind a fail-closed read-only validator, track patch compliance against policies, and match installed packages against Red Hat, Microsoft, Debian and Alpine advisories. New internal admin-port fan-out between hosts is flagged as lateral movement.

Android devices under the same protection

An Android agent in the work profile reports to the same Endpoint Intelligence gateway: posture, sideloaded and fake apps, user-installed certificates, and blocking through Private DNS first and an on-device filter second.

Act from your phone

An installable web app with push notifications and a focused decision board for approvals. The highest-consequence decisions require a fresh sign-in.

Five signed response actions, as a separate channel

Isolate host, kill process, quarantine file, disable local account and revert, as signed, host-bound, expiring documents with four-eyes approval, a dry run first, daily and fleet-fraction ceilings and a fleet kill switch. Response never rides the telemetry gateway.

Internal deception: zones, canary tokens and decoy groups

Mark sensors as internal so any touch pages as Critical, plant honey credentials and beacon URLs, and group decoys into coherent fake sites with internal DNS so an intruder's pivot between them is visible.

Web-server and Linux personas, exploit watch, novelty

nginx, Apache and IIS personas; bounded Linux shell personas; a cited catalogue that names the exploitation campaigns reaching your sensors and backfills history; novelty scoring for request shapes the fleet has never seen.

Security wire

Curated advisories from CISA, NCSC UK, SANS ISC and Microsoft MSRC, flagged when they mention a CVE you are exposed to. Context only: news never becomes an indicator.

Clearer navigation, a readable relationship graph, a SOC wall

Nine sections organised by what the analyst came to do, a relationship graph that opens as a collapsible tree with a layered view and a full-screen stage, and a full-screen attack map built for the wall.

Fewer false lookalikes

Lookalike domains are read for page content, so parked pages and unrelated businesses are proposed benign instead of raised, and copies of the same phishing kit are linked by fingerprint.

Appliance supervision

The malware-analysis appliance reports liveness through an outbound agent. A stalled analysis backend is detected and work is deferred instead of silently failing, with optional bounded self-restart.

Incident lifecycle on a case

Declare a case an incident with a severity, move it through detected, contained, eradicated, recovered and closed with SLA clocks, attach evidence from the platform's own artefacts, complete a post-incident review, and download a hashed evidence bundle.

Disaster recovery hardened

Stated RPO/RTO per topology, encrypted off-site backup copies, per-tenant restore without stopping the platform, a secrets-custody table and a backup-freshness health check.

Certificate pinning for blocklist sources, and SSLBL certificate fingerprints

Pin a blocklist source's TLS certificate by SHA-256. A new abuse.ch SSLBL certificate-fingerprint preset joins the catalogue.

Monthly partitioning for sensor events and sightings

The two highest-volume tables are range-partitioned by month with a nightly maintenance job; a capacity model and growth alerts ship with them.

Anonymous public feed tier

An opt-in, unauthenticated feed of attacker addresses only: 48-hour delay, 1,000-row cap and its own throttle. Off by default and kill-switched.

Documentation ships with every release

A strictly built documentation set, every link resolved, packaged with each release for on-premises and air-gapped mirrors.