Skip to content
FencerFencerDocs

Release Notes — July 31, 2026

This release brings User Access Reviews and AI-powered pull request reviews to general availability, ships a redesigned experience across the Artifacts, Cloud, Code, and Network pages, and previews upcoming agentic penetration testing.

New Features

Section titled “New Features”

User Access Reviews

Section titled “User Access Reviews”

Now generally available. Run periodic, point-in-time access reviews where vendor owners attest to who has access, with easy-to-use assignment worksheets (retain, remove, or modify), automatic remediation tickets in Linear or Jira, sign-off and attestation, manager oversight, and evidence export for SOC 2 / ISO 27001.

AI PR Reviews

Section titled “AI PR Reviews”

AI-powered security code review is now generally available for pull requests. Every PR is automatically scanned for security issues, with reviews and fixes streaming in as they run with findings organized in a tiered taxonomy and contextualized with exact code snippets.

Redesigned Posture Pages

Section titled “Redesigned Posture Pages”

The Artifacts, Cloud, Code, and Network pages have been rebuilt on a shared layout: a unified asset grid with tabbed detail views, breadcrumb navigation between assets, bulk scope actions, per-user favorites, standardized KPI cards, and a new tiles overview that shows one card per asset type.

Integrations

Section titled “Integrations”
  • Cloud scans now recognize more Google Cloud resource types that previously showed up as unknown assets.
  • Vanta setup instructions now specify the exact read and write scopes to grant.
  • Azure credentials are now validated when you edit a connection, not just when you first create it.

Improvements

Section titled “Improvements”
  • Faster asset filtering. Asset inventory filter facets now load noticeably faster.
  • Editable posture scope. Asset posture pages now show scope columns with inline editing, so you can see and change scope without opening each asset.
  • Clearer partial scans. Architecture scans now explain why a scan finished partially instead of leaving you guessing.
  • Bounded architecture scans. Each cloud provider portion of an architecture scan is now bounded and named if it stalls, instead of the whole scan hanging.
  • Safer detection rules. Detection rules with fields that can’t be mapped to your data are now automatically disabled instead of silently failing.
  • Cleaner TLS noise. Network scans now recognize more CDN-fronted domains and no longer mistake self-signed origin certificates for CDN defaults, cutting down on TLS/cipher noise that wasn’t actionable.
  • More accurate PR code scans. Code scans on pull requests now rebase onto the current base commit, producing more accurate diffs for review.
  • Bulk scope everywhere. Bulk mark-out-of-scope is now available on posture pages and the artifacts/containers page, in addition to the asset inventory.
  • Vulnerability history for everyone. A timeline of status changes is now available on every account.
  • Clearer DNS labels. DNS record assets now show more descriptive labels.
  • Deep links from the inventory drawer. The asset inventory drawer now exposes a direct link to the asset.
  • Less DNS churn. Rotating DNS address records are now updated in place instead of being deleted and recreated.
  • Location filtering. The vulnerability list now supports filtering by location prefix.
  • Bulk rule toggles. Select multiple detection rules and enable or disable them all at once.
  • Readable rule titles. Rules and detections now show readable titles instead of raw rule names.
  • Simpler rule files. Custom detection rule files no longer need a specific file extension.
  • Focused network discovery. Network discovery can now skip a configured list of lower-priority targets to keep scans focused.
  • Tidier asset diff. The asset diff hover card now opens on the correct side so it no longer overlaps the details panel.
  • Readable detection attributes. Detection detail attribute keys now display with spaces instead of underscores.
  • 1Password branding fixed. Corrected lingering “OnePassword” references throughout the app.
  • Smarter Fix button. The AI Fix button is now disabled for repositories that don’t support it, instead of failing when clicked.
  • Traceable vulnerabilities. Vulnerabilities detected in an earlier run are now linked from the run that found them again.
  • Clearer integration alerts. Broken-integration notifications now use the integration’s name instead of an internal identifier.
  • Skip stale code scans. Code scans are now skipped when their commit no longer exists in the repository, instead of erroring.

Bug Fixes

Section titled “Bug Fixes”
  • Fixed an issue in event ingestion that could silently drop a batch of security events; ingestion now only advances after a batch is confirmed written.
  • Fixed findings not consistently linking back to the correct file directory.
  • Fixed ignored and deferred vulnerabilities still appearing in your task inbox.
  • Fixed empty rows and a broken filter link in the asset vulnerabilities list.
  • Fixed “View Current State” dropping your asset filter for scans.
  • Fixed subdomain counts double-counting DNS records instead of counting unique subdomains.
  • Fixed scan-start errors being silently swallowed on some plans instead of shown.
  • Fixed the Slack agent’s response not being saved and shown in the web app.
  • Fixed hosts on port 443 with no SSL/TLS grade not appearing in the domain’s SSL/TLS tab.
  • Fixed attribution and scheduled timing for cascaded domain and network scans.
  • Fixed asset inventory pagination breaking when filters were applied.
  • Fixed devices from Kandji and other MDM sources being incorrectly removed by stale-device cleanup.
  • Fixed a bounced-recipient error on one address blocking other lifecycle emails from sending.
  • Fixed AWS architecture inventory scans not completing within their expected time budget.
  • Fixed alert matching failing when a detection’s underlying rule was missing.
  • Fixed protocol-exposure findings missing from network service scans.
  • Fixed TLS grading failing for services that should have graded F.
  • Fixed the GitHub tag modification detection rule not filtering correctly by event type.
  • Fixed a data mismatch that could leave detection events with a missing ID or timestamp.
  • Fixed detection rules referencing data columns that no longer exist.
  • Fixed Cloudflare firewall event ingestion getting stuck on an empty time window.
  • Fixed a scope query that could leak staging resources into in-scope views.
  • Fixed the “View full agent details” link not opening after launching a fix.
  • Fixed Google Workspace accounts with no recorded login incorrectly showing a login date.
  • Fixed asset timeline hover information being cut off in a narrowed panel.
  • Fixed a domain page link pointing to a page that no longer exists.
  • Fixed inconsistent counts for lookalike domain findings when sorting the list.
  • Fixed bulk-action button text looking disabled in dark mode.
  • Fixed missing links between vulnerabilities and the run that found them for some secret-scanning results.
  • Fixed a duplicated organization prefix in a vulnerability detail asset link.
  • Fixed external detection rule sources not validating that the configured branch exists before syncing.
  • Fixed detection rules with an unmapped, category-only data source causing errors instead of being skipped.
  • Fixed freshly-updated network services being incorrectly deduplicated away.
  • Added a proper error page for CSRF failures instead of a generic one.
  • Fixed the bulk Fix/Defer popup rendering incorrectly under the list header.
  • Fixed a contradictory “no upstream fix available” message on vulnerability detail.
  • Fixed asset location links and navigation on vulnerability detail.
  • Fixed vulnerability file paths showing extra directory prefixes instead of a clean relative path.
  • Fixed the g-then-j keyboard shortcut for navigating between rows on grid pages.
  • Fixed Zoom being incorrectly classified as an identity provider.
  • Fixed the sidebar navigation highlighting the wrong item.

Coming Soon

Section titled “Coming Soon”

These features are currently in testing and rolling out soon:

  • Agentic Penetration Testing. The AI Penetration Testing Agent and Penetration Testing v2 previews are converging into one experience. This cycle adds scheduled start times and comprehensive/expert-led engagement options to the test builder, custom test naming, and a wave of scope-accuracy and reliability hardening so runs stay tightly bound to what you’ve authorized and report clearly on anything they couldn’t reach.
  • On-Demand Full-Repository Security Review. An on-demand review of your entire repository is coming, launched from the repository view.
  • Investigate Detections in Threat Hunter. Detection details are becoming more concise, with a direct link to investigate the underlying events in Threat Hunter.
  • DigitalOcean Monitor log source. DigitalOcean Monitor is being added as a new SIEM data source, with a guided setup flow to connect and provision it.
  • Network Flows page. A new page visualizes VPC flow log traffic, with a geo map and additional network intelligence widgets.
  • Refreshed integration setup. Connect and edit forms for individual integrations are being migrated to the new experience with consistent validation, loading states, and error handling. This wave adds Rippling, Vanta, Bitbucket, and Azure DevOps.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.