Release Notes — August 14, 2026

This release brings two new integrations, Iru for device compliance signals and Google Workspace as a new detection source, plus a much clearer view of your attack surface. Asset inventory now shows how your resources connect to each other, the IP addresses that don’t belong to you, and the MCP servers and API endpoints you’ve configured.

New Features

Resource relationships and attack surface visibility

Asset inventory now shows how your cloud resources connect to each other, with a new Resources tab on cloud account details listing everything discovered inside that account. This is part of a broader push on attack surface visibility, enabling you to identify IP addresses tied to your infrastructure that you don’t actually control, the MCP servers and tools you’ve configured, and the API endpoints you’re exposing.

End-of-life and revoked dependency risk

The Dependencies grid now shows, and lets you filter on, packages that are end-of-life, past their support window, or have had a release revoked. This risk was already being collected, it just wasn’t visible until now.

Detection rules for your custom log sources

Custom log sources can now be covered by the same structured detection rules used across our other data sources, extending threat detection to whatever you’re already sending into Fencer.

Per-repository controls for AI code review

Admins can configure how AI security code review behaves on a repository-by-repository basis instead of one setting for the whole organization.

Integrations

• Connect Iru to bring each device’s compliance status onto your Endpoints page. See whether its disk is encrypted, its firewall is on, its screen locks, and its OS is up to date.
• Google Workspace is now available as a SIEM data source. Connect it to stream admin and activity audit logs into Fencer, with detection rules already tuned for sensitive OAuth grants and other high-priority events.
• DigitalOcean Monitor events now carry more structured detail, giving detection rules more to work with.

Improvements

• AI review from more places. AI code review can now start from pull request comments on additional source-control providers, not just GitHub.
• Faster vulnerability and asset pages. Queries behind the vulnerability list, asset grids, and asset-inventory filters are faster for organizations with larger inventories.
• More complete AWS inventory scans. AWS architecture inventory scans now finish within their time budget instead of ending partway through for large accounts.
• Inline asset ownership editing. Edit an asset’s owner directly from the list, and filter datagrids by owner along with other fields.
• KPI summary strips on posture pages. Every posture asset list now starts with a KPI summary strip, with clearer visual separation between cards.
• Quick filters in Hunts. Hover a row in Hunts to add an “Include” filter on its actor, action, or target with one click.
• Clearer penetration test report objectives. The objectives section of penetration test reports now better matches the OWASP format.
• OAuth integrations can always be reconnected. Fixed cases where a broken or expired OAuth connection couldn’t be re-established.
• More reliable Fencer MCP server. The Fencer MCP server now handles more connection edge cases cleanly, reports rejected tool arguments clearly, and adds new tools for looking up assets and members.
• Elastic IP visibility in AWS inventory. AWS architecture scans now collect Elastic IPs and the network connections tied to them.
• Choose your ticketing provider for access review remediation. User access review remediation tickets can now be filed with your preferred ticketing provider.
• Device last check-in visibility. The endpoints overview now shows when each device last checked in.
• More columns on posture grids. Posture list grids support extra columns, hidden by default, for anyone who wants more detail.
• Critical vs. high split at a glance. The shared vulnerabilities count now breaks out critical from high instead of combining them into one number.
• Row context menu on datagrids. Datagrid rows use a context menu for row actions instead of a favorite star.
• Hunts filter reflects your actual sources. The Hunts data-source filter now only lists source types you’ve actually connected.
• Clearer penetration test language. Renamed the “Reporting” status to “Ready for remediation” and standardized on “penetration test” throughout reports.
• New Security Practices page. Our docs site now has a Security Practices page covering SOC 2 Type II compliance, how we handle your data (no code retention, encryption at rest and in transit), tenant isolation, and how to report a vulnerability.

Bug Fixes

• Fixed hard page reloads returning a 404 on deep links.
• Fixed an expired session showing a raw error instead of returning you to the login page.
• Fixed clean AI penetration test runs having their credit refund rejected.
• Fixed the vulnerability-import button being unreachable for assigned penetration testers on manual pentests.
• Fixed AI code review failing outright on large pull request diffs.
• Fixed AWS CloudWatch Logs events delivered via subscription filters not being unpacked correctly.
• Fixed filtering Hunts by nested data fields not working.
• Fixed vulnerability triage occasionally getting killed mid-run instead of resuming.
• Fixed an error opening certain nodes in the architecture graph view.
• Fixed a crash during asset scanning caused by duplicate DNS records.
• Fixed oversized input fields stalling SIEM ingestion for GCP Cloud Armor and related sources.
• Fixed a bad-recipient error blocking other lifecycle emails from sending.
• Fixed user sessions recording the load balancer’s IP instead of the real client IP.
• Fixed a naming mismatch that caused AI penetration test credit charges to fail.
• Fixed penetration test vulnerabilities repeating the underlying tool’s description instead of their own.
• Fixed indentation and column-width issues in penetration test reports.
• Fixed the impersonation warning banner not being dismissible.
• Fixed incorrect avatar images in the identities owner column.
• Fixed keyboard shortcuts and tab navigation in the vulnerabilities command palette.
• Fixed the “has upstream fix” indicator collapsing unknown cases into “not fixed.”
• Fixed a GitHub detection rule not matching repository-creation events correctly.
• Fixed generic error messages for container scan failures caused by registry access issues.
• Fixed an inconsistent default base URL in the Fencer CLI.
• Fixed the open row’s highlight being hard to see in one theme.
• Fixed penetration test detail and report pages erroring on legacy or malformed data.

Coming Soon

These features are currently in testing and rolling out soon:

• Pause a penetration test mid-run. You’ll be able to stop an in-progress AI penetration test directly from the UI instead of waiting for it to finish.
• AI penetration testing keeps expanding. A single engagement will be able to span multiple connected domains at once, and scope discovery is learning to recognize CNAME-fronted apps as selectable targets automatically.
• Stronger SSO enforcement. SSO will be checked at the moment a protected action is taken, not only at login, closing gaps where a revoked identity could keep acting.
• MCP surface inventory. Application scans will start enumerating an organization’s MCP tool, prompt, and resource surface as its own asset type, with a dedicated tab to review it.
• On-Demand Full-Repository Security Review. Beyond reviewing individual pull requests, AI code review will be able to scan an entire repository on demand, launched from the repository view.
• GitLab as a SIEM source. GitLab audit events will be connectable as a new SIEM data source, with detections surfaced through Hunts.
• Redesigned AI code review flow. The AI code review experience is moving into a cleaner, dialog-based flow on the repository page.
• Improved DAST coverage. The application scanner is getting better at finding pages on JavaScript-heavy sites during scans.
• AI credit usage on your usage page. You’ll be able to see AI credit consumption directly alongside your other usage metrics.
• IP ownership chain. Domain and network views will show the ownership chain behind an IP address.
• Network Flows page. A new page will visualize VPC flow log traffic with a geo map and other network intelligence widgets, sourced from real connection data.
• Also in testing. A few smaller items are rolling out gradually including: collapsible vulnerability reference lists, per-organization identity-enrichment exports, and a detection grouping fix.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.