Release Notes — October 9, 2026
Four features from our early-access list are now generally available: custom automations, custom roles, the Fencer AI security chat assistant, and personal API keys. Your homepage is now a prioritized task board, and AI fixers can respond to review feedback on their own pull requests.
New Features
Section titled “New Features”Custom automations
Section titled “Custom automations”Build your own custom automation rules triggered by vulnerabilities, detections, and pentest events. Rules can open Jira or Linear tickets, set due dates from your SLA, and assign tickets to an owner. You can also use rules to reduce noise and improve time to resolution by defining which findings get sent to whom.
Describe a rule in plain language and let the AI rule builder draft it, or assemble it yourself from triggers and destinations. Every rule has a run history, and automation runs appear in your activity feed.
SecOps detection alerts are now delivered through these same rules, and rules can send events to your own webhook.
Custom roles
Section titled “Custom roles”Define roles with exactly the permissions your team needs. See your existing role definitions and make custom roles from the Team page.
Personal API keys
Section titled “Personal API keys”Your team can now request personal Fencer API keys to use with the CLI and MCP server. API key requests must be approved by organization admins, and both admins and requesters are notified when a request is made or decided.
Fencer AI security chat assistant
Section titled “Fencer AI security chat assistant”Ask Fencer about your security posture, then ask it to do something about it. It can help you fix vulnerabilities, prepare for security reviews, and take on other tactical work, showing what it’s doing as it goes. Assets, detections, and scans open in a side drawer, and you can queue your next message while it’s still replying. Every agent run appears in one filterable agents list.
A prioritized task board on your homepage
Section titled “A prioritized task board on your homepage”Your homepage is now an actionable task board. A scheduled agent keeps a prioritized list of what to work on next, you can edit priorities at any time, and each task has its own chat. Next to it, a dashboard shows your progress, and a noise-reduction funnel explains how raw findings were narrowed down to what needs your attention.
AI fixers respond to feedback, CI failures, and merge conflicts
Section titled “AI fixers respond to feedback, CI failures, and merge conflicts”AI fixers now stay with their pull requests after opening them. Leave review feedback on a fixer’s pull request, no tagging needed, and Fencer’s AI fixers pick it up once the comments settle, push the requested changes, and reply in each thread. They can also fix failing CI checks and resolve merge conflicts, and they review their own patch before the pull request opens. Follow-up rounds appear as a conversation on the PR, and fixer PRs are assigned through the vulnerability assignee’s linked accounts. Untick the Autofix checkbox in a fixer PR’s description to stop follow-ups on that PR.
More AWS streaming data sources
Section titled “More AWS streaming data sources”The AWS Streaming Monitor now supports VPC Flow Logs and Application Load Balancer access and connection logs, with a clearer setup page and full-precision timestamps on CloudTrail and VPC Flow Log events.
Set roles from your identity provider
Section titled “Set roles from your identity provider”Fencer can now assign organization roles in your SSO sign-in.
MITRE ATT&CK tags on detections
Section titled “MITRE ATT&CK tags on detections”Detections are now tagged with MITRE ATT&CK techniques, and a new SecOps report page shows your coverage.
Group dependencies by package or location
Section titled “Group dependencies by package or location”The dependencies list can now be grouped by package or by where the dependency is declared.
Penetration testing-only plan
Section titled “Penetration testing-only plan”You can now subscribe to a plan that includes only penetration testing. Scanning modules outside your plan show an upgrade badge in the navigation.
Improvements
Section titled “Improvements”- AI pentest refinements. The AI penetration test agent now paces itself against fragile targets, recovers findings when a run is interrupted, reports every vulnerability it probed, and catches more injection issues. “Refine & run” is now available to all customers, and you can link directly to a pentest’s result tabs.
- AI code review stays in sync with your pull request. Reviews re-run when you push, resolve comments you’ve addressed, reuse a single comment across pushes, and offer fixes as suggestions you can apply in one click.
- Richer CloudTrail events. CloudTrail events now carry cloud account metadata alongside identity information, making hunts and detections easier to correlate.
- Faster code scans. Dependency detection, license lookups, and infrastructure-as-code scanning run faster, and known packages are no longer re-enriched on every scan.
- More vulnerability context. Checks backed by a CVE now show CVSS scores, EPSS, and exploitability, and the CISA known-exploited catalog refreshes daily.
- Asset owners. Asset and device owners appear in the inventory, API, and CLI, are filled in from Iru device sync, and assets have an in-scope toggle.
- Vulnerabilities without an upstream fix are deferred automatically, and the fix status now shows an explicit “Unknown” state.
- Tighter permission checks. API tokens now honor read and write scopes, read-only members can use organization pages they should have access to, and creating or deleting domains requires asset permissions.
- Custom Source shows its default transformation. The editor now shows the transformation Fencer applies to incoming events by default, so you can start from it. A custom source must save its own transformation before you can generate an ingest token. Ingest tokens are shared with the AWS Streaming Monitor.
- Activity feed. Automation runs, source-control webhook events, and architecture runs show in the activity feed, and system-triggered jobs are labeled “Fencer”.
- Clearer Slack alerts. Detection alerts use a simpler format, include recommendations, and no longer show link previews.
- Smoother sign-in. Two-factor entry uses one box per digit, the login page marks your last used method, and step-up prompts accept authenticator codes.
- Datagrid and filter polish. Keyboard navigation in filters, text search on the Team page, record-type filters on DNS records, a single Status filter replacing Ignored and Deferred, and filters saved per page.
- Fencer CLI. Detection event details are available, and non-JSON responses show the HTTP status and body.
- Vendor catalog. Disable vendors in the catalog, skip archived GRC vendors, and re-sync vulnerabilities from the Drata edit page.
- Detection tuning. Noisy CloudTrail rules are quieter, and detection rules read the new per-type streaming views.
- Smaller touches. Organization logos fit their tile, the onboarding checklist only shows for roles that can configure the organization, monthly vulnerability reviews are explained, and the Sentry integration disconnects when you uninstall the app.
Bug Fixes
Section titled “Bug Fixes”- Fixed SCIM-provisioned users needing manual linking before they could sign in with SSO.
- Fixed scans running for deleted Aviator branches.
- Fixed Azure Scan and Azure Monitor overwriting each other’s connection for the same tenant.
- Fixed hover details for deferred and ignored vulnerabilities.
- Fixed the detection Events list not showing source event IDs.
- Fixed the “No Fix Available” reason cell rendering.
- Fixed SaaS Scan vulnerabilities linking to the wrong GitHub URLs.
- Fixed unknown asset types being handled incorrectly.
- Fixed network asset links in vulnerability details.
- Fixed account filters not showing the cloud account’s display name.
- Fixed domain scans merging different virtual hosts that share an IP address.
- Fixed CDN-fronted HTTP exposure findings being rated above informational.
- Fixed Cloudflare-fronted hosts missing a TLS fingerprint.
- Fixed inventory resources and history not returning when a network service reappeared.
- Fixed inconsistent finding status and severity labels and colors.
- Fixed vendor CSV imports failing without a reason.
- Fixed stale vendor identity status after identity syncs and access reviews.
- Fixed HTTPS ports not reporting their product.
- Fixed access reviews needing a separate step to launch.
- Fixed scheduled scans running for deleted organizations.
- Fixed the grouped findings list on dependency vulnerability pages.
- Fixed the command palette crashing on some pages.
- Fixed error toasts dropping the server’s explanation.
- Fixed API callers receiving a page instead of JSON when authentication was required.
- Fixed architecture scans completing with zero resources after a retried result.
- Fixed Slack thread replies not syncing to detections.
- Fixed threat hunting pagination stalling on pages with several sources.
- Fixed typing digits in custom time ranges on Hunts.
- Fixed detection-scoped hunts querying unrelated providers.
- Fixed the Cloudflare field mapping in detection rules.
- Fixed AWS scans being slowed by very large ECR repositories.
- Fixed dropped secrets and vendor noise in cloud secret checks.
- Fixed GCP scans timing out on projects with many BigQuery tables.
- Fixed AWS Inspector2 checks timing out on accounts with large finding backlogs.
- Fixed assets being deleted twice.
- Fixed Google Workspace rule links.
- Fixed scanner descriptions being hard to read in the vulnerability overview.
- Fixed detection rules not updating when data sources change.
- Fixed GitHub app uninstalls happening before an organization deletion finished.
Integrations
Section titled “Integrations”Rippling
Section titled “Rippling”Connect Rippling to provision employees as Fencer accounts, and let people sign in with Rippling when they install from the Rippling App Shop. Each organization can have one Rippling connection, and a new help-center article walks through setup.
Apple Business Manager
Section titled “Apple Business Manager”Sync identities from Apple Business Manager.
Cloudflare and DigitalOcean posture checks
Section titled “Cloudflare and DigitalOcean posture checks”New Cloudflare checks cover TLS, DNS, and zone posture, DigitalOcean coverage is expanded, and you can rename Cloudflare accounts.
Redesigned integration setup
Section titled “Redesigned integration setup”Connect and edit pages for every integration were rebuilt. Setup forms sit beside their instructions, posture detail pages gain a Settings tab, and Google Workspace now flags grants to known-compromised OAuth apps.
Coming Soon
Section titled “Coming Soon”These features are in early access and rolling out soon:
- Customer lookup tables. Upload CSV lookup tables to enrich your SIEM events.
- Check detail pages. A dedicated page for each check, linked from vulnerabilities.
- Onboard GCP by folder. Connect a whole GCP folder at once instead of one project at a time.
- Connect AWS accounts from Organizations. Add every account in your AWS Organization from the management account.
- Assign roles from identity provider groups. Map SCIM and Rippling groups to Fencer roles.
- Fix with Fencer in automations. Open fix pull requests directly from an automation rule.
- GitHub events streaming. Stream GitHub events into your SIEM data.
- Activity leaderboard. See what Fencer has done for you.
Interested in early access to any of these features? Reach out to us and we’ll get you set up.