Developer Roll Up: October 2026

October's releases delivered three big pieces. Email Security became generally available in web app 6.5.0 and got a triage-first console over the next three releases. Grid Sensor 5.4.0 brought application allowlisting to Windows and macOS, with a matching Application Control page in the web app. And creating an organization now starts with the product you came for. Four web app releases (6.5.0 through 6.6.2), four sensor releases (5.3.13 through 5.4.2), and two adapter releases filled in the rest, from new investigation commands to sensors that enroll behind firewalls that route TLS by server name.

Email Security is generally available

Email Security protects Microsoft 365 and Google Workspace mailboxes through the provider's API, so nothing about mail delivery changes. Every message gets an explainable verdict that you can search, investigate, and remediate from the console, and a guided setup takes you from connecting a provider to your first results. Messages, recipient groups, campaigns, and user reports each have a triage view with bulk remediation, and Hunt searches past mail.

The overview now leads with the work that needs an analyst: mail still in inboxes, open user reports, flagged campaigns, and recent suspicious or malicious messages. Summary cards and a full verdict breakdown link straight to the matching messages, and the overview shares the Dashboard's period selector. Mail the provider already filed in its spam folder is hidden by default, with one checkbox to bring it back, and the provider's own junk placement is shown next to the verdict.

Application allowlisting on Windows and macOS

Sensor 5.4.0 can enforce an application control policy, blocking any execution the policy does not allow. A permissive mode reports would-be blocks without enforcing, so a policy can be tuned before it blocks anything. Each block arrives as an event carrying what you need to approve it: file hash, signer, matched rule, parent process, and user. Repeated blocks of the same execution within five minutes fold into one summary event. Naming an updater as a trusted installer lets the software it installs run, so self-updating applications keep working. Users see a desktop notification when one of their executions is blocked.

In the web app, the new Application Control page manages policies and rules in one place. Policies are listed in the order a sensor applies them, a policy fully covered by an earlier one is marked Unreachable, and Application Control works with Git Sync. Sensor 5.4.1 recognizes binaries signed under Microsoft's new Windows Production PCA 2026 authority, so an allowlist that trusts the OS vendor keeps working. Application Control requires the Application Control extension.

Onboarding that starts with the product

Creating an organization now asks what you want to protect: Endpoint, Cloud Security, Email Security, or Code Security. Each choice has its own setup screen, turns on the extensions it needs, and opens that product's setup when the organization is ready. "Just exploring" creates a demo organization.

Cloud Security and vulnerability verification

Sensor coverage now counts only running machines that can run a sensor, so serverless workloads, stopped machines, and Kubernetes clusters whose nodes are already listed stop showing up as gaps. The coverage page shows when the cloud inventory was last collected, has a Re-scan now button, and gives each unmonitored machine a next step and a CSV export. Linux vulnerability views now show distro-verification badges and per-host coverage, and older installed kernel builds are labelled "installed, likely not running". The Risks page gets a filter rail with counts, and GCP and Microsoft 365 setup now list exactly which roles, APIs, and certificates full coverage needs.

Entities, cases, and the rest of the app

Entity pages show when, where, who, and how each activity was observed, and Cloud Security organizations see Entities before connecting a cloud provider. The Sensors list adds a Kind column that separates endpoint agents, browsers, third-party EDR devices, identity and email sources, and cloud feeds. Anyone who can edit cases can now assign them, and a new read-only user.list permission lets a user see who is in an organization. Compliance reports explain why a control is incomplete, the Hive editor renders SOPs and agent prompts as Markdown, and the console offers a System theme, starts faster, and loads the Sensors list faster for large fleets.

Sensor: new commands

cert_store_list lists the certificates in a host's trust stores, with fingerprints and self-signed flags, across Windows, Linux, Java keystores, and macOS keychains. On Windows, crash_dump_info finds kernel crash dumps and names the most likely culprit drivers and their signers. force_sync pushes a configuration change to a host immediately instead of at the next sync, up to five minutes later. Linux module loads are now captured from kernel mapping events, catching short-lived processes at lower I/O cost, and Windows software inventory adds each package's publisher, install location, and uninstall command.

Sensor: enrollment and hardening

The sensor now sends the server name on every cloud connection, so new installs enroll behind firewalls and proxies that route TLS traffic by server name. Its embedded TLS, certificate, and archive libraries were updated for upstream security fixes. The Windows install script now installs the 64-bit sensor when launched from a 32-bit PowerShell, as RMM tools often do. A run of low-memory crashes on Windows is fixed, file_get retrieves files under /proc and /sys that report a size of zero, and the Windows service binary keeps its normal permissions after an upgrade.

Adapters

Adapter logs no longer flood the host when a connection keeps failing: repeats within a minute fold into one line with a count. The Slack, Cato, and Google Cloud Pub/Sub adapters back off up to five minutes after repeated failures, and the Slack, Cato, Okta, Microsoft Defender, Entra ID, and Azure Event Hubs adapters keep their place through retries and paginated results. A legacy Windows build runs the adapter on Windows 7 SP1 and Windows Server 2008 R2, on a best-effort basis.

Full release notes for web app 6.5.0 through 6.6.2 are on Docs, along with sensor releases 5.3.13 through 5.4.2 and adapter releases 1.32.50 and 1.32.51.