Release Notes

2026-10-18

backend v0.1821.0 / frontend v0.1088.0

New features

Forge can list your Strategies, show a Strategy’s stored details, and edit a Strategy from the chat.

Improvements

Forge tells you why a reply ended early when the model declines to answer or reaches its length limit.
Account linking suggests the person whose email address is the account’s first initial and family name, for an admin to confirm.

Bug fixes

Integrations: a sync run that ends early no longer hides earlier failed syncs from automatic recovery.

2026-10-16

backend v0.1816.0 / frontend v0.1084.0

New features

Integrations: an HTTP Event Collector (HEC) finding sink can now pin its collector’s certificate, where you fetch the collector’s chain, choose the keys to pin and confirm them, and Furl then sends nothing to a collector that matches no pin.

Improvements

Strategies: winget is no longer chosen for Windows programs installed per user, installed as MSIX packages, or hidden from the uninstall list. winget cannot see those installs, so each one shows the reason it was ruled out.
Verification decides Windows fixes that leave an old version’s uninstall entry behind by reading the installed binary, so a stale entry no longer marks a successful fix as failed.
Settings combines Endpoint Tags and People Tags into one Tagging tab. Old links redirect to it.
Furl keeps retrying background work through a service outage of up to an hour, where it used to give up after about two minutes.

Bug fixes

Targets: a target stuck in validating because its paused run could never resume is now released and runs again.
Forge keeps the assistant’s reasoning and tool error states when a conversation resumes after an approval.
Forge: a script’s classification tags, such as destructive or reversible, stay on the script after you allow or deny it, after a reload, and when it ran without an approval prompt.
Integrations: Tenable imports with many findings per asset are processed in smaller pages, so a large export no longer stalls the import.
Endpoints: Furl ranks an endpoint’s owner once from all of its accounts, including accounts the Furl agent reports, and every view of the owner uses that one result.
Portal: an admin viewing a person’s portal now sees and changes that person’s Remediation Autonomy setting instead of getting an error or changing their own.
Memory: a memory added by hand now saves, and a failed save shows an error and keeps your text in the dialog.
Checks: a check run no longer stays running for good when one endpoint’s result fails to save, which had blocked every later run of that check.
Feed: a disclosure whose package is no longer on any endpoint offers no Investigate action and says why, instead of offering an investigation that would be refused.
Remediations: verification compares the version installed after a fix with the version Furl detected on the endpoint before it, not the version the scanner reported.
Targets: findings from scanners that list the host’s operating system ahead of the package now land on the affected application’s target, so one target no longer collects findings for unrelated packages.
Targets: a deferral made while Furl merges two duplicate targets now stays with the target that remains.
Integrations: SentinelOne’s Debian and Ubuntu package names are split into the package and its version instead of being filed under the maintainer’s email address.

2026-10-14

backend v0.1773.0 / frontend v0.1068.0

New features

Integrations: send finding events to an HTTP Event Collector (HEC) endpoint as a finding sink, send a test event to check the connection, and see each sink’s delivery health in Settings.
Endpoints: an Owner column shows who owns each endpoint, and you can search endpoints by owner.
Scopes: filter remediation scopes by the endpoint owner’s people tags.
Scopes: filter by target type to build a patch scope.

Improvements

Scopes: remediation scope target tables show each endpoint’s owner.
Scopes: the scope preview names any existing scopes that a new scope overlaps.
Integrations: People tag import is now a checkbox next to Primary Source.

Bug fixes

Endpoints: the endpoint owner is chosen by the strength of the evidence, not by an arbitrary order.
Forge: a scope that Forge creates now includes matching targets that already exist.
Patch targets are grouped by OS family, which fixes how OS versions were combined.

2026-10-12

backend v0.1758.0 / frontend v0.1059.0

New features

Strategies: admins can turn on auto-apply for a mitigation once its efficacy clears the threshold, so its runs skip the approval gates until its content changes.
Strategies: each mitigation now shows its active state and its efficacy, the share of mitigations whose first drift check found the control in place. Rollout rings read the same figure.
Notifications: admins hear when the feed opens an investigation on its own, and channels hear when a person opens one from the feed.

Improvements

People: filter people by tag from the Tags column header.
Strategies: winget strategies fail preflight when winget cannot see the installed package, instead of reporting a failed upgrade.
Strategies: a revert that is verifying now reads Verifying, not Running or Failed.

Bug fixes

Strategies: a mitigation whose strategy was deleted can now be reverted from its endpoints.
Endpoints: local macOS and Linux accounts now link to the matching directory person, so owner messages, the portal and owner approvals reach a real person.
Strategies: approval requests and runs left stuck by a retired approval path are closed as rejected, and their open notifications resolve.

2026-10-09

backend v0.1738.0 / frontend v0.1049.0

New features

People: tag people to group them, one at a time or in bulk from the People page.
Integrations: Okta and Google Workspace can import each user’s department and org unit as people tags, toggled per datasource.
Notifications: owner messages can reach all endpoint owners, chosen people, or everyone with a chosen people tag.
Rollouts verify each patch install on the machine after its reboot, and ring gates count verified machines against the ring’s full population.
The rollout view shows where the active ring’s targets stand and why a gate is waiting.

Improvements

Notifications: the owner message template now lives under Settings → Notifications.
Endpoints: tags are now called Endpoint tags throughout the app, and the empty state names the tag policies that would populate them.
Scopes: the new and edit scope pages load faster.
Strategy efficacy rates include verdicts from automatic post-install verification, not only verdicts recorded by hand.
The public API reference groups its endpoints by area.

Bug fixes

Endpoints: agent configuration rejects invalid tag names before they are saved.
Endpoints: old dynamic tag links redirect correctly when the tag name contains special characters.
Endpoints: the error for deleting an imported tag points to the Import endpoint tags setting that controls it.
Forge shows its thinking summaries between tool calls.
Vulnerability matching checks npm advisory version ranges in npm’s own version order.
Software identifiers are written in one consistent form, so two products no longer share each other’s CVEs.
A patch scan that skips an update keeps that update’s stored record.
The Dashboard summary returns within a bounded time instead of hanging on large organizations.

2026-10-07

backend v0.1705.0 / frontend v0.1036.0

New features

Forge sessions can be exported to PDF.

Improvements

Remediations explain winget download failures caused by an untrusted certificate authority (error 0x80072f0d).
People: the endpoints filter toggle now reads “Only show people with endpoints”.

Bug fixes

Strategies: Windows applications installed for a single user no longer get a winget or Chocolatey upgrade that cannot see them. Furl falls back to the vendor installer instead.
Settings: only organization admins can create and manage API keys.
Endpoint owners stay current on every sync, so owner filters, owner notifications and People endpoint counts include owners resolved after the endpoint last changed.
People: device logins in DOMAIN\user form match the right person.
Targets: InsightVM software reported through registry-key or install-path proofs is classified as software, and duplicate targets for the same install merge into one.

2026-10-06

backend v0.1685.0 / frontend v0.1024.0

Improvements

People: confirmed and automatic account matches decide who owns each account. An account with only tied or possible matches has no owner until someone reviews it on the People page.

2026-10-05

backend v0.1677.0 / frontend v0.1018.0

New features

People: review and decide account matches. Accounts the matcher could not link with certainty queue up on the People page, where you confirm or reject each suggested person, or confirm all probable matches at once.
People: user accounts now match people by email alias, and an email match outranks a username match.
Settings > Feed: each organization has a daily model-spend limit for the advisory feed, with a Furl-provided default and the current limit shown on the page.
Patch rings: a ring rollout freezes the policy’s rings when it starts, so editing the policy never changes a rollout in progress, and each machine keeps its ring for the whole rollout.
Patch rings: one policy can mix hand-picked tag rings with percentage rings, and an organization can set a default patch policy.

Improvements

Feed pages are shown based on each organization’s own feed settings instead of a global switch. Settings > Feed stays available to turn matching on.
Slack handles stay in step with account links, and Slack guest accounts are no longer matched to people.

Bug fixes

People: people created from built-in operating-system accounts such as Administrator, Guest and SYSTEM are removed and no longer created.
Integrations: the Microsoft Defender export fails clearly on a record with no identity and renews an expired token before the export call instead of failing the run.
Patch rings: a tag ring with no tags now takes only the machines no earlier ring already took, instead of every machine in the scope.

2026-10-02

backend v0.1661.0 / frontend v0.1010.0

Improvements

Targets: Reporting a passing verification now asks whether the fix landed or there was nothing to fix, so a target that never needed a change is no longer counted as remediated.

Bug fixes

Targets: An apt update for a package already at the newest available build now stops before it runs and shows No Fix Available with the installed and candidate builds, instead of running and failing verification. Retry checks it again.
Targets: Debian and Ubuntu endpoints running a backported build newer than the finding’s version are resolved during validation instead of receiving an upgrade with nothing to install.

2026-10-01

backend v0.1647.0 / frontend v0.1006.0

Improvements

Scopes: the Ticketing Integration section always appears on the create and edit scope forms, and explains what to do when a ticket cannot be linked.

Bug fixes

Manual strategies no longer sit forever waiting for an approval they can never receive. They wait in their own state until someone does the work, and admins press Check now to verify the endpoint.
Manual strategies no longer offer Override and escalation actions that could not run.
Forge: a deleted session no longer resumes when an endpoint result arrives.

2026-09-30

backend v0.1629.0 / frontend v0.999.0

Improvements

Settings > Feed describes each investigation option by what it runs on endpoints, so it is clear which queries, checks and scripts wait for a person.

Bug fixes

Microsoft Defender imports for large organizations finish in one refresh instead of failing on Defender’s hourly API limit.
A data source refresh interrupted by a server restart resumes on its own instead of timing out.

2026-09-29

backend v0.1625.0 / frontend v0.996.0

New features

Notifications: Owner Messages send endpoint owners one Slack direct message listing their open asks. The message goes at most hourly when new asks arrive and daily as a reminder. Set it up on the new Owner Messages card in Settings > Notifications.
Time to Remediate appears on the Targets and Findings tables, as aggregates on the Findings page and in scope metrics, and as a mean time to remediate card on the dashboard.
Endpoints rows have an Explore with Forge button that opens Forge scoped to that endpoint.

Improvements

Targets: the uncovered targets count loads faster and no longer holds up the rest of the page.

Bug fixes

Microsoft Defender syncs wait out Defender’s per-minute rate limit and retry instead of failing part of the import.
Findings: local vulnerability matching no longer reports CVEs that apply only to another operating system, and it checks a product name against the vulnerability dictionary before trusting it.
Windows programs are identified more reliably by publisher, known aliases and versions embedded in the program name.
Remediation preflight recognizes package manager aliases and trusts the context a strategy provides, so fewer valid remediations are held back.
Forge keeps following a turn on the Forge page after it dispatches work to an endpoint.
Radio buttons are visible in light mode.

2026-09-28

backend v0.1611.0 / frontend v0.987.0

New features

Dynamic tag rules can match on when an endpoint was last seen, so endpoints that have gone quiet can be tagged automatically.

Improvements

Running an integration action now requires permission to manage integrations.
Changing an endpoint’s package-manager capabilities now requires permission to manage endpoints.

Bug fixes

Findings: vulnerabilities found by the Furl scanner carry the same software as their target, so they group and filter by software correctly.
Scans of endpoints with many matches are processed in smaller pages and complete reliably.

2026-09-27

backend v0.1601.0 / frontend v0.983.0

New features

Notifications can be delivered to chat. Admins subscribe notification types to a Slack channel or to each person’s direct messages from a single Notifications settings page that also covers desktop notifications.
Notifications carry their own actions. Approve, defer, open, acknowledge or dismiss from the bell, mark items read one at a time, and see a notification resolve on its own once its request is handled elsewhere.
The People page shows who is being asked to act and who has answered. Opening a person shows their full notification history.
Scopes can filter endpoints by when they were last seen, and membership updates as endpoints go quiet.
Endpoints: Windows endpoints report how often osquery has restarted, so a crash loop is visible from the endpoint view.

Improvements

Approval requests get an escalation deadline. Admins hear when an owner lets requests lapse, and deferred requests are no longer re-sent.
Desktop notifications are capped per person so a busy day does not flood anyone’s screen.
Operator notices go to organization admins rather than every user.
Reminders and the portal name the software the request is about.
Targets: a confirmed-not-valid ruling is shown on the target, with guidance for the required reason.

Bug fixes

Links in notifications open pages that exist.
Older notifications in the bell can be read and dismissed instead of keeping the badge lit.
Integrations: Qualys, Rapid7, SentinelOne and Apple Business Manager syncs page through large accounts reliably and resume where they stopped.
Strategy generation always produces at least one strategy for a subject.
Uncovered targets with no product name are named from their software instead of showing blank.
Vulnerability definitions with a malformed CPE still import, without that CPE.
AnyDesk versions are recorded correctly when the release channel prefixes the version.

2026-09-25

backend v0.1588.0 / frontend v0.978.0

New features

Endpoints: an endpoint that no source has seen within the organization’s staleness window, 30 days by default, is marked stale and leaves the active count. Organizations can opt in to automatic cleanup of stale endpoints.
Endpoints: organizations can opt in to unenrolling agents that have been silent longer than a set window, from 7 to 365 days. An unenrolled agent that comes back online re-enrolls on its own.

Improvements

Microsoft Defender operating system vulnerabilities now produce OS patch targets.
Time-to-remediate leaves out the time an endpoint was offline.

Bug fixes

Microsoft Defender syncs no longer fail with a rejected credential partway through a long import.
Endpoints: a machine that a scanner saw before its agent enrolled no longer appears as two endpoints.
Scopes: membership based on EPSS thresholds updates on every sync, including scope edits saved while a sync was running.
Forge: Rename is hidden on sessions the feed opened, and a refused rename now tells you why.
Forge: error events that the page used to drop now appear, and Stop reliably shows its notice.

2026-09-24

backend v0.1567.0 / frontend v0.970.0

New features

Findings can be filtered by EPSS score and EPSS percentile, and sorted by EPSS score, to rank vulnerabilities by their likelihood of exploitation.

2026-09-23

backend v0.1560.0 / frontend v0.968.0

New features

Feed opens a disclosure in a side pane beside the queue, so you can compare rows without leaving the list. Each row shows an Affected versions badge, and each scope explains what it means on hover.
Scopes: EPSS score is now a scope criterion, so a scope can target findings by their likelihood of exploitation.

Improvements

Integrations: Automox sync failures show the response status and the underlying cause.

Bug fixes

Findings: CVE matching is correct for vendor and product names that contain escaped characters.
Integrations: Rapid7 data warehouse connections no longer send a client certificate to the customer’s database server.

2026-09-22

backend v0.1550.0 / frontend v0.965.0

New features

Endpoints: Windows endpoints report installed and missing updates collected from the Windows Update Agent.

Improvements

Scheduled checks are spread across their interval instead of all running at the same moment each day.

Bug fixes

Targets: findings on existing targets stay linked when a new vulnerability is matched to a target that has not otherwise changed.
Findings: products whose names contain special characters, such as Notepad++, match vulnerabilities consistently.
Checks: scheduled check runs record their findings and resolved findings correctly.
Settings: removing a time window from an autonomy rule saves successfully.
Integrations: Automox actions that cannot run are no longer offered.

2026-09-21

backend v0.1538.0 / frontend v0.964.0

New features

Targets: a Highest EPSS Score column shows how likely a target’s vulnerabilities are to be exploited, with sorting, filtering and CSV export.

Improvements

Time to remediate now excludes the time an endpoint spent offline, so endpoint downtime no longer reads as remediation latency.
Targets: a remediation halted on a version mismatch resolves itself once the endpoint has moved past that version.
Endpoints: a check run retires the results it stops detecting, and reopens them when it detects them again.
Forge: a strategy created in Forge takes precedence over the catalog fallback.

Bug fixes

Endpoints: the preflight verdict now explains its reasoning when no probe failed.
Endpoints: a pending-reboot warning is advisory in the preflight verdict rather than a failure.
Endpoints: reportable network interfaces are chosen by interface rather than by MAC address class, so physical and virtual adapters report correctly.
Endpoints: Docker Desktop on macOS is identified as Docker Desktop rather than Docker Engine.
Targets: a target the pipeline has already resolved is shown as finished.
Targets: verification is judged the same way whether the probe ran on the synchronous or the asynchronous path.
Targets: a pipeline completion is attributed to the job it was waiting on before it counts toward the run.

2026-09-17

backend v0.1516.0 / frontend v0.957.0

Improvements

Forge asks for approval before running osquery queries or saving insights, unless your autonomy settings are at the most permissive tier.

Bug fixes

Forge evaluates autonomy rules against every endpoint a script would reach instead of a single representative host. Blocked endpoints are skipped and reported with the rule that blocked them, and the approval card lists the exact endpoints the script will run on.
Forge approval cards for saved insights now show the content being approved, and cards display their endpoint list immediately instead of after a delay.

2026-09-16

backend v0.1514.0 / frontend v0.956.0

New features

Endpoints are rescanned for vulnerabilities shortly after an agent reports that installed software changed, instead of waiting for the next scheduled scan. Scans triggered this way are labelled as an inventory change in the datasource run history.
Every check declares a finding type: vulnerability, compliance, deprecation, indicator, licensing or standardization. The Checks page shows the type and lets you set it when editing a check, and Findings can be filtered by it.
Forge classifies the finding type when it drafts a check and asks before proceeding when it cannot. The approval card shows the finding type and the CVEs the check claims to detect.

Improvements

Check results are recorded as findings and appear in the knowledge graph, and remediation targets are derived from those findings.
Enrolling an endpoint no longer waits on an organization-wide inventory sync, so enrollment completes faster on large fleets.

Bug fixes

Strategy selection is deterministic when several strategies score equally, so a target picks the same strategy on every evaluation.

2026-09-14

backend v0.1499.0 / frontend v0.953.0

New features

Endpoints now inventory VS Code and browser extensions per user, so extensions show up alongside installed software.

Improvements

Forge session timelines now show one span per tool call, record the wait for a human approval as its own segment, and close out spans left open when a turn is stopped.
Forge session history loads faster.
A datasource refresh is marked complete only once its entity sync has landed the data.
Ring policies save in a single transaction, so an interrupted save can no longer leave a policy half-applied.
Findings that match no known product no longer re-enter the calculation retry loop.

Bug fixes

Product identification retries a lookup with punctuation stripped when no vendor is known, so more installed software resolves to a known product.
Targets: CrowdStrike Spotlight findings now mint targets, because their proof text is parsed for the product it names.
Integrations: a CrowdStrike Spotlight sync restarts its walk when the search context expires, instead of stopping partway through.
Forge check and strategy names render special characters correctly instead of showing raw HTML entities.
Forge binds a strategy to the subject type of the product’s own check, so a strategy can no longer attach to the wrong kind of subject.
Strategies that do not name a package manager no longer offer the package-manager condition.
A refresh stranded by a retired connector is recorded as failed instead of sitting queued indefinitely.
Ownership no longer collects every unnamed account onto a single person.
Forge: lengthy probe output stays inside its panel instead of overflowing the layout.

2026-09-11

backend v0.1463.0

Improvements

SentinelOne: application risk syncs now read the full risks listing, so large fleets are no longer cut off at the export limit.
Integrations: a datasource refresh that was deferred for recency now repairs a bounded amount of data per run, keeping sync times predictable.

Bug fixes

Targets: software whose name repeats its vendor is identified correctly, so its vulnerabilities now match.
Findings: calendar-versioned software matches its catalog entry, so its vulnerabilities are reported instead of being skipped.
Findings: a vulnerability that arrives without a severity score takes one from Furl’s CVE data, so severity is no longer blank.

2026-09-10

backend v0.1457.0 / frontend v0.949.0

Improvements

Settings, Autonomy: remediation controls and response controls now sit under separate headings, with blackout windows grouped alongside the remediation controls.

Bug fixes

Targets: a CVSS score bound now includes a target scored exactly at the bound. A bound of 9.8 could previously exclude a target whose highest finding scored 9.8, because the score was carried with a small rounding error. Whole-number bounds were not affected. This covers the Targets filters, the Targets CSV export, and scopes that set a CVSS bound.
Public API: closed is now the documented status for a resolved finding, and filtering findings by status returns the matching findings instead of none. remediated continues to work as a deprecated filter value and will be removed in a future version.

2026-09-09

backend v0.1448.0 / frontend v0.946.0

New features

Scopes: a scope pinned to a vendor now covers every product from that vendor, resolved through the subject alias registry so alternate vendor spellings are included.

Improvements

Integrations: Vanta findings carry the fix version from the CVE-to-product applicability data.

Bug fixes

Vanta sync reports the fix version that actually covers the installed version of the affected software.
Endpoints: a matched Furl endpoint now adopts a hostname it had never reported instead of leaving the record blank.
Endpoints: agent update rings compare the agent’s reported version rather than its build stamp, so agents on the same version no longer appear out of date.
Findings: CVE version ranges are compared only when both versions share a comparable format, removing false matches between mixed version schemes.
Forge: phone-width viewports can start a Forge session on the new Forge page.

2026-09-07

backend v0.1431.0 / frontend v0.942.0

New features

Scopes select software by subject instead of by typed product and vendor names. The scope builder offers a subject picker, existing scopes were converted to their matching subjects, and the scope target list and export gain subject and vendor facet filters. A filter value that named no catalog subject was dropped in the conversion, so review any scope whose target count changed.
Scopes accept dependency as a subject type, so a scope can target package dependencies alongside software, services, and configuration.

Improvements

Targets bind to a subject through curated vendor aliases as well as the canonical vendor name, so more discovered software becomes remediable.

Bug fixes

Public API: the scope subject_filter object replaces the products and vendors lists with subject_ids. Requests that still send the retired keys receive a 400 response with an explicit error instead of creating a scope that matches everything.

2026-09-04

backend v0.1425.0 / frontend v0.940.0

New features

Checks: each scheduled check shows its next run time, in the Checks table and in the check detail sheet.
Endpoints: an agent update now reports its result against the job that requested it. A completed or failed update is visible in the job history, rather than inferred from the agent’s version after the fact.
Targets: findings against an operating-system build now register as OS patch targets, so operating-system updates get their own target type instead of folding into software targets.
Targets: a configuration covered by an active hold is tracked as a held configuration target, and remediation respects the hold until it is released.

Improvements

Findings: correlation scores a match against its strongest evidence tier rather than the union of every tier, which sharpens matching precision.
Endpoints: software scans page by inventory rows rather than endpoint count, keeping scan processing steady for endpoints with very large software inventories.
Integrations: removing a datasource refreshes only the rollups that datasource backed, not every rollup in the organization.

Bug fixes

Integrations: Qualys syncs read the API’s rate-limit signal and pace themselves within the remaining budget, instead of failing partway through a throttled run.
Endpoints: host details containing NUL characters no longer fail to store.
Remediation: a long-running script resumes from its in-flight checkpoint again. A recent parameter-validation change made a resuming script start over from the beginning.

2026-09-02

backend v0.1400.0 / frontend v0.937.0

Improvements

Integrations: the run history for a datasource now shows a refresh from the moment it is queued. Previously, there would be a short delay before the refresh would appear in the UI. The history now stays on screen while a new refresh is being requested. A queued refresh that no worker will claim is settled and reported as failed, rather than sitting queued indefinitely.
Forge: a script classified as destructive, process-disrupting, affecting other users, requiring elevated privilege, or requiring a reboot now always raises an approval prompt by default (configurable by admins). A session running on full autonomy previously ran such a script without asking. An individual session can gate more classifications, never fewer.

Bug fixes

Endpoints: filtering by a tag now returns every endpoint carrying that tag. The filter previously applied only to the page of results already loaded, so the table showed just the tagged endpoints that landed on that page and reported that partial count as the total. Exports were affected the same way.
Integrations: a Qualys check carrying only a CVSS v2 score now takes its severity from that score. Furl read the v3 score alone, so Qualys-authored severity 4 and 5 checks with no v3 element rendered as informational. Weak ciphers, default credentials, and expired certificates were all affected.
Targets: the Start Time and Finished columns now render reliably. Both cells phrased their timestamps against the server’s clock and timezone rather than the reader’s, which made the browser discard the initial render of the page.

2026-09-01

backend v0.1388.0 / frontend v0.931.0

New features

Endpoints and Integrations: tags an integration reports on your endpoints can now be imported into Furl. Turn on Import tags on the integration’s detail page and those tags appear on the Endpoints page alongside your own, marked as imported and labelled with the sources reporting each one. Import is off by default, because some sources carry thousands of asset labels. Turning it off again removes the tags that integration was backing. A tag whose last reporting integration is gone is flagged as safe to delete.

Bug fixes

Targets: an installed application that Furl had been tracking under more than one target now shows a single target. Scans identifying the same install by different keys could create duplicates, and those duplicates could never close on their own. Findings, deferrals, and remediation history move onto the surviving target, and the retired duplicates are not counted as remediations.

2026-08-28

backend v0.1382.0 / frontend v0.930.0

New features

Remediation now checks that an endpoint’s agent is online before it dispatches work. A target on an offline endpoint reports “Endpoint Offline” right away and re-runs automatically once the agent checks back in. It previously sat in “Validating…” for up to an hour before timing out.

Improvements

Asset correlation now requires a minimum confidence before it merges two records into one identity, so a weak match no longer collapses distinct assets together.

Bug fixes

Targets: macOS software names no longer carry a .app or .pkg suffix, so the same application no longer appears under two names.
Endpoints: recovery for an endpoint whose data collection has stalled now runs. Every attempt previously failed, leaving the endpoint stalled indefinitely.
Integrations: a Rapid7 sync now handles incomplete solution data instead of failing the sync.
Integrations: creating a ticket through a ticketing provider that has no project concept now succeeds.

2026-08-27

backend v0.1371.0 / frontend v0.928.0

New features

Endpoints: an endpoint that no source reports any more is now labelled as such in the Source column. It previously showed an em dash for the day or more before retirement, which read as missing data rather than a lifecycle state.

Improvements

Findings and Endpoints: the endpoint filter dropdowns now search as you type instead of loading the whole fleet up front. On a large fleet this was the slowest part of the Findings page load.
Strategies and Settings: dates on these pages now display in a consistent format, and date columns can be filtered by range.
Findings: On large fleets, findings and targets settle noticeably sooner after new scan data lands.

Bug fixes

Integrations: a Vanta sync now refreshes its access token when it rotates, instead of failing with an authorization error until the integration was reconnected.
Targets: invalid software catalog entries and their corresponding remediation targets have been removed.
Remediations: deployment output display was cleaned up.

2026-08-26

backend v0.1356.0 / frontend v0.921.0

Improvements

Software calculation: software records orphaned by a large integration refresh are now retired in one pass instead of across many sync cycles, so a large refresh settles sooner.
Knowledge graph: an asset with no hostname is now labelled by its computer name or serial number instead of rendering without a title.

Bug fixes

Sign-in: starting sign-in from your identity provider now signs you in. First-time users were previously stranded on the sign-in form.
Integrations: an Apple Business Manager device whose detail lookup fails is now imported with the data Apple did return. Previously one failing device blocked the whole sync, so no Apple data landed.
Integrations: Apple Business Manager MAC addresses are now stored lowercase and colon-separated like every other source, so a fleet no longer shows two formats.
Integrations: Apple Business Manager’s friendly device name is now recorded as the computer name rather than the hostname, so it no longer takes part in hostname matching.

2026-08-24

backend v0.1349.0 / frontend v0.918.0

Improvements

Endpoint correlation, asset retirement, and the datasource refresh pipeline are significantly faster, so integration syncs finish sooner.
Targets: the columns dropdown is now sorted alphabetically.

Bug fixes

Endpoints: machines that share a generic hostname are no longer merged into one endpoint. An asset whose hardware UUID or cloud instance ID proves it is a different machine now correlates to its own endpoint. Accounts affected by this, most commonly by the default EC2AMAZ- name on un-sysprepped Windows instances in AWS, will see those assets separate onto their own endpoints on the next refresh.
Integrations: a Qualys asset that reports no serial number no longer records an empty one.
Integrations: a transient enrichment failure during a sync now fails only the page it occurred on, leaving the asset’s identity data intact.
Forge: a session interrupted mid-run resumes with the inputs it started with instead of re-deriving them.

2026-08-23

backend v0.1340.0 / frontend v0.917.0

Bug fixes

Endpoints: sorting the table by MAC address now orders addresses correctly.
Integrations: refreshing a datasource that is already refreshing no longer starts a second run alongside the first.
Integrations: a refresh cut short by a service restart is now closed out in the datasource’s execution history, instead of sitting there as running with no results.

2026-08-22

backend v0.1336.0 / frontend v0.916.0

Improvements

Scans and data refresh are substantially faster. Software calculation and the refresh pipeline now run sharded and incremental, skipping work for assets that have not changed, so new findings surface sooner after an integration syncs.
Endpoints: an enrolled agent keeps its endpoint’s OS version current from live telemetry rather than only at enrollment.
Integrations: Rapid7 InsightVM and Qualys imports are faster and no longer risk truncating a large asset or detection set.
Findings: CVE details, CVSS scores, exploit maturity, and CISA Known Exploited Vulnerability status are now served from Furl’s own daily copy of the vulnerability data rather than looked up per request, so enrichment is faster and keeps working through an upstream vendor outage.
Deploys and restarts now drain in-flight work before shutting down, so a release no longer interrupts a scan or an integration sync in progress.

Bug fixes

A vendor that returns an incomplete response no longer causes assets to be marked absent and removed. An asset must be missing from two consecutive refreshes before it is retired.
Integration syncs no longer stall or fail partway through a large paged import.
Findings now pick up corrections to CVE data reliably, instead of occasionally missing a change.
Findings that missed a scoring pass are now reconciled on the next cycle rather than staying stale, and that reconciliation now completes quickly on large accounts instead of running for hours.
Forge: opening a session that has been deleted returns a clear not-found result instead of hanging.
Software and vulnerability calculation now completes on accounts with very large finding backlogs. It previously ran out of memory and failed the pass on backlogs in the millions.
Integrations: adding a datasource no longer fails when one of its checkbox settings is left unchecked.

2026-08-19

backend v0.1296.0 / frontend v0.915.0

Improvements

Endpoints: when two candidate endpoints match an asset equally well, correlation now attaches it to the one backed by an enrolled agent, so third-party asset data lands on the machine Furl can actually remediate.
Endpoints: CrowdStrike device MAC addresses now carry onto the asset record, giving correlation another signal to match on.
Findings: the +N source badge on a finding’s source list renders as a circle, matching the individual source badges beside it.

Bug fixes

Endpoints: assets with no hostname, serial number, or MAC address no longer collapse into one shared endpoint. They stay uncorrelated until they carry an identifying signal.
Endpoints: hostnames that differ only in capitalization now resolve to a single endpoint instead of separate case-variant records.
Deleting an endpoint now unenrolls its agent instead of leaving it enrolled against a removed endpoint.

2026-08-18

backend v0.1287.0

Bug fixes

Fixed a database maintenance regression from the earlier deploy today that could cause intermittently slow page loads.

2026-08-18

backend v0.1286.0 / frontend v0.914.0

New features

Integrations: Apple Business Manager. Connect with an API account to import your Apple device inventory and Managed Apple Account directory, with each device attributed to the person enrolled on it. It can also serve as the primary source of people in your organization.

Improvements

Targets: approving a software recognition rule now replays the findings that prompted it, so newly recognized software becomes remediable without waiting for the next scan.
Findings: CVE affected-version data refreshes daily, so upstream corrections to version ranges reach your findings within a day instead of a month.

Bug fixes

Dashboard: newly created organizations show the real count of known CVEs instead of zero.
Findings: source badge logos are cropped to the badge circle rather than overflowing it.

2026-08-17

backend v0.1279.0 / frontend v0.913.0

New features

Remediation: strategies now prefer the package manager that owns the installed software, so Chocolatey-managed installs on Windows are remediated through Chocolatey rather than a generic installer.

Improvements

Endpoints: Chocolatey detection on Windows is more reliable — it keys off the presence of choco.exe and resolves non-standard install roots from the registry, improving software inventory accuracy.

Bug fixes

Targets: endpoints reported only by integrations, without agent inventory, are now included in reconciliation, so their targets stay current and close when resolved.
Findings: findings are never created with a blank title.

2026-08-15

backend v0.1269.0 / frontend v0.912.0

New features

Settings: a new organization setting turns off desktop notifications on endpoints. Pending approvals stay visible and actionable in the portal.
Scopes: remediation now honors blackout windows. Work scheduled inside a blackout is held rather than run, and each held item shows the reason it was blocked. Blackout times follow the time zone stated in Settings.

Improvements

Targets: a target closes on its own once every finding behind it has retired, so resolved work leaves the queue without manual cleanup.
Findings: the Furl scanner pages through endpoints as it reports, so large environments finish a scan reliably.
Findings: finding ingestion skips writes when nothing changed, cutting database load during large refreshes.

Bug fixes

Targets: Debian and Ubuntu software discovered by the Furl scanner now forms remediation targets that apt can act on.
Findings: the Furl scanner no longer retires vulnerability findings that belong to another source.
Targets: probe details no longer show a validation reason made up only of punctuation.
Scopes: date columns in scope tables no longer break on first render.

2026-08-14

backend v0.1246.0 / frontend v0.904.0

New features

Strategies: strategy cards now show your own organization’s execution counts and success rate, rather than counts shipped with the strategy library.

Improvements

Integrations: Tenable.io, Microsoft Defender, Qualys, Rapid7 InsightVM, Nucleus, and Vanta refreshes now ingest page by page, completing faster and more reliably on large datasets.

Bug fixes

Integrations: Qualys and Rapid7 InsightVM refreshes no longer stop short on large result sets, so findings that were previously missed are now ingested.
Integrations: Microsoft Defender refreshes no longer fetch the same page twice, cutting refresh time and log volume.
Targets: targets created under an older identity scheme are retired automatically, clearing duplicate entries from the Targets list.
Endpoints: agents too old to update themselves are no longer offered an auto-update they cannot apply.
Endpoints: context graph controls stay inside the viewport instead of drifting off screen.

2026-08-13

backend v0.1239.0

New features

Targets: failed targets in an activated scope are retried automatically under a capped, windowed threshold, so transient failures recover without a manual retry click.
Targets: historical version-conflict findings now appear as Needs Review with their version evidence and rulings, instead of resting as plain failures.

Improvements

Integrations: Rapid7 InsightVM and CrowdStrike Spotlight refreshes now ingest page by page, completing faster and more reliably on large datasets.
Integrations: Qualys now recognizes Linux operating systems it previously could not fingerprint.
Endpoints: agents can recover a wedged on-host scanner automatically when they check in.

Bug fixes

Forge: approving a remediation on a long-idle session no longer risks the approval being dropped.
Strategies: generated remediation strategies are validated more robustly, preventing malformed output from failing strategy creation.
Endpoints: agent version pinning now respects per-platform version availability when the platforms differ.

2026-08-12

backend v0.1225.0 / frontend v0.900.0

New features

Targets: needs-review targets can now be explained and acted on directly — Furl explains why the target needs review and offers the actions to resolve it.
Endpoints: endpoints from different sources now also correlate by MAC address and by fully qualified domain name in both directions, improving how multi-source assets unify into a single endpoint.

Improvements

Endpoints: correlation now considers every physical network adapter MAC address, so sources that observe different adapters on the same machine unify into one endpoint instead of creating duplicates.
Integrations: Nucleus assets now use their real hostnames and strong identifiers such as EC2 instance IDs and SentinelOne serial numbers, improving how they correlate with endpoints from other sources.
Integrations: data source refreshes are faster and complete more reliably on large datasets.
Findings: the Furl scanner now detects CVEs for software versions not yet catalogued in the vulnerability database, using verified attribution from neighboring catalogued versions.
Findings: finding titles from the Furl scanner now follow the same style as vendor-reported findings.

Bug fixes

Endpoints: an endpoint’s primary network interface is now detected reliably, so endpoints no longer appear without their main MAC address and IP.
Findings: Nucleus findings now include the vendor’s recommended solution, and no longer show a CVSS score derived from the severity label when the scanner did not report one.
Endpoints: software removed from an endpoint is now reconciled promptly and no longer lingers in the software inventory.
Strategies: a check can now be deleted even after it has been used by a remediation pipeline, and a failed deletion shows an error message instead of failing silently.
Targets: viewing probe details on a remediated SMB target no longer crashes the page.

2026-08-10

backend v0.1207.0 / frontend v0.895.0

New features

Findings: each finding now links to its Context Graph node, so you can jump straight from a finding to the asset relationships behind it.
Targets: a software version conflict detected during validation now lands the target in its own “Needs review” status — with the validation verdict shown — instead of being marked failed alongside genuine errors.

Improvements

Integrations: the Google Admin integration is now called Google Workspace, matching the product it connects to.

Bug fixes

Findings: CVE severity scores are more accurate. Furl now prefers the official NVD score when a CVE record carries more than one, falls back across CVSS versions when the latest isn’t available, and no longer creates blank findings from non-CVE placeholder identifiers.
Findings: vulnerability findings from a removed integration no longer linger — deleting an integration recomputes the affected findings, and deduplication considers all active sources rather than only recently updated ones.
Findings: the finding drawer’s target link now lands on the Targets page filtered to that target.
Targets: the State filter can be cleared again.
Tables: changing filters in quick succession no longer drops one of the changes.

2026-08-07

backend v0.1198.0 / frontend v0.887.0

New features

Scopes: endpoints can now be filtered by the integrations that manage them. “Managed By” narrows a scope to endpoints managed by the integrations you choose, and “Not Managed By” excludes endpoints managed by others — so a scope can target, for example, endpoints managed by CrowdStrike but not by Automox.
Targets: the Targets table can now be filtered by scope.
Targets: when an endpoint’s OS inventory and its on-disk binaries disagree about a software version (for example, two versions of the same product installed side by side), validation now surfaces the conflict as “Needs review” with the option to continue anyway, instead of reporting a generic validation failure.

Improvements

Integrations: disabling the furl scanner integration now immediately removes its imported data.

Bug fixes

Findings: a finding that was resolved reopens automatically when a scanner observes it again.
Targets: verdict overrides can no longer be applied while a target’s remediation pipeline is still in progress.
Remediation preflight checks: a check whose endpoint query never returned no longer counts as a pass. Package-held, pending-reboot (Linux and Windows), runtime version pin, and runtime version manager checks now report a failure with the reason, so remediation stops instead of proceeding on a check that was never performed.
Manual strategies: approving a manual strategy now hands its steps to the endpoint owner, instead of failing with a “no script template” error.
Windows: winget is now found reliably on endpoints where the agent runs as a system service, so winget strategies are no longer skipped as unavailable — previously an endpoint could report winget unusable for up to 24 hours despite having it installed.
Windows: winget upgrades now resolve against the winget source rather than the Microsoft Store, so they no longer fail on Store certificate errors or agreement prompts.
Endpoint queries that fail to record their results now settle as failed with a reason instead of reporting completed with no data, and the waiting remediation step is notified right away rather than waiting for the dispatch-timeout sweep.
Strategies: updates to content-library strategies now reliably refresh the data behind strategy matching, so recommendations reflect current strategy content.

2026-08-05

backend v0.1188.0 / frontend v0.881.0

Bug fixes

Scopes: finding filters (finding types, minimum severity, minimum CVSS score) are now enforced when determining which targets belong to a scope. Filter criteria that had no effect — including a “vulnerability” finding-type checkbox the form locked on by default — are no longer stored or displayed.
Findings: evidence text no longer lists a product as its own vendor when the data source doesn’t provide a vendor.
Signing in after your active organization was deleted now returns you to the organization picker instead of a stuck session.

2026-08-04

backend v0.1181.0 / frontend v0.877.0

New features

Forge can now open and read specific web pages when it needs information from one. The approval card lists the exact URLs it wants to fetch along with the query behind the request, and anything pulled from a page is marked as untrusted content so you can see what came from the open web.

Improvements

Scans and datasource refreshes are significantly faster, most noticeably on repeat refreshes. Furl now recognizes when a refresh hasn’t actually changed anything and skips the redundant work instead of rewriting every record, and scope matching, remediation-target syncing, and software calculation now run in batches rather than record by record. The improvement grows with the size of your environment.

Bug fixes

Strategies: the delete action now appears for strategies your organization created that don’t come from the content library.

2026-08-03

backend v0.1174.0 / frontend v0.875.0

New features

Targets: a Start time column shows when each remediation began.
Targets: a header legend explains what each processed status means.
Integrations: turning an integration off now asks whether to keep or delete the data it imported, instead of silently discarding it.

Improvements

Integrations: Automox now appears under Endpoint Management and SentinelOne under Vulnerability Management; the unavailable Jamf, Intune, and Generic Webhook tiles have been removed, and the Cloud badge renamed.
Strategies removed from the content library are now disabled rather than deleted, and any approvals they carried are revoked.
Endpoints that no longer exist in any connected source are cleaned up automatically.
Targets: the Asset Owner column is now named Endpoint Owner.
First-time setup now lands on Endpoints.

Bug fixes

Endpoints: an agent that is inactive is reported as inactive rather than unhealthy.
Running a check while one is already in progress now returns a clear message instead of a generic error.
Findings that no longer apply to an endpoint are closed correctly.
Endpoint correlation clears source links that are no longer valid.
Scopes: the ticketing section is always shown, and no longer claims there is no ticketing connection when one exists.

2026-07-31

backend v0.1160.0 / frontend v0.868.0

New features

Remediation phase verdicts can now be corrected by a person. When the AI’s validation, preflight, or verification verdict is wrong, you can override it with a required justification — correcting validation or preflight re-runs the remediation from that phase, while correcting verification records the target’s final outcome directly. Each correction is linked to the run it causes, so it can be traced end to end.

Improvements

Targets: the verification step shows when a phase’s outcome came from a human correction rather than the AI’s verdict, instead of crediting an overridden pass to the AI.
Failures when submitting a verdict correction are now reported instead of appearing to succeed silently.

Bug fixes

Targets: the probe results panel stays open while a target is running instead of closing itself every few seconds.
Scopes: the target table’s columns no longer rebuild each time the page refreshes while a scope is running.
Targets: a target whose software has since been removed no longer passes verification as though it had been remediated.
Remediations parked awaiting a reboot keep their pending-reboot status instead of being overwritten by a later verdict correction.
Fixed several cases where a remediation target could be advanced or finalized using state left over from an earlier run.
Vanta: imported endpoints no longer fall back to the Vanta asset display name as the hostname.

2026-07-30

backend v0.1158.0 / frontend v0.866.0

New features

Remediations that finish successfully but require a reboot are now tracked with a dedicated “succeeded — pending reboot” status instead of being marked failed; verification completes automatically after the endpoint reboots and re-inventories.
The agent detects PowerShell execution policies enforced by Group Policy, giving remediation strategies accurate context on managed Windows endpoints.

Improvements

Tenable.io: imported findings now use CVSSv3-based severity, distinguish the same vulnerability on different ports, and carry device serial numbers; Macs reported by Tenable merge correctly with agent-enrolled endpoints, and the integration icon renders cleanly in dark mode.
Linux package vulnerabilities from vulnerability scanners (Tenable.io, Rapid7 InsightVM) now produce remediation targets for well-known software families — PostgreSQL, Vim, curl, GNU binutils, GnuTLS, and more — including the package manager to use for the fix on Ubuntu systems.
Endpoints: hardware-UUID matching between sources is now case-insensitive, so the same machine reported by multiple integrations merges into a single endpoint instead of appearing twice.

Bug fixes

Tenable.io: fixed the “Invalid request payload” error that prevented vulnerability imports when no tags filter was configured, and hardened tags-filter parsing against whitespace and colons in tag values.
Fixed an issue where a single imported finding without CVE assignments could prevent all of an organization’s findings from appearing.
CrowdStrike Falcon Spotlight: vendor, product, and install path are now extracted correctly from application data.

2026-07-27

backend v0.1137.0 / frontend v0.860.0

Improvements

Forge: upgraded to a newer AI model (Claude Opus 5) for higher-quality analysis and strategy generation.
Strategies: strategy changes now reliably trigger rematching of the targets they apply to.

Bug fixes

Scopes: software product and vendor filters match targets regardless of which identity vocabulary their software data uses, so scopes no longer show zero matches for software they should cover.
Findings: WinRAR vulnerabilities imported from Rapid7 InsightVM now extract the software vendor correctly, so they produce remediation targets instead of being silently dropped.
Findings: the Furl scanner no longer records “n/a” as a software vendor for package-based findings.
Checks: preflight no longer runs service and process probes for package-manager remediations, where they don’t apply.
Page header actions wrap onto a new line instead of overlapping the page title on narrow windows.

2026-07-24

backend v0.1128.0 / frontend v0.859.0

New features

Endpoints: search covers more fields, and every column in the endpoints tables can be filtered.
Scopes: a new Copy Scope action duplicates an existing scope’s definition as a starting point for a new scope.
Checks: checks now run nightly by default, and each check’s schedule can be viewed and adjusted.
Forge: CVE research is more comprehensive, combining a dedicated CVE database lookup with recency-anchored web search, and distinguishes emerging-incident questions from established CVE research.
Integrations: CrowdStrike endpoints are enriched with hardware identity details from the CrowdStrike Hosts API.

Improvements

Strategies: updating the strategy for a remediation subject automatically rematches the targets it applies to.
Ticketing: scope ticket creation is more resilient. Lost ticket announcements are retried, and duplicate tickets are never created.
Endpoints: agent enrollment surfaces endpoint-linkage errors immediately, and a background sweep links agents that enrolled without an endpoint.

Bug fixes

Targets: retrying a scope no longer leaves a target’s status showing the previous attempt’s Failed state while the retry is in progress.
Approvals: approving or rejecting a remediation attempt that has already been replaced by a newer attempt is now safely rejected.
Integrations: CrowdStrike vulnerability sync returns endpoints correctly, and a failed enrichment batch no longer affects the rest of the sync.
Endpoints: the managed-by filter includes Cloud Infrastructure.
Checks: preflight validation honors the AI verdict, and service checks pass when a service is expected to be absent and is absent.
Targets: dependency targets are verified with real probes instead of being automatically confirmed.
Targets: remediation of Homebrew cask installs resolves to the managed application correctly.
Endpoints: software identification no longer overwrites a matched product identity when a later scan cannot identify the product.
Findings: vulnerability detection recovers for software with capitalized product names (such as Mozilla Firefox on Windows). An upstream product-identification service became case-sensitive; product lookups are now normalized before matching, so affected software is identified and scanned again automatically.
People: lookups and updates reference the correct person record and return a clear not-found error for unknown people.

2026-07-21

backend v0.1098.0 / frontend v0.849.0

New features

Endpoints: delete an endpoint along with its vulnerability data, and choose to keep operational data when deleting an integration.
Scopes: the scopes table now shows Active, Successful, and Failed target counts for each scope.

Improvements

Endpoints: automatic recovery of stalled osquery data collection now works on Windows endpoints.
Scopes: activating or resuming a scope now immediately re-evaluates its targets and starts remediation.
Checks: probe checks use an upgraded AI model for higher-quality results.
Strategies: strategy recommendations link directly to the corresponding strategy on the Strategies page.

Bug fixes

Endpoints: deleting an endpoint no longer disrupts agent event processing or scope evaluation for remaining endpoints and targets.
Approvals: an approval that fails to start remediation now restores the strategy’s previous state instead of leaving it superseded.
Approvals: duplicate pending-approval entries no longer occur for the same target.

2026-07-16

backend v0.1088.0 / frontend v0.845.0

New features

Dashboard: filter the summary metrics and trend graph by scanner source and time frame.
Targets: a new Scope column shows which scope each target belongs to, and the status popup now shows how the target was attributed to that scope.

Improvements

Strategies: strategy and remediation-subject generation now uses an upgraded AI model for higher-quality output.
Strategies: lowering your approval confidence threshold automatically re-evaluates strategies that were previously blocked by it.
Integrations: ticket updates in connected ticketing systems are now published durably after a remediation settles — a failed update is retried instead of silently dropped.

Bug fixes

Strategies: script-based strategies can no longer be generated with a malformed script template.
Approvals: approval counts and dispatches no longer include targets outside the approval’s scope.

2026-07-15

backend v0.1079.0 / frontend v0.838.0

New features

Targets: a new Finished column shows when each target was remediated or closed, with 30/60/90-day quick filters.
Scopes: pause and reactivate a scope directly from a row action on the scopes table.
Scopes: the scope’s targets view now shows when each target entered the scope.

Improvements

Strategies: the approval table is now sortable, and low-confidence entries show the strategy’s confidence score alongside the approval threshold.
Targets: version-change verification results now appear as remediation evidence, showing how a fix was confirmed.

Bug fixes

Scopes: creating or editing a scope now moves idle targets to their most specific matching scope.

2026-07-14

backend v0.1068.0 / frontend v0.832.0

New features

Strategies: added an Approved/Unapproved column with filtering, so you can see and filter strategies by their approval status.
Checks: probe check results now show timestamps.

Improvements

Software matching: product editions (such as Developer Edition) now bind to their own subject rather than the base product, improving remediation accuracy.
Endpoints: Furl now automatically recovers an agent whose osquery data collection has stalled, without manual intervention.
Endpoints: updated the bundled osquery to 5.23.1.
Remediation: job completions are now published durably, so a completed job no longer resolves with the wrong outcome after a transient failure.
Knowledge Graph: neighbor counts are computed more efficiently.
Scopes: added a Cancel button to the scope create and edit views.
Integrations: removed Carbon Black from the integrations list.

Bug fixes

Strategies: strategies disabled for your organization can no longer be approved or dispatched.
Findings: product and vendor filters are now case-insensitive.
Targets: the Status column now sorts by its displayed label.
Targets: uncovered targets are counted per target rather than per finding.
Targets: default filtering is only applied when you haven’t set any other filters.
Targets & Dashboard: the Furl-remediated count now reconciles with its drill-in view.
Rollouts: a lost ring-activation dispatch no longer stalls a rollout.
Checks: a failed manual check-run dispatch no longer wedges the check.

2026-07-07

backend v0.1030.0 / frontend v0.823.0

New features

Remediations that stall because an agent stops responding are now automatically detected and unblocked, so a dead agent no longer strands a remediation indefinitely.

Improvements

Endpoints: agent health now reflects whether the endpoint’s osquery collection loop is actually running its assigned jobs, so an agent that is checking in but no longer collecting data no longer shows as fully healthy.
Agent data reliability: agent events that fail to process are now retried and routed to a dead-letter queue instead of being silently dropped.

Bug fixes

Targets: targets awaiting a reboot after a successful update now resolve as remediated.
Windows remediations now report their real command exit codes and capture the full deployment output.
Remediation verification now runs against the endpoint’s actual operating system, fixing incorrect package-manager verification on mixed-OS fleets.
Nested tables now keep their pagination controls anchored at the bottom instead of floating mid-table.

2026-07-01

backend v0.1015.0 / frontend v0.819.0

Improvements

Forge: you can now create scopes using tag-based filters.
Forge: newly created remediation scopes start in a paused state, so you can review them before they take effect.

Bug fixes

Forge: target queries are now limited to your in-scope targets.
Windows winget remediations now reliably resolve winget on the system PATH.

2026-06-30

backend v0.1010.0 / frontend v0.818.0

Improvements

Data tables: wide tables now have a floating horizontal scrollbar so you can scroll across columns without jumping to the bottom of the page.

Bug fixes

Agent downloads: hardened the agent download redirect endpoints against path-traversal in encoded URLs.
Scopes: the scope detail page now shows tag names instead of internal IDs.

2026-06-26

backend v0.1009.0 / frontend v0.814.0

Improvements

Knowledge Graph: node detail loads faster
General performance improvements

2026-06-25

backend v0.1007.0 / frontend v0.813.0

Improvements

Knowledge graph: in-flight graph data requests are now cancelled when you navigate away or close the page, avoiding wasted work.

2026-06-24

backend v0.1003.0 / frontend v0.810.0

Improvements

Security improvements from regular scans.

Bug fixes

Endpoints: IP and MAC addresses now stay current as agents report changes, instead of occasionally going stale.
Findings: endpoint names now display correctly even when an endpoint has no IP address.

2026-06-23

backend v0.997.0 / frontend v0.807.0

Improvements

Findings: the Detected column is now sortable.

Bug fixes

Sign-in and account screens now follow your dark-mode theme instead of always rendering in light mode.
Forge: cancelling a single endpoint in a multi-endpoint batch now cancels only that endpoint — the batch resumes and still returns results from the others.
Findings: when a data source stops reporting, its findings and targets are now closed on endpoints that other sources still report, instead of lingering as stale.
Targets: asset-identity matching now prefers an exact name match when multiple candidates tie, so assets reported by multiple sources are correlated more accurately.

2026-06-23

backend v0.994.0 / frontend v0.805.0

Improvements

Endpoints: the agent status column is now labeled “Agent health” and reports two distinct signals — whether the agent is active (checked in recently) and whether it is healthy (its two daemons are reporting in sync).
Security improvements from regular scans.

Bug fixes

Forge: osquery and script commands are no longer sent to endpoints whose agent is inactive — previously the job would silently queue and time out after about 15 minutes. Forge now declines up front and explains why, so you can choose an active endpoint.
Forge: when a conversation’s messages fail to load, you now see an error you can retry instead of what looked like an empty conversation.

2026-06-22

backend v0.990.0 / frontend v0.802.0

Improvements

Integrations: deleting an integration now cleans up its associated operational data.

2026-06-19

backend v0.986.0 / frontend v0.801.0

New features

Forge: jobs can now dispatch across multiple endpoints in parallel, with a toggle to switch between parallel and sequential dispatch.
Endpoints: a dedicated, filterable Source column shows where each endpoint’s data comes from.

Improvements

Endpoints: the page header now shows an at-a-glance summary of your agent fleet.
Endpoints: the +N source rollup now shows integration logos on hover, and the hostname column stays frozen in place as you scroll horizontally.

Bug fixes

Endpoints: corrected the tooltip shown on the +N source rollup.

2026-06-17

backend v0.983.0 / frontend v0.794.0

New features

Dashboard: KPI tiles are now clickable and drill into the matching page, pre-filtered — for example, Actively exploited opens Findings filtered to known-exploited vulnerabilities, Closed remediation targets opens Targets filtered to closed, and Agents deployed opens Endpoints filtered to agent-managed hosts.
Endpoints: you can now export the Endpoints table to CSV.
Integrations: each connection can have its own data-source refresh interval, so you can tune how often Furl pulls from each source independently.
Dashboard: a new agent-coverage card shows how many endpoints don’t yet have an agent installed.
Memory: the memory your agent forms during its dreaming phase is now visible in the Memory tab.

Improvements

Dashboard: the remediation-target tiles are now labeled “Open remediation targets” and “Closed remediation targets” for clarity.
Dashboard: clearer vulnerability tile labels (“Actively exploited vulnerabilities”, “Total vulnerabilities (all sources)”, “Furl-remediated targets”), a more logical tile order, and consistent alignment so values and trend graphs line up across each row.
Dashboard: vulnerability stats are clearer — resolved targets are split into “Remediated by Furl” and “Closed”, and the deduplicated tile is renamed “Unique vulnerabilities”.
Targets: the Validation column now uses clearer, consistent wording (unvalidated → validating → valid / not valid).

Bug fixes

Dashboard: the Open remediation targets tile now shows the same count as the Targets page.
Validation: a finding is no longer marked invalid without corroborating evidence, preventing false negatives.

2026-06-15

backend v0.973.0 / frontend v0.783.0

New features

Targets: a new Open/Closed State column lets you filter and sort targets by whether they’re still open or have been closed.

Improvements

Targets: the Validation column is simplified — the Status now reflects only terminal outcomes, and the in-progress validating state is collapsed into a cleaner indicator. Scope-only validation shows a read-only status.
Settings and in-app navigation load faster — fewer redirects reaching Settings and a cached user profile remove a round-trip on each navigation.

Bug fixes

Vulnerability matching is more precise: CPE fallback matching now only applies to tokens that broaden the installed product, reducing false matches.
Logging out from the user menu now works reliably.
The app keeps its styling intact when an error page is shown.

2026-06-13

backend v0.968.0 / frontend v0.777.0

Improvements

Pages now refresh their data more reliably, and background polling pauses while you’re on another view — keeping what you see current without unnecessary requests.
Empty and error states across the app now show clear, plain-language messages instead of leaking internal technical text.

2026-06-12

backend v0.966.0 / frontend v0.774.0

Improvements

Remediation preflight now detects packages that are held back from upgrades (apt holds) on Linux endpoints, so blocked upgrades are surfaced before a fix is attempted.
Tables across the app use a consistent set of page-size options (10, 25, 50, 100).

Bug fixes

Vulnerability matching identifies more products correctly: ambiguous vendor/product combinations now fall back to product-only matching, and product identifiers covered by known CVEs are preferred.
Finding-to-target links are now recorded consistently during vulnerability processing.
Forge: when multiple approvals are pending, each response is applied to the correct action.

2026-06-11

backend v0.963.0 / frontend v0.774.0

Improvements

Targets: faster, more consistent loading for large target sets — target lists, filters, and counts are now served from purpose-built tables.
Endpoints: software inventory reports are now processed by diffing against the previous snapshot instead of rewriting every record, reducing processing load for large fleets.
Tables across the app share consistent page-size options (10, 25, 50, 100) and default to 10 rows per page.

Bug fixes

Vulnerability matching now recognizes more product version formats, and targets are no longer incorrectly closed as removed when an upstream CVE lookup briefly returns no results.
Vulnerability identity matching is more accurate: candidate software identities covered by the CVE are preferred, and vendor/product pairs with no match fall back to a product-only lookup.
Findings are now recorded even when no remediation target exists yet, and a finding that affects several pieces of software on one endpoint is linked to all of them.

2026-06-10

backend v0.951.0 / frontend v0.772.0

New features

A new overview dashboard surfaces KPI cards and a vulnerability/remediation trend at a glance.

Improvements

Targets: the list now paginates, sorts, and filters on the server, so large target sets load quickly and every column stays sortable across pages.
Findings: the table now has per-column filters and a Source column showing where each finding came from.
Scopes: processed targets now distinguish targets you closed from those the remediation pipeline resolved, and the processed-targets CSV export includes the closed disposition and the time each target was closed.

Bug fixes

Targets: the Urgency column now sorts in the correct order.

2026-06-08

backend v0.940.0 / frontend v0.766.0 / agent v1.2.0

New features

The macOS agent (v1.2.0) now supports Intel-based (amd64) Macs running macOS Sequoia and later.

Improvements

Findings: table columns now keep a fixed width while you sort, so the column headers no longer shift around.

Bug fixes

Targets: furl-detected remediation targets now dedupe consistently, so duplicate entries no longer appear across calculation cycles.
Vulnerability scanning now detects known CVEs for Windows applications whose version numbers carry extra trailing segments (such as 7-Zip), which were previously reported as having no known vulnerabilities.

2026-06-07

backend v0.935.0 / frontend v0.765.0

New features

Authoring a remediation subject in Forge now automatically rematches previously-unmatched targets to it, so newly-defined subjects immediately pick up the software already in your inventory.

Improvements

Targets now match to remediation strategies using their native CPE and package URL (purl) identifiers, so more software is correctly paired with the right strategy.
Vulnerability scans run faster — identity resolution is batched and deduplicated, and probes are skipped for targets that can’t be remediated.

Bug fixes

Known Exploited Vulnerability (KEV) indicators now render with the correct critical styling.

2026-06-06

backend v0.924.0 / frontend v0.764.0

Improvements

Targets: the list now sorts by highest CVSS score first by default, so the most severe targets surface at the top.
Severity and urgency indicators are now a single, consistent chip style across the app.

Bug fixes

Fixed a sorted, filterable column header that was invisible in light mode.

2026-06-05

backend v0.923.0 / frontend v0.757.0

New features

Findings: a high-level metrics header now summarizes key counts at the top of the Findings page.

Bug fixes

Integrations: endpoints imported from Qualys now include their hardware UUID and serial number — and use the correct hardware identifier on macOS — so they correlate with agent-managed endpoints instead of appearing as duplicates.
Forge: the size of a proposed reach change is now validated before it can be applied.

2026-06-04

backend v0.910.0 / frontend v0.756.0

New features

Scopes: you can now retry remediation across a scope’s targets — retry all of them, just the failed or blocked ones, or an individual target.

Bug fixes

Targets: remediation targets and their findings now close automatically when the underlying software is removed from an endpoint — and reopen if it’s reinstalled — instead of lingering as active indefinitely.
Remediation: when a remediation is blocked during preflight checks, the blocking reason now surfaces instead of the attempt failing without explanation.

2026-06-03

backend v0.906.0

Bug fixes

Findings: improved CVE version matching so vulnerabilities are detected more accurately — affected software with open-ended version ranges, trailing-zero version numbers, and multi-segment versions now match correctly, reducing missed detections.

2026-06-02

backend v0.905.0 / frontend v0.755.0

New features

Scopes: new scopes are created in a paused state so you can review their configuration before any remediation activity begins; activate or resume them when ready.
Endpoints: the endpoint detail panel now includes a software inventory table listing the software installed on that endpoint.

Improvements

Scopes: the Scopes page loads faster.
Targets: the Targets page loads faster.
Strategies: the strategies table now has a Created Date column.
Security: updated platform and agent dependencies to address known vulnerabilities.

Bug fixes

Forge: vulnerability research now anchors to the current date — web search results are treated as current and up to date rather than relying on the model’s training data.
Forge: switching to a different session while one is running now prevents thrashing between them in the user interface.

2026-06-01

frontend v0.747.0

Bug fixes

Sign-in now returns you to the page you originally requested, instead of dropping you on the default landing page.

2026-05-31

backend v0.891.0

Bug fixes

Endpoints: agents are now matched by their hardware UUID, so two machines that share a hostname are tracked as separate endpoints instead of being merged into one.
Targets: filtering remediation targets by multiple values no longer fails.
Remediation: when a deployment step fails, the pipeline no longer runs verification against it.

2026-05-30

backend v0.888.0 / frontend v0.746.0

New features

Endpoints: endpoints can now be tagged automatically from agent configuration, so you can group and target them by tags set on the agent itself.

Bug fixes

People: only real user accounts from endpoint agents are ingested as people now — service and machine accounts are filtered out — and each person is correctly linked to their endpoint.
Remediation: Windows preflight checks now correctly evaluate available disk space and pending-reboot status before a remediation runs.

2026-05-29

backend v0.885.0 / frontend v0.745.0

New features

Scopes: a new Processed Targets table shows the targets a scope has run through, with a CSV export of the current view.
Scopes: blocked targets now explain why they’re blocked, and admin approval gates can be approved inline without leaving the page.

Improvements

Strategies: targets with no matched strategy now show a clear “No Strategy” pill instead of the misleading “Needs Review” label.

Bug fixes

Targets: remediation targets that have no CVSS score now sort below those scored 0, rather than mixing in above them.
Strategies: the subject picker in the Create Strategy flow is usable again.

2026-05-28

backend v0.876.0 / frontend v0.739.0

New features

Scopes: an endpoint tags filter on the “Where to Remediate” step lets you target remediation by endpoint tag.

2026-05-27

backend v0.875.0 / frontend v0.738.0

New features

Targets: a CSV export button on the Remediation Targets table downloads the current filtered view.

Improvements

Findings: the search bar now filters results server-side, matching how search works on other tables.
Endpoints and Findings: integration and scanner icons in table columns are right-aligned and collapse cleanly when many are present.
Severity badges across the app now use the style guide’s color variants consistently.

Bug fixes

Scopes: the ticketing destination dropdown handles Freshservice’s flat ticketing model correctly.

2026-05-26

backend v0.870.0 / frontend v0.733.0

New features

Sidebar: a What’s New link now opens the release-notes page directly from the app.
Forge: endpoints flash green when a command completes against them, making it easier to see which hosts just finished.

Bug fixes

Forge: the reach panel refreshes after the assistant makes scope or strategy changes, so the affected-endpoints count stays in sync with the conversation.

2026-05-22

backend v0.862.0 / frontend v0.730.0

New features

Desktop tray notifications for informational events, approval requests, and snoozed deferrals.
Multi-select column filters across Targets, Findings, and Endpoints — pick more than one value at a time and see them as pills above the table.

Improvements

Column-bound filters (CVE, VSI, CVSS Score, and others) now live in each table’s column headers rather than a separate toolbar.
Tables remember column visibility, page size, and active filters across refreshes — each table has its own scoped settings.
Active filters collapse to a summary pill when more than three values are selected.
Targets: Coverage card moved above the toolbar for clearer reading.
Strategies: enable/disable toggle moved into the secondary toolbar row alongside other table controls.
Unified search behavior across tables — press Enter or click Apply to submit, with a Reset-to-default control.

Bug fixes

Targets: Software Vendor and Software Name filters include targets that only have attribute-level vendor or product data.
Tables: column-header filter dropdowns stay open across data refreshes.
Endpoints: Columns dropdown shows up even when the global search bar is hidden.

2026-05-20

backend v0.856.0 / frontend v0.727.0

New features

Forge streams the assistant’s response incrementally — text, tool calls, and approval state appear as they happen rather than after completion.

Bug fixes

Forge: new user messages are now rejected while a tool call or interrupt is in flight, and when the last message isn’t from the assistant.
Forge: reach-panel job state pills show human-readable labels.
Endpoint owner lookup repaired (filters out stale and non-furl owners), restoring correct exception routing.