What shipped, what changed, and what we took out.

CHANGED A recorded privileged session cannot be quietly redirected or ended

The agent now ties a recorded session to its real process the first time it sees it. If the user then edits the session's files to point recording at another process, or to make it look finished, the session is ended and a high-severity tamper alert is raised, instead of the recording simply stopping.

ADDED Signed session records, with an optional independent timestamp

When a privileged session ends, the platform now signs the final link of its recording chain. If you name a timestamp authority (RFC 3161), that signature is also timestamped by it, and the recording can be exported with its signature and timestamp as one evidence bundle.

CHANGED Erasing a person's data no longer depends on what was in flight at the time

When a person's key was destroyed while an event about them was still being written, that event could end up protected by a blank key, and so escape the erasure. Keys are now handed out as copies, so destroying one reaches every record it ever protected.

CHANGED A flood of made-up usernames no longer pushes real people out of their behaviour baselines

Failed sign-ins for names that never signed in successfully no longer create a baseline of their own, and when space runs short the never-successful ones go first. A password spray can no longer make a real person's history disappear.

ADDED Older Windows servers read the same as modern ones

Security logs from Windows NT, 2000, XP and Server 2003 now decode into the same records as their modern equivalents, so every detection that reads a sign-in, a new process or a group change applies to them unchanged. The original event number is kept on the record.

ADDED Transfer rings in fraud analytics

Money that travels around a ring of three to six accounts within three days, each hop close to the first in amount and in time order, is now reported as one finding with the ring attached.

CHANGED Repeated activity between the same two things shows once, with a count

On the investigation timeline, the same action between the same two things within a short window now folds into one link that says how many times it happened and when it started, instead of crowding out everything else.

CHANGED An automated investigation cannot act on a value it only read in untrusted data

If a proposed action's target, address, recipient or command was copied from data the investigation read rather than from the person who asked, the action waits for a human, and the record says which value came from where.

CHANGED One metered dimension on the platform line, and the pricing page now says so correctly

The published charging model listed mechanisms we do not use — per machine, per seat, per report, per destination. None of them were ever billed and none of them exist in the product. The platform line is metered on raw volume ingested per day and nothing else; detection, response, posture, identity, search and reporting carry no charge of their own. The capability index has been corrected row by row.

CHANGED A trial is bound to a daily volume instead of a node count

Put the agent on as many machines as you like. The licence carries a daily volume figure you declare, which is the same unit a quote would later use, and one upward amendment is available without a conversation. Counting nodes measured the wrong thing: one node is a jump box or a database host, and nothing in the count says which.

ADDED What happens if a licence lapses is now published

Enforcement never degrades and neither does the obligation plane — consent, erasure, grievance, your audit record, your bill and your ability to log in. Forward motion stops after a grace window: new policy and detector authoring, the reporting surfaces, feed freshness and support. It is on the pricing page in full, along with what is never gated by a licence in any state.

ADDED Per-machine policy carriers for detection content and protected datasets

An operator can now declare which detection content and which protected datasets a given machine is served. The machine's feed reports what it received, what a named policy withheld, and what nothing could judge — so a narrow feed is attributable rather than mysterious.

CHANGED Enrolment credentials now declare their reach at issue

A join credential is minted either for a machine that reports telemetry or for an application that reads its own account. The choice is made once and cannot be changed afterwards. Previously every credential was minted the same way, and the mismatch surfaced hours later on the host as an unexplained refusal.

CHANGED Refused device credentials now name their reason

A rejected credential returns a named reason rather than a blank where the diagnosis goes. Any surface that renders the refusal verbatim now shows it. The remedy is a re-mint rather than an edit, and the message says so.

REMOVED The free tier, before it shipped

Replaced by a single full-strength trial: thirty days from issue, on-premise or SaaS, nothing feature-gated, one per organisation, non-renewing. Our reasoning is on the pricing page rather than in a footnote — a free tier of an on-premise platform gives us no telemetry and no shutdown path while still generating support obligations.

ADDED Guided lessons that run on the live board

Academy lessons can now walk a learner through the real screen. Every step carries copy for the case where the estate is quiet, because a walkthrough over an empty board is the common case on a first day. No lesson ever injects example data into a live board.

CHANGED Coverage is reported as counts, not percentages

Any figure spanning machines that were never measured is now stated as a count with the unmeasured named separately. A percentage over an estate containing unevaluable machines was arithmetic performed on a category error.

REMOVED Direct actuator rollback from the operator surface

It worked, which was the problem: it changed the estate without a recorded decision. Undoing an automated action now crosses the same gate as the original, so the reversal is as accountable as the act.