We have expanded our risk detection capabilities to include 62 new risk types, providing a more comprehensive assessment of external attack surfaces for you and your vendors. Our scanning engine now identifies a wide range of new services, which we’ve grouped into the following categories to help prioritize remediation efforts:
- Remote Access & Management: We now detect critical interfaces for routers, VPNs, servers (HP iLO), and container platforms (Portainer). If exposed, these services provide a direct path for attackers into your network or vendors’, bypassing other security controls.
- Databases & Data Stores: Our scans now identify exposed instances of ClickHouse, InfluxDB, and Firebird RDBMS, among others. Unsecured databases are a primary target for data theft and ransomware attacks.
- Exposed IoT & Media Devices: We’ve expanded our detection to include a growing blind spot for security teams: exposed IP cameras, network video recorders, and smart home/office systems. These devices are often initial access vectors for breaches if not properly segmented and secured.
- DevOps & Cloud-Native Tools: We can now identify misconfigured Kubernetes, Grafana, and Apache Airflow instances. When exposed, these tools can leak sensitive credentials, monitoring data, and even provide control over critical infrastructure.
- Legacy & Insecure Protocols: Our scanning now flags outdated and unencrypted services, such as Rlogin, Remsh, and TFTP. These protocols are easy targets for attackers to intercept credentials and sensitive information.
To help users proactively address these items before they impact scores, for the first 4 weeks, these new risks will be flagged as “provisional.” Users will be able to view them in their accounts, but they will not impact security scores during this period. This 4-week grace period is designed to provide teams with a clear window to review, prioritize, and remediate the newly identified risks. In the week of November 19th, they will become active and will be factored into scores like all other security risks.
Other improvements
- Trust Exchange users can share their security rating instantly using an embedded badge. This badge links directly to their Trust Page, giving customers easy, immediate access to security and compliance information.
- Our risk detection capabilities have been expanded to include CVE-2025-61882, a critical (CVSS 9.8) vulnerability in specific versions of Oracle E-Business Suite, recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
- We have added a new risk for insecure HTTPS-to-HTTP redirects to help users more accurately identify websites that downgrade secure connections, potentially exposing data to interception or tampering during transmission.
- We have updated the questionnaire builder to allow ‘File Upload’ questions to be set as mandatory, helping ensure that vendors provide required documentation before they can submit a questionnaire.
- This release includes a number of bug fixes.
