Changelog

2026-10-16 · Aegis

Every policy is published through approval. In every organisation, a policy is published only when the approver you chose accepts it. Owners and admins can cancel a pending request, which puts the policy back the way it was. Once published, a policy's text and PDF are frozen: changes go into a new version that is submitted for approval, and regenerating a published policy creates a new version instead of replacing the one in force. See Policies.

Automated evidence waits for an approver. With Evidence Approval on, a passing integration check, automation or evidence template sends its task to review instead of marking it done, and done tasks come back for review when they are due again. You can't approve your own submission unless you are the only person who can approve, which is recorded as a self-approval. Auditors are no longer offered as approvers, and a review that has lost its approver shows a picker to assign a new one. See Evidence & Tasks.

Deeper DPDP coverage. India's DPDP now maps to 35 controls, 16 policies and 39 tasks, up from 17, 7 and 7. It reuses the privacy controls you may already have for SOC 2 and the security safeguards the DPDP Rules require, and adds evidence for consent withdrawal, children's data, significant data fiduciary status, data localisation, breach reports to the Data Protection Board, nominations, grievance timelines and inactive-user erasure notices.

Better tailored policies. Policies are now written from your assessment answers, organisation facts, vendors and Document Vault excerpts, checked before they are saved, and kept consistent with each other. Policies added later, for example when you add a framework, are tailored the same way instead of arriving as templates.

2026-10-15 · Aegis

A security assessment now scopes your program. Before Aegis generates anything, a ten-section assessment asks how your company is built and run and how mature each area is today. Its answers decide which control families and policies apply, each decision with its reason, and you can override any of them with a written reason before you submit. Out-of-scope policies are kept but marked out of scope, and out-of-scope controls and tasks no longer count against framework scores. See Security Assessment.

Finish it later. New organisations can choose Finish later, open the app and come back from the nav or an Overview card that shows progress. Nothing is generated until the assessment is submitted. Organisations set up before the assessment existed can take it too; submitting when a program already exists re-runs generation and rewrites policy text, and the review page says so first.

Answer it with your agent. Three new MCP tools let Claude or another assistant propose assessment answers: get_assessment_state, propose_assessment_answer and mark_assessment_unknown. The assistant is told never to answer from general knowledge about your company, the server enforces seven rules (evidence, visibility, valid options, verifiable sources, quarantine, no overwriting, audit), and nothing it sends counts until a person confirms it. There is no submit tool. See Connect Claude (MCP).

The Document Vault. Upload policies, vendor lists, risk registers, contracts and diagrams. Aegis classifies each document and suggests vendors, risks, organisation facts and assessment answers, each with a quote checked against the document. You approve, edit or reject each suggestion, then apply. Documents only fill gaps: they never override an answer a person gave. NexusVoid admins can control which document types suggest risks. See Document Vault.

The roadmap is a step-by-step process. Phases and milestones run from kick-off to audit, each with a clear "done when" and the real tasks and policies under it. Dates are optional and yours: owners and admins can set a target date per milestone and an audit date per framework, and on-track or overdue only appears where a date exists. Up next lists what you can start now. NexusVoid curates and publishes the structure. See Roadmap.

A status board for the roadmap. Roadmap tasks and policies sit in To do, In progress, In review and Done. Moving a card changes the real task; moving one to review asks for an approver. Policy cards stay locked, because policies move through approval on the policy page.

Approval rules are enforced by the API. With Evidence Approval on, a task can't be marked done or sent to review directly through the task API, bulk updates or the MCP update_task_status tool; it is submitted for review and the assigned approver completes it. Only a policy's assigned approver can accept its changes, and a policy can no longer be published by editing its status. The vendor and risk task pickers now offer the real task statuses. See Evidence & Tasks and Policies.

2026-10-02 · Aegis

NexusVoid is your autonomous CISO. The docs now describe the platform the way it is built to be used: a security program run for you, with compliance as the by-product. Argus finds and fixes, Aegis proves it. See the Introduction.

Argus and Aegis connect both ways. One OAuth connection lets Aegis read open Argus findings and send your framework scores back to Argus. Critical and high findings can be added to the risk register in one click (each finding is added once), and a new No Open Critical Code Findings check evidences the Secure Code task. Disconnecting in Aegis revokes its access in Argus. It fails closed: if Argus cannot be reached, it does not pass. See NexusVoid Argus.

Security training is built in. Two courses ship today, All-Employees Security Awareness (assigned to everyone by default) and Secure Development for Engineers. Each has short video lessons and an 80% quiz drawn from a question bank. Employees work through each course in order in the portal, one card per course. Passing files Security Awareness Training evidence automatically, certificates can be downloaded per passed course, and recurring courses re-open six months after they are passed. See Security Training.

Linked tasks on risks and vendors. A risk's or vendor's Tasks tab now lists the compliance tasks that treat it, with assignee and status.

Integrations have their own place in the app, in the left rail next to Compliance, Organisation and Security.

A new employee portal. Employees sign in with a one-time code, see their progress at a glance, and accept policies, install the device agent and complete training from one page.

More accurate device checks. macOS password policy no longer passes when automatic login is on or when no policy can be read. FileVault that is only scheduled to turn on does not count as encrypted. On macOS before Ventura, the screen-lock check now also requires the password to be asked for within 5 minutes. Windows reads the password policy more reliably and reports Windows Hello PIN length for information. See Endpoint & Shadow AI.

2026-08-08

Findings are now reported by source. A project's finding count used to be one number covering four unrelated kinds of work. On our own repository that number was 341, of which 130 were CVEs in packages we install, 110 were CVEs in OS packages inside a base image, 59 were infrastructure misconfigurations, and 50 were in code we wrote. Every row was real, and the headline still answered a question nobody asked.

The dashboard now leads with findings in code you wrote and breaks the rest out separately:

Container CVEs still count, in their own bucket. They are real and actionable, they are simply not code findings, and they dominate any repository with a Dockerfile. The panel also reports how many distinct problems the code findings represent once repeated hits of one rule on one file are merged, and how many sit in test files.

Dependency inventory accuracy. Three defects, all found by scanning ourselves:

• Nested lockfile paths were parsed as package names. A key like node_modules/@clerk/shared/node_modules/swr became the package @clerk/shared/swr, which does not exist on any registry. 71 of 985 reported dependencies on our own repository were names you could not install. These reached SBOM and SPDX exports.
• The inventory never forgot. Nothing removed a dependency row, so upgrading a package left the old version behind permanently and the inventory reported the union of every version ever seen. It now prunes what a scan no longer finds. If a scan produces no dependencies at all it prunes nothing, because a scanner that failed must never be able to empty your inventory.
• A project no longer lists itself as one of its own dependencies.

Test files are excluded from static analysis by default. A test asserting on a dangerous pattern contains that pattern. Two of our own code findings were a TLS test flagged for bypassing TLS. The excluded count is reported rather than silently applied.

Remediation shows the whole queue. It defaulted to a single project and capped the list at 40 without saying so, which is why it looked far emptier than Issues. It now covers all projects by default, states the real total, and pages through the ranking.

AI Activity is now the Agentic Security Team. The page was four stacked tables. It is now a roster grouped by the stage of the lifecycle each agent covers, from code through dependencies, pull request, triage, remediation and runtime. Opening an agent shows that agent's own work: its fixes, its pull-request reviews, its scan runs. The PR Reviewer has been added to the roster, having been missing from it while its reviews had their own table on the same page.

Pull Requests moved into Git Posture as a tab. Both answer the same question from two ends: the repository end and the merge-gate end. Old links redirect.

BOMs and Compliance now ship switched off. Both are complete and unchanged. Most teams reach for them a handful of times a year rather than weekly, so they no longer occupy two permanent slots in the sidebar. Turn either on in Settings → Dashboard Organiser.

2026-08-07

API inventory now reports three authentication states. The Authentication filter was Authenticated / Open / no auth. Anything not provably authenticated was reported as open, on a 447-endpoint estate that meant 383 reported as unauthenticated when the true figure was 96, with 287 simply undetermined. Endpoints Argus cannot assess now read Not determined, and the drawer's "No Authentication Required" banner fires only on a proven verdict. Risk scoring is unchanged and still treats an undetermined endpoint as open, erring toward higher risk is deliberate; asserting an unproven fact was not.

Remove a project. Projects → open a project → Settings → Remove project. Requires Admin and a typed confirmation. Irreversible and cascading: findings, scan history, BOMs, API inventory and dependency records go with it. Your Git repository is untouched.

Project branch and language display fixed. The project list showed a default branch rather than the branch actually scanned, and "Unknown" for a language that is never collected.

2026-08-06

Navigation consolidated, 42 items to 38. Four screens became tabs on the pages they belong to:

Old links redirect to the right tab; nothing was removed.

ATT&CK technique counts corrected. Three surfaces counted techniques over whatever rows they had loaded and disagreed with each other. All three now read one server-side count.

Dashboard tidied. Each figure is stated once. The org risk score sits beside the per-repository scores it summarises, and the compliance tile links to the full report.

Removed: ListRules, CreateRule, UpdateRule, DeleteRule. These served a seeded rule catalogue that no scan ever consulted, so a client calling UpdateRule got a success response while configuring nothing. Detection rules are managed at Settings → Rules, which does gate scans.