What's new in TridentStack Control

Improved

• Deployment rings that run continuously (24/7, no maintenance window) no longer send a "Deployment Started" notification at each cycle. Windowed rings still notify as before.

Fixed

• Fixed several issues on the tag editor page: pasting a search term now triggers the correct lookup, the agent list no longer truncates long names, duplicate OS badges no longer appear, stale heartbeat timestamps are refreshed correctly, and the configuration/policy column displays the right assignments.

New

• Deployment rings now have a Dispatch Settings section where you control how quickly endpoints begin receiving updates after a window opens. The default dispatches all endpoints within the first 15 minutes. Increase this period to spread network load on large fleets, or leave it at the default for fast rollouts. Endpoints that come online after the dispatch period still receive updates for the remainder of the window.

Improved

• Reviewing past reboot windows no longer means stepping through them one at a time. Under All windows on the Scheduled Reboots tab, expanding a run now shows the same complete breakdown as selecting that window on its own: each reboot group with the time its reboot was sent, and every endpoint's reboot status, whether it was still patching when its group began, last check-in, and uptime.

Fixed

• Deployment rings with a single 100% phase no longer stall after the initial pass. All eligible endpoints now receive updates each window, and endpoints that were offline or in cooldown are prioritized on the next cycle instead of being permanently skipped.

New

• The query builder now lets you report on hardware details, security posture, endpoint protection, disk utilization, and operating system specifics for every managed endpoint. Select the new Hardware and Security or Agent Telemetry data sources to build reports covering CPU, RAM, disk, manufacturer, model, serial number, TPM, Secure Boot, BitLocker/FileVault/LUKS encryption, Defender status, EDR product, .NET versions, and more. You can also join these data sources to the Agents table for a single combined view. The Agents data source itself adds platform, directory join status, Entra tenant, connected gateway, and serial number columns.

• Reporting dashboards can track more of your security posture over a chosen period, each with a comparison to the period before it: aging backlog, findings opened during the period that are still open, fixable findings, unique CVEs, affected endpoints, how many update installs completed, and how many compliance controls passed, failed, and were evaluated. Add these panels to any dashboard that has a reporting calendar.

• Reporting periods are now available to every account, not only those that already had a dashboard using them. Every account is set up with a monthly reporting calendar automatically, starting from the month you joined, and you can define your own periods, such as fiscal quarters or four-week cycles, from Settings > Reporting Calendar. Calendars now roll forward on their own, and if a custom calendar runs out, reporting falls back to calendar months so your dashboards keep reporting without a gap.

• A deployment ring's rollout detail page now has a maintenance window picker and a Scheduled Reboots tab. Pick any past maintenance window to see exactly what happened during it, or choose All windows to see every reboot sequence run for that ring at once. The Scheduled Reboots tab shows the reboot sequence group by group, with each endpoint's current status, uptime, and the reason for any failure or skip. While a sequence is running, the header names the group currently rebooting and what happens next, such as which group it is waiting on to come back online or how long until the next group's reboot goes out, along with the time each group's reboot was actually sent. A group also calls out any endpoint whose reboot was sent before it had finished installing its own updates, so a sequence that started ahead of a slow endpoint is easy to spot. And if a ring shows Completed while its reboot sequence is still finishing underneath, a second label next to Completed makes that clear instead of leaving the two statuses looking contradictory. Each endpoint's hostname now links straight to its endpoint details page, and the table shows whether it is currently online or offline, when it last checked in, and an uptime that keeps refreshing automatically for as long as the sequence is running.

Improved

• Rollout Status now shows an endpoint's install activity inline, right on the rollout page, instead of sending you to that endpoint's History tab to see it.

• Vulnerability reporting now covers every version of the .NET runtime present on a Windows endpoint, not only the one Windows lists under Add or Remove Programs. Endpoints often carry several .NET runtime versions side by side, and Windows registers roughly one entry per runtime family, so findings were reported against a single version while the others went unreported. ASP.NET Core runtimes were missed entirely. Expect .NET findings to increase on endpoints with more than one runtime installed: those vulnerabilities were already present, they were simply not visible.

• Application update failures now show actionable error messages instead of raw exit codes. For example, an install blocked by a running application shows "Access denied: application may be running" rather than "Exit code 5," and a download failure shows the unreachable source URL rather than raw error output.

• Application updates are no longer dispatched to endpoints running OS versions the application no longer supports. Chrome and Edge on Windows Server 2012 R2, Visual Studio Code and Wireshark on Windows Server 2016, and Firefox on Windows 8.1 all stopped failing silently and now stay at their last compatible version.

Fixed

• Compliance figures are now calculated consistently across every dashboard panel and the Compliance page. The compliance tile, its trend, the Compliance Timeline, and the Compliance page previously each combined scores by a different rule, so the same tenant could see several different numbers for what should be one score. All four now agree with how the Compliance page has always worked: only endpoints that are still active count, only frameworks assigned to them today count, and each endpoint's frameworks are combined by how many controls they check before averaging across endpoints, so a framework checking hundreds of controls no longer outweighs several endpoints on a smaller one. The Compliance Timeline also now plots the score each endpoint actually held at every point in time, instead of averaging whichever evaluations happened to land in each interval. Your headline score may move once this is live, and past reporting periods are recalculated under the same rules.

• The built-in Home dashboard can now be set as your personal default. Its row menu in the dashboard selector was missing the Set as Default option, so if your organization had chosen a different default dashboard there was no way to go back to Home without copying it first.

• Reporting dashboards now reflect your full open vulnerability count. The executive Overview, its period comparisons, and the trend previously left Windows operating system and .NET Framework findings out of their totals, so they could show fewer open vulnerabilities than the Vulnerabilities page. Those findings are now included everywhere, so the dashboard totals, period-over-period comparisons, and trend line up with the Vulnerabilities page. Historical period numbers may rise the first time you open them after this update, because they are recalculated with the complete set of findings.

• The documentation server for AI assistants now refreshes with every release. Claude, Cursor, and other connected assistants answer from the current guides, API reference, changelog, and roadmap instead of an older snapshot.

• .NET Framework security updates stay visible on endpoints that have been out of contact. When an endpoint has not checked in for more than three days, its last recorded .NET Framework version may no longer be accurate, because another tool or an administrator could have changed it in the meantime. TridentStack Control now offers the full set of applicable .NET Framework updates for those endpoints instead of narrowing the list against a reading it cannot confirm. Endpoints checking in normally are unaffected.

• .NET runtime update status now accurately reflects what is actually installed. Three separate problems previously made good installs look wrong. An update could keep being re-offered after it succeeded, because a single installation record could not confirm the version on its own; endpoints on .NET 6 and .NET 7 were affected most, since Microsoft has published the final update for both and nothing further would ever arrive to confirm it. A completed install could also be checked against the endpoint's state from before the install, because the confirmation check ran ahead of the endpoint's own fresh report. And because one .NET update package can cover only some of the runtime types an endpoint has, such as the desktop runtime and the ASP.NET Core runtime, an update that delivered everything it contained could still leave the endpoint needing a different one. Updates now converge after a single install, the confirmation check waits for the endpoint's fresh report, and a partial delivery shows as a partial install rather than a failure.

• .NET Framework vulnerability findings now match the update that actually applies to the endpoint. Two mismatches previously kept findings open no matter what was installed: on systems where Microsoft publishes a separate update per .NET Framework version, such as Windows Server 2019, Windows Server 2022, and Windows 10 22H2, a finding could name the KB built for a different version; and because Windows records .NET Framework 4.7.2, 4.8, and 4.8.1 under one shared version line, a finding could be checked against the files of a version the endpoint was not even running. Findings are now matched and verified against the endpoint's own specific .NET Framework version, so installing the update TridentStack Control recommends actually clears the finding it was offered for.

• Resolved .NET Framework vulnerabilities now appear in an endpoint's vulnerability history. When a .NET Framework finding cleared because the fixing security update had been installed, the open count dropped with nothing in the endpoint's timeline to explain it. Each of those resolutions now records the update that cleared it, so the history shows why a finding went away and not only that it did.

• Endpoint readings taken right after an update are no longer lost. An endpoint sends a fresh reading within seconds of finishing an install, and if its next routine check-in followed closely enough, that reading could be set aside and never recorded. The endpoint's installed updates, operating system build, and .NET runtime versions could then sit at their pre-install values until the next scheduled refresh hours later, and a successful install could be reported as failed because verification was comparing against the older reading. Those readings are now always recorded.

• The dashboard panel picker no longer lists data sources that cannot return your data. Eight of the time-series sources in that list drew on fleet-wide figures rather than your own, so a panel built on one stayed empty no matter how it was configured, and one failed outright. Those eight are gone from the list. The tenant-scoped trends that do work, covering fleet health, compliance score, vulnerability count, and vulnerability severity over time, are unaffected and remain available.

Security

• .NET Framework patch verification now tells the servicing versions apart. Windows records several .NET Framework versions, such as 4.7.2, 4.8 and 4.8.1, under one shared version line, and Microsoft ships a separate security update for each. TridentStack Control compared an endpoint's files against that shared line, so files from one servicing version could satisfy the check for another and an endpoint could be reported as patched when its own version had not received the update. Each servicing version is now verified against the update built for it, so a finding is only cleared on evidence that applies to the endpoint's own version. This also lets TridentStack Control verify a further 16 .NET Framework security updates whose file evidence it previously could not use at all.

Improved

• Compliance tag assignments now use one consistent three-tier scale, Level 1, Level 2, and Level 3, in place of the previous overlapping options. Each tier builds on the one before it, so Level 2 always includes Level 1 and Level 3 is TridentStack Control's broadest assessment scope, making it straightforward to choose exactly how much of a benchmark an endpoint is scored against.
• DISA STIG compliance controls now sort into TridentStack Control's Level 1, Level 2, and Level 3 tiers by the severity DISA assigns to each rule, instead of grouping two severities together under Level 1: Level 1 now holds only DISA's highest-severity findings, medium-severity findings move to Level 2, and DISA's lowest-severity findings get a Level 3 tier of their own. A DISA STIG endpoint's Level 1 and Level 2 control counts and percentages change to reflect this; your overall compliance percentage is unaffected, since it is calculated across every tier together.

Fixed

• Executive Overview dashboard panels no longer briefly show "metrics are busy" errors on page load. Panels that cannot compute immediately now wait for capacity instead of failing, and background refreshes recover reliably.
• Fixed an overcount in the endpoint health card's compliance component. When an endpoint had more than one compliance score recorded for the same framework, TridentStack Control added the critical and high failure counts from every one of those records together instead of using a single one, so the number shown could be several times the true count. Failure counts and the compliance score now reflect a single evaluation per framework. One related change: an endpoint that has a compliance baseline assigned but has not finished its first evaluation no longer counts as perfectly compliant while it waits. Compliance is left out of that endpoint's overall health score until the first evaluation lands, so its overall score can shift, usually downward, and then settles once the evaluation completes.

New

• TridentStack Control now detects when a cloned or duplicated endpoint shares credentials with another machine. A warning appears on the Endpoints list and the endpoint detail page with guidance to reinstall the agent on the duplicate, preventing silent data corruption from two machines writing to the same identity.
• Export any dashboard to a PDF snapshot of exactly what you are viewing. A new Export button on the dashboard toolbar creates a PDF of the current view, matching the fiscal period or time range you have selected, and lists your recent exports for that dashboard so you can download them again.

Improved

• The row actions menu now stays on screen on wide tables. On the Endpoints list, and every other table that scrolls sideways, the three dot menu at the end of a row is pinned to the right edge of the view, so you can open it from any row without scrolling the table all the way across first.
• Compliance benchmark updates no longer rewrite your history. Each DISA STIG release we ingest is now recorded as its own immutable revision, so a benchmark refresh can no longer change what an already-recorded compliance result meant. Re-fetching the same release is recognized and skipped instead of rewriting every rule.
• When a benchmark release withdraws a rule, that rule now stops counting toward your compliance score, and stops appearing in the endpoint's control list, instead of being scored forever against a standard that no longer includes it. The rule and its past results are retained in your history, so nothing you already measured is lost.
• Dashboards are now the first entry in the left sidebar, reachable in one click instead of from inside a Reporting menu. Query Builder has moved to the bottom of the Security section and the Reporting menu is gone, so every area of the product is one level deep. On a phone, Query Builder is now under the Security tab rather than the More menu. Existing links and bookmarks continue to work.
• Dashboards now refresh automatically every 15 minutes, and the refresh interval picker has been removed from the dashboard toolbar. The refresh button beside it is unchanged: press it whenever you want the current view reloaded straight away.

Fixed

• .NET Framework updates built for a version an endpoint does not have are no longer offered to it. Windows ships .NET Framework 4.x in mutually exclusive versions, and an update built for one of them cannot install on an endpoint running another. Affected endpoints were downloading a full update, often 90 MB or more, only for Windows to reject it as not applicable and leave a failed entry in the endpoint's history. TridentStack Control now withholds an update whose target version matches none of the versions the endpoint could be on. Where an endpoint's .NET Framework version is not yet known with certainty, the update is still offered, so nothing is withheld on a guess.

• An update Windows has refused as not applicable now stays set aside, instead of being offered again the next time TridentStack Control cannot read the endpoint's .NET Framework version. Previously that record could be discarded during a routine recalculation, so the endpoint downloaded the same update again, often 90 MB or more, and Windows refused it again. The record is now kept until something about the endpoint actually changes, and an update Windows has refused twice is set aside for good.

• "Install all pending updates" no longer re-queues an update that is already set aside. Updates Windows refused as not applicable, and updates held back after repeatedly failing to install, were both being picked up again by the bulk action, which is what Retry is for. Both are now skipped by the bulk action and left to their existing badge and Retry button on the endpoint. Selecting an update by name and installing it still works exactly as before.

• Report results no longer show "Invalid Date" in place of a value that starts with a date but is not one. A backup filename, a log line or a date range beginning with a timestamp now shows its actual content, shortened with a hover tooltip like any other long value in the grid.

• .NET Framework vulnerabilities are no longer hidden when an unrelated .NET Framework update is installed. Previously a single installed or applicable .NET Framework update could mark every .NET Framework CVE on that endpoint as already patched.

• .NET Framework vulnerability findings now clear once the update that fixes them is installed. Some endpoints kept reporting .NET Framework findings after the fixing update was already applied, because the version number Microsoft publishes for an update can move for components an endpoint does not report. Those findings now resolve on the next scan. An endpoint still waiting on a reboot keeps the finding until it reboots.

• A .NET Framework vulnerability is no longer reported as fixed on evidence that cannot prove it. Some .NET Framework months fix a component such as WPF or ASP.NET without changing the core file TridentStack Control was measuring, which left an endpoint reading as patched while the fix was still missing. Each fixing update is now checked against the file list Microsoft publishes for that specific update. Findings that cannot be proven fixed stay open until the fixing update is confirmed installed, so a finding that used to clear on its own may now remain visible longer.

• Microsoft Office status on an endpoint no longer reads "Up to Date" when Office updates were never evaluated for it. An endpoint with no assigned policy, with a disabled policy, with Office updates turned off in its policy, or whose Office version could not be determined now shows "Not Evaluated" and says which of those it is.

• A .NET runtime that fell behind is now offered its update even when Windows already reports the month's .NET update as installed. Windows Update only services the runtimes it installed itself, so an ASP.NET Core runtime added another way could sit one release behind with no update on offer; TridentStack Control now judges each installed runtime on its own version instead of the installed-update list.

• Endpoints running a .NET preview or release-candidate runtime are now offered the matching release build instead of being treated as already current, and a runtime entry TridentStack Control cannot read is counted as unknown rather than treated as absent.

• Compliance benchmark content now refreshes automatically on its weekly schedule. New benchmark releases reach your compliance results on their own instead of waiting for a refresh to be run for you.

• Endpoints running Windows on ARM are now offered the architecture-specific Malicious Software Removal Tool update instead of being skipped, and an endpoint whose processor architecture could not be read is no longer assumed to be 32-bit when .NET Framework fixes are evaluated or dropped from architecture-specific updates. Such an endpoint is offered the 64-bit installer with a note, and a refusal is recorded as not applicable rather than left unexplained.

• Executive dashboard metric panels (Open Period End, Resolved, MTTR, Compliance, Aging Backlog) no longer show a "busy" error on first load. The panels now retry automatically when the server is momentarily at capacity, keeping the loading spinner visible until data arrives instead of surfacing an error.

• A dashboard panel that cannot load its data now shows a clear message with a Try again option, instead of quietly disappearing. Previously a panel whose data failed to load, or took too long to respond, could vanish from the dashboard with no sign anything went wrong, leaving you unable to tell an empty result apart from a failure. Such a panel now stays in place with the reason and a Try again button, and it keeps showing its last good data while a later refresh recovers.

• Compliance evaluations for nearly 300 CIS controls with spaces in their registry paths now check the actual registry value instead of falling back to a generic existence check, producing accurate pass/fail results where they previously could not.

• Numeric threshold rules in compliance checks (e.g. idle-time limits, session timeouts) now evaluate correctly instead of always reporting a mismatch.

• A Windows Search indexing control could report as compliant on endpoints where the setting was not actually configured correctly. It now checks the setting itself, so the result reflects what is really set on the endpoint.

• Compliance controls that check a text-based registry setting now compare the value the endpoint actually holds. Some settings were being read as zero regardless of their real content, which could report an endpoint as compliant when it was not, or as non-compliant when it was fine. Affected results correct themselves on the next evaluation.

• Advanced audit policy controls on Windows Server 2016 now check the exact Success and Failure coverage the benchmark asks for, instead of only checking that auditing was switched on. Endpoints with partial audit coverage are now reported accurately.

• Windows logon banner compliance controls now read the banner text on the endpoint instead of failing with an unexplained result. A configured banner is recognized and an empty one is correctly reported as not configured.

• Linux compliance controls that check a value inside a configuration file, such as password age and lockout thresholds, now produce a real pass or fail instead of an unknown result. Controls that cannot be checked from the collected data are reported as unknown rather than assumed compliant.

• Linux file permission and ownership controls now read the exact format the benchmark asks for, so checks on audit tools, cron directories and SSH configuration produce real results instead of staying unresolved. A control covering several files now requires every one of them to be correct.

• Compliance controls that carry no expected value from the benchmark are now reported as unscored instead of failed. Around 1,950 results, covering the logon banner title and text, anonymous access restrictions, Remote Assistance ticket settings and the Netlogon channel allow list, previously read "Expected equals null, got 0" or "Registry value not found" even though there was no value to compare against. They now show as unscored alongside the value the endpoint actually holds, so you can review it against your own policy. The report distinguishes three different states, which used to read alike: a setting that exists but holds no value is shown as blank, a setting we checked and found not configured is shown as not configured, and only a setting we could not read at all is shown as not collected. A small number of results that had been reported compliant on the basis of data that was never collected are now unscored as well. Compliance percentages rise slightly as a result, because those failures were never real.

• The fleet-wide compliance report no longer counts a control as passing just because nothing failed. A control with no results collected from any endpoint, or where some endpoints could not be scored or reported an error, is now listed as unscored with the reason, instead of appearing among the passing controls. Controls that are not applicable across the fleet get their own section. This changes the passing count on the fleet report to reflect only controls every reporting endpoint actually passed. The report also states how many of the endpoints assigned to the framework have reported results at all, so a partial picture is visible rather than implied.

• Compliance reports now disclose unscored controls instead of dropping them. The per-endpoint and fleet-wide PDF reports gained an Unscored controls section naming each control and why it was not scored, and the endpoint Compliance tab shows an Unscored count. A control that could not be scored used to be absent from every section of the report, and on the fleet-wide report it could be listed among the passing controls. Where a control was evaluated across user profiles, the report gives a readable summary of how many profiles were compliant or unreadable, and long values such as a logon banner are shortened to keep the table legible.

• Update history now tells you what happened to every update in an install, including any the endpoint never reported back on. Previously such an update could be listed as "Installed successfully" on an otherwise successful install, or left as a blank row on a partial one. Those rows now read "Installed, not verified", "Failed" or "Not installed" based on the install progress the endpoint actually sent before it went quiet, each with the reason, and an update with no evidence it installed no longer counts toward the install's success.

• A rollout no longer records an update as deployed to an endpoint that never reported installing it, so Rollout Status reflects what was confirmed rather than what was sent. An update the endpoint reported installing but never confirmed is kept in the rollout's record, marked unverified, and no longer counts against the endpoint when TridentStack Control decides whether an update is stuck in a loop.

• The Non-Converged Updates report now also flags an update sent to the same endpoint repeatedly with no result ever reported, listed as "Sent repeatedly with no result reported". Previously that case could fall below every threshold and go unlisted, so a silently looping update was invisible.

• The update recommended as the fix for a vulnerability no longer changes between one look and the next. When several updates released on the same day could fix the same vulnerability, which one TridentStack Control named was left to chance, so the same endpoint could show a different KB after a refresh with nothing having changed. The choice is now settled the same way every time.

• Update supersedence is no longer recorded between unrelated Microsoft products. Some updates were incorrectly marked as replaced by an update for a different Windows edition or a different product, which could hide an update an endpoint still needed. Windows Server 2025 and Windows 11 24H2 in particular share an underlying build, and Microsoft gave them separate update identifiers in January 2026; TridentStack Control now follows that split.

• Dashboard leaderboard panels now show readable content for a column bound to a structured field, instead of an unreadable placeholder. This matches the fix already made for table panels. On a phone, such a value is trimmed to fit its card rather than running off the side of it.

• Report results now show structured values, such as a JSON or list column, as readable content in the grid and in the hover tooltip. Previously such a column could leave the results area blank.

• Dashboard table columns bound to a structured field now render readable content in every column style, including status and badge columns, and a link column with a blank value no longer leaves the panel empty.

• CSV exports from Report Results now write structured values as complete content in a single column instead of placeholder text, and a column heading containing a comma or a quotation mark no longer shifts the rest of the row.

• Server-generated CSV exports now keep every row aligned. This covers the Endpoint Checks compliance export and CSV exports requested through the reporting API. A structured column, such as a JSON field, is written as complete content inside one cell instead of splitting one column into several and shifting every value after it, negative numbers export as numbers rather than as text, date and time columns export as plain timestamps instead of being wrapped in stray quotation marks, and a column heading containing a comma or a quotation mark no longer shifts the rest of the row.

Security

• .NET Framework vulnerability results on ARM64 Windows endpoints are no longer reported as verified-patched unless every framework directory on the machine has been inspected. An ARM64 Windows PC carries three .NET Framework installations, and only two were being checked, so a result could be cleared on partial evidence. Affected endpoints now show an indeterminate result for these updates instead of a clean one, and any genuinely out-of-date file we can already see is still reported as vulnerable.

New

• Out-of-support .NET runtimes now appear in Vulnerabilities as a standing finding with the end-of-support date, so you can find every endpoint that still runs one.
• The IIS ASP.NET Core Module is now checked against the ASP.NET Core release it shipped with, so you can identify when its Hosting Bundle needs an update.
• Upload a custom package installer and TridentStack Control detects the platform, name, version, publisher, copyright, language, and file description automatically. Drop the file, review or edit the detected metadata, configure install arguments and detection settings right on the same form, and confirm. The review form appears within seconds of the upload finishing while the security scan continues in the background, so you are never waiting on the scanner before filling in details. For EXE packages, a "Pick from endpoint" button next to the detection display name opens a modal where you select one of your endpoints and browse its installed software list, so the Add/Remove Programs name used for detection matching is always exact. Existing packages with a matching identity are offered as "add a new version" to keep your catalog tidy, and when adding a version the new version is compared against existing ones with a warning if the numbering looks inconsistent.
• Adding a new version to an existing custom package now uses the same upload-first flow as creating a package: drop the file, review auto-detected metadata, configure install settings, and confirm. The "Add version" button on a package's detail page opens the upload form pre-targeted to that package.
• Organization admins can now rename their organization from Settings > General. Any user can also update their own display name from User Settings. Names set by Microsoft or Google sign-in are kept in sync automatically unless you explicitly edit them.
• Organization admins can now edit another user's display name from User Management. Open the Edit User dialog on any user to change their name and roles in one step.
• The Servicing Health card on each Windows endpoint now tells you when an out-of-support .NET runtime is installed (with its support end date) and when a .NET SDK is present that system updates do not service, so a runtime that no longer receives security fixes is visible before it becomes a finding elsewhere.
• Pin your active filters so they survive a page refresh. When you click the new Pin button next to the filter bar, your current include/exclude filters are saved in the browser and restored automatically on each visit. Pinned filters are shown in amber with a "Pinned Filters" label so it is always clear that you are looking at a filtered view. Available on the Endpoints, Configuration Policies, and System Update Policies pages.
• Search across everything from one place. A new search bar at the top of the sidebar finds pages, settings, endpoints, tags, policies, configurations, deployment rings, and packages as you type. Static results (pages and settings) appear instantly; live results from your data load after a brief pause. Every result shows what it is (endpoint, policy, setting, etc.) so similarly named items are easy to tell apart. Use Ctrl+K (Cmd+K on Mac) to jump to search from anywhere. On mobile, tap the search icon in the header for a full-screen search overlay.
• Navigation sections in the sidebar now remember whether you collapsed or expanded them, even after a page refresh. If you search to a page inside a collapsed section, the section automatically expands so you can see where you landed.
• Run Endpoint Checks on demand, without waiting for the next scheduled evaluation. A "Run Endpoint Checks" action is now available wherever you work with checks: on an endpoint's detail page and its Checks tab, across a multi-endpoint selection on the Endpoints list, and per check policy (from both the Endpoint Checks list and a policy's results) to re-run every assigned endpoint at once. Endpoints that are offline, on an older agent, or already running checks are skipped, and the result tells you exactly how many ran and why any were skipped.
• New "By Package" view on the Vulnerabilities page. See every affected product across your fleet at a glance, ranked by risk: the number of Critical, High, Medium, and Low CVEs, how many are known to be exploited, how many have a fix available, and how many endpoints are affected. Click any product to jump straight to its list of CVEs.
• As endpoints update to the new agent, vulnerabilities in a .NET runtime bundled inside an application are now found and attributed to that application, with the fix being the application's own update.
• As endpoints update to the new agent, when an endpoint's .NET inventory cannot be read completely, its Servicing Health card now says so, so you know runtime updates for that endpoint are being judged from partial evidence until the next successful report.

Improved

• Reboot history on Windows endpoints now records which user approved or postponed a reboot prompt, including the Remote Desktop session name on multi-session servers, so you can see who acted on a pending reboot.
• The Compliance page tabs now display as card lists on mobile devices instead of tables with scrollbars. The Agents tab shows each endpoint with its compliance score, passed/failed/exempt counts, freshness, and framework tags. The Baselines tab shows each framework with control counts, OS targets, deployment status, and expandable details. The Reports tab shows each report with a menu for download, regenerate, and delete. The Framework and Category tabs have tighter spacing on smaller screens.
• The User Management page in Settings has a cleaner layout. Each user row shows one visible action button (Approve for pending users, Edit for active users) with secondary actions (deactivate, reset MFA) tucked behind a dropdown menu. All dialogs now have proper keyboard navigation and focus management. On mobile devices, users and invitations display as cards instead of a cramped table.
• Compliance report PDFs are now compact and executive-grade. A per-endpoint report with 400+ controls generates approximately 20 pages instead of 270, with a structured cover page showing your company logo and compliance score at a glance, an executive summary with severity breakdown and methodology, detailed cards only for critical and high-severity findings, and a dense register table for the rest. Evidence appears once (not duplicated), empty sections are suppressed, and the full report width is used for tables and registry paths. Tenant-wide reports are bounded regardless of fleet size.
• When a modern .NET update switches to a different component installer for an endpoint (for example from the desktop runtime to ASP.NET Core), the replacement installer is now downloaded ahead of the maintenance window instead of at install time, and the previously staged file is no longer used; the endpoint's regular download housekeeping removes it.
• Vulnerability search now finds CVEs by the software they affect, not just by CVE ID. Type a product name to see every vulnerability attributed to it. The search box is relabeled to make this clear, and it now matches across all of a CVE's affected products, not only the first few shown.
• The calendar export now lets you choose which rollouts to include. The Export button on the Rollout Status Calendar tab opens a checklist of your active rings, every exportable ring selected by default, so you can send any subset (or all of them) to a single calendar file instead of always exporting everything.
• Update Health now shows a red Blocked status for findings that stop every cumulative update from installing: component store corruption recorded in the Windows servicing log or learned from a failed install, and a disabled App Readiness or Windows Modules Installer service. Action recommended is reserved for findings that affect a single update or leave installs able to proceed. The Servicing Health section also states whether the agent is holding installs on the endpoint or whether scheduled updates will still be attempted.
• A generic 0x80070490 servicing code in the Windows servicing log no longer raises an Update Health warning on its own. It is shown as an informational note unless a component store corruption marker is also present.
• The agent Effective Policy view now stays consistent across every endpoint. It always shows all policy sources with their setting counts, along with the conformance summary and any conflicts, instead of collapsing to only a subset on endpoints that carry settings from a single source. A new inline explainer defines each policy source, so it is clear where every effective setting comes from and why some settings have no conformance result.
• Endpoints are no longer offered the same .NET Framework update more than once. A monthly .NET Framework cumulative update is published both as a combined rollup and as per-version updates that carry the actual installers, and both were being listed, along with the previous month's release. On Windows 10, Windows 11 and Windows Server 2016 and later, each endpoint now sees one .NET Framework cumulative update per version it runs, matched to the version it actually has installed, and the reason it was chosen is shown in the update's detection details. Endpoints that do not report their .NET Framework version still receive the update. If preview updates are enabled for an endpoint, a month's security update and its preview are now both listed rather than only the newer of the two.
• Configuration policy settings that use a name/value list, such as antivirus exclusion paths and processes, now show column headers and a clear explanation of which field the setting actually reads. It was previously easy to enter the path or process in the wrong field, which meant the exclusion never took effect even though it appeared configured.
• Antivirus exclusion entries are now checked as you type them. In a configuration policy that manages exclusion paths, processes, or file extensions, an entry the antivirus can never match is rejected before you can save it: one that starts with a wildcard in place of the drive letter, and one that carries more than six wildcards. Three more shapes that often do not do what people expect are flagged with an explanation while still letting you save: a folder in the process list, a wildcard inside a bare program name, and a trailing wildcard in the path list, which matches file names rather than everything below the folder. Entries you saved earlier are left alone, so this never blocks an unrelated edit.
• Scheduled reboot sequences select each wave by tag, start as soon as the ring finishes installing updates (the minutes-before-window-end setting is now the fallback for long installs), and can advance on a timer instead of waiting for the previous wave to come back. Every field explains itself in place, and the match count expands into the list of matched endpoints. Waves that used a "has this tag" condition keep those tags; any other condition (hostname, other properties, "does not have") is dropped, so a wave that combined a tag with another condition now matches every endpoint carrying that tag, and a wave that selected endpoints only by hostname or other properties needs its tags picked again (use an automation rule to tag by hostname).
• Report templates and saved reports are now tabs on the Query Builder page, so you can browse a template, run it, and save a report without leaving the page. Your existing links to the Templates page open there automatically. In the sidebar, Vulnerabilities and Compliance are now grouped under "Security", and the dashboard and Query Builder are grouped under "Reporting". On mobile, the bottom navigation has been reorganized: Home, Agents, Updates, Security, and More, so you can reach any major module in two taps.
• As endpoints update to the new agent, your Linux software inventory now includes Snap and Flatpak applications and common third-party security and management agents (such as endpoint detection or remote monitoring tools), even when they are installed outside a package manager, so you can see everything that is really on the endpoint. Common Snap and Flatpak applications are also checked for known vulnerabilities.
• On a Windows endpoint's Effective Policy view, settings configured directly on the device now appear alongside the ones TridentStack Control and your domain policies set, so you can see everything that actually applies in one place. Each policy-configured setting's Pass or Fail now reflects the endpoint's real on-device value instead of only whether the policy was delivered, and entries for the same setting from more than one source are merged into a single row with the others listed as overrides.
• As endpoints update to the new agent, Windows compliance evaluation is more accurate: controls written with an HKLM: registry prefix now evaluate against the collected registry data instead of reporting a lookup miss; per-user (HKCU) controls are evaluated against every user profile loaded on the endpoint, name the profiles that do not comply, and report Unknown instead of a false Passed or Failed when no profile is loaded or the value was not collected; and endpoint user lists no longer include service and system accounts.

Fixed

• The TridentStack Control desktop window now comes to the front on the first click. Previously, the first time you opened it from the system tray after signing in, it could appear behind your other windows and only flash in the taskbar. It now opens in the foreground on the first click, the same as every later open.
• Windows endpoints are no longer offered a .NET Framework cumulative update built for a different .NET Framework version than the one they run (for example a 4.8.1 installer on a 4.8 endpoint), which Windows refused every time it was dispatched. When the endpoint's installed version and its Windows release are known, only the installer that services that version is listed, and the detection details name the update that covers it. Windows 10 1607 and Server 2016 endpoints, whose .NET Framework is serviced by the monthly Windows update, no longer see a separate .NET Framework update for it.
• STIG compliance scores are now more accurate. Registry-based controls that differed only in upper/lowercase between the template and the endpoint data previously showed as failures; they now match correctly. Controls that check per-user (HKCU) registry paths, which the agent does not collect, now show as requiring manual review instead of failing. A defensive matcher that could cross-match unrelated registry paths sharing the same leaf name has been removed.
• API key callers can now retrieve configurations and enrollment tokens through the TridentStack Control API without errors. Previously, these endpoints returned a server error for API key authenticated requests.
• On a Windows endpoint's Effective Policy view, a locally-detected setting that manages a list of values now shows as a single, clearly named row (for example, "Specify permitted managers") instead of one confusing row per list entry with names like 1000 or *. Empty placeholder rows for these settings are no longer listed, so the Local source is easier to read.
• Updates that Windows reports as not applicable to an endpoint are no longer retried every cycle. They are parked after the first refusal, shown as "Not applicable" on the endpoint's update list, and checked again automatically when the endpoint's Windows build, installed updates, or .NET inventory changes.
• An update that Windows refuses as not applicable is no longer recorded as a failed install. The endpoint's History shows it as "Not applicable to this system" with its own count, a rollout that hits one completes normally instead of counting a failure toward its safety halt, install verification no longer downgrades a real install because a companion update was refused, and the Stuck Updates report lists these under their own "Not applicable" reason. Installs recorded before this change keep their earlier status.
• Endpoint details (installed updates, reboot state, disk space, security software versions) refresh correctly again on every full check-in. A defect introduced on 2026-09-03 caused these full refreshes to fail silently on some endpoints, so the information shown in TridentStack Control could lag behind the endpoint.
• Read-only users no longer see Create, Edit, or Delete buttons on policy pages that lead to a permission error on save. The buttons are now hidden for users without edit access, across all policy types.
• Modern .NET updates now keep every installer Microsoft publishes for a release, including Windows Desktop, ASP.NET Core, the Hosting Bundle, and the runtime, so endpoints that only run ASP.NET Core are no longer left without a file to install.
• Modern .NET runtime updates now offer the installer for the specific framework that lags on an endpoint, continue to cover endpoints with a second architecture, and surface missing inventory reads instead of silently withholding updates.
• Antivirus exclusion lists on an endpoint's Effective Policy view are now checked against what the endpoint reports, not only against what was sent to it. A list counts as matching when every entry you configured is present on the endpoint, and the entries that are not there are named when you hover the value. Exclusions added by other software on the same endpoint no longer count against the result, because these lists add to what is already there rather than replacing it. When an endpoint reports nothing at all for a list, the view keeps its previous result instead of claiming the exclusions are absent, since a machine that cannot read its own policy data looks the same as one with nothing configured. Duplicating a policy now carries its list settings across intact, so the copy is checked the same way as the original.
• Retired endpoints are no longer included in scheduled reboot waves.
• Dashboard table panels now show a readable, expandable value for columns backed by structured data (for example an endpoint's custom metadata or its pending refresh state) instead of an unreadable placeholder.
• As endpoints update to the new agent, Windows Server 2016, 2019, and 2022 endpoints no longer show recurring failed entries for monthly .NET Framework updates that do not apply to them. TridentStack Control now reads the installed .NET Framework servicing level on these server editions, which it previously could not, so it offers only the monthly .NET Framework update that actually applies and stops re-offering ones the server rejects.
• Corrected how Microsoft Defender attack surface reduction controls are scored in compliance results. These controls were being answered from unrelated evidence: whether the Microsoft Defender service was running, or whether Virtualization-Based Security was on. Neither shows whether an individual attack surface reduction rule is actually enforced, so an endpoint could be reported as compliant on a rule that had never been checked. TridentStack Control now scores these controls only from the endpoint's reported attack surface reduction rule state, and reports them as Unknown, with the reason given, when the endpoint has not reported that state. Expect some of these controls to move from Passed to Unknown or to a real result on your next evaluation.
• Made Windows user rights controls report what was actually checked. Two problems are fixed. Some user rights controls were being answered by the wrong check entirely: "Perform volume maintenance tasks" was scored against a scheduled task because of the word tasks in its name, and "Log on as a service (Windows Defender Application Guard)" was scored against whether the Microsoft Defender service was running. Separately, when TridentStack Control had no built-in expectation for a right, it reported the control as Passed without comparing anything. User rights controls are now always evaluated from the endpoint's actual rights assignments and compared against the benchmark's own expected accounts, and a right that the benchmark deliberately leaves to your own policy is reported as Unknown, naming the accounts that currently hold it, instead of Passed. Expect movement in both directions on these controls at your next evaluation.
• Windows policy compliance controls are now scored from the full policy registry scan the agent already performs, instead of only the smaller list of values it reads individually. This closes a long-standing blind spot: most controls in the STIG benchmarks point at policy values that were outside that smaller list, so they either could not be scored or were answered by an unrelated check. Two things change on your next evaluation, both in the direction of accuracy. Controls that previously showed Unknown now report a real result, because the policy scan can show whether the setting is configured. And some controls that previously showed Passed now correctly show Failed: they were being answered by something unrelated, such as whether the Microsoft Defender service was running, rather than by the policy setting the control is about. Expect Windows compliance scores to move, in most cases downward, because more controls are being genuinely checked and fewer are passing without evidence. Controls whose settings sit outside the policy scan's scope are unaffected and continue to report as before.

New

• Proxmox VE update handling is rolling out to your Linux fleet as endpoints pick up the latest agent. A PVE host installs its pending updates the supported way, applying the full set in a single operation so kernel and Proxmox platform packages update correctly instead of being held back. TridentStack Control also guards against unintended major-release upgrades: a routine patch run will never move a host from one major Proxmox release to the next, which stays a separate, deliberate procedure.

• As your Proxmox VE hosts pick up the latest agent, rebooting one from TridentStack Control previews the running guests the reboot will shut down first: each running virtual machine and container is listed, and any VM whose guest agent is not responding is flagged, so you can check it before the host goes down. On a cluster node, the dialog notes that running guests are left to PVE and HA rather than stopped automatically.

• TridentStack Control is rolling out recognition of Proxmox VE hosts as they update to the latest agent: a hypervisor's cluster, quorum, node, and high-availability guest details appear on the endpoint's new Server Information tab, and PVE hosts default to blocking automatic reboots so a hypervisor is never restarted out from under its running virtual machines. If you clear that block and reboot a single-node PVE host, TridentStack Control gracefully shuts its guests down first and holds the reboot if any guest cannot be confirmed stopped, with the full record kept on the endpoint's history. The Server Information tab also surfaces each Linux host's kernel, reboot, and service-restart status, and detects services still running against an updated library even on Proxmox VE and other hosts without add-on utilities installed.

• You can now export a deployment ring's rollout schedule to a calendar file (.ics) that imports into Google Calendar, Outlook, or any other calendar app, giving you two years of recurring reminders for when patching happens. Export a single ring from the Rollout Status Calendar tab, or export all active rings at once.

Improved

• Agents are rolling out escalating, randomized reconnect pacing: as endpoints pick up the latest agent, they come back online with staggered timing after a network interruption or maintenance window, so large fleets reconnect smoothly instead of retrying in lockstep.

• The Stuck Updates tab now sorts by most recently seen, groups updates that no longer affect any endpoint into their own collapsed section, and tracks up to 60 days of history.

• A blocked update is now labeled wherever it would normally be offered on an endpoint, with your reason and, when available, who blocked it and when. It also shows up as a finding on the endpoint's health card, so a block is visible at a glance instead of only in the blocklist settings.

• Update and application details now include a step-by-step Detection Steps trace that explains why a patch or app update applies to a given endpoint, matching the detailed detection view already shown for vulnerabilities.

• The KB number (or macOS build) in an endpoint's Pending System Updates list is now a link that opens the update's details directly, on desktop and mobile, instead of requiring the right-click or Actions menu.

• The application name in an endpoint's Pending Application Updates list is now a link that opens the application's details directly, on desktop and mobile, matching the KB link in Pending System Updates.

Fixed

• Rebooting a macOS endpoint now honors the reboot countdown, rolling out as your macOS endpoints pick up the latest agent. Previously the endpoint rebooted immediately with no warning period; it now waits the configured countdown before rebooting, the same as Windows and Linux endpoints.

• Scheduled update pre-staging on Windows endpoints now retries a download automatically after a brief network interruption, instead of marking it failed until the next pre-staging window, rolling out as your Windows endpoints pick up the latest agent. A download that still fails after retrying reports how many attempts were made, so a persistent problem is easy to tell apart from a momentary one.

• Fixed a paused application update's marker and Retry button painting over the neighboring columns in an endpoint's Pending Application Updates list. A paused update now shows a compact "Paused" marker in place of its schedule, with Retry beside it.

• The update and application details dialogs now place Close on the left and the Install Now or Update Now action on the right, matching every other confirmation dialog in TridentStack Control.

• Fixed the required-version guidance for vulnerabilities that are fixed at a different version on each release line, such as Firefox and its extended support releases. A finding on a current release could show the fix version from an older line, in some cases appearing to ask you to move to an earlier version, along with an impossible affected range. Each finding now shows the correct fixed version for the installed release line, and existing findings are corrected in place on the next scan.

• Fixed the Reboot Required indicator for Proxmox VE hosts. When a newer kernel is installed but the host is still running the older one, the endpoint now correctly shows that a reboot is required instead of reporting none.

• Fixed a rare case where a Windows feature upgrade that completed successfully after a Reboot could still show as failed.

• Fixed a case where creating or updating an Endpoint Checks policy could skip some already-connected endpoints, leaving them showing outdated results until they reconnected.

• Removed three update classification options from the auto-approval rule builder that could never match an update actually offered to an endpoint, so a saved rule using one of them no longer looks active while doing nothing.

• Fixed a case where a large number of endpoints reconnecting at the same time could cause some configuration policy pushes to be reported as failed even though the policy still reached the endpoint. These deployments now settle automatically and report their true status.

• Fixed a case where an application's status could take up to 10 minutes to reflect a fresh scan after an update completed, even when the scan found something different.

• macOS security update classifications for OS upgrades are now cross-checked against an independent update catalog for greater accuracy.

• Fixed a case where a Windows endpoint whose system telemetry was not being ingested (for example, an unlicensed endpoint) could show a System State Refresh in its History as completed, with Linux details, even though no telemetry had been received. These refreshes now only complete when the endpoint's data is received, or time out honestly if it is not.

• Fixed the confidence shown on a vulnerability's detection details. Findings confirmed by an authoritative source, such as a vendor security advisory or a measured file version on the endpoint, now show as high confidence with a clear detection method instead of an unknown method with unknown confidence. Findings matched against the vulnerability database now show a confidence level that reflects how precisely the product and affected versions were identified, so a well-identified finding is no longer mislabeled low confidence. Existing findings are updated in place.

Security

• Improved the accuracy of the Malicious Software Removal Tool and Microsoft Defender platform update recommendations, so a single delayed report from an endpoint no longer causes a temporary incorrect recommendation.

New

• Reboot your fleet in controlled waves at the end of each maintenance window. Deployment rings now offer a scheduled reboot sequence: define ordered waves that select endpoints by attributes such as hostname, tag, or operating system, and TridentStack Control reboots each wave in turn once patching activity for the window has settled, verifies every endpoint actually came back up, and only then moves to the next wave, with an optional wait between waves. You choose per wave whether a failed reboot halts the remaining waves or lets the sequence continue, and a live preview shows how many endpoints each wave will match, with sample hostnames, while you edit. Each run is recorded on the ring with per-endpoint results, reboots appear in endpoint history with dispatch, reboot, and verification steps, and failed or halted sequences raise notifications through your configured channels.

• See which updates are stuck. The Rollout Status page has a new Stuck Updates tab that lists system updates that keep installing without taking effect or cannot finish, which endpoints are still affected, and why: the latest install required a reboot, a pre-install check is blocking it, the install was blocked before it could start, or the update reports success but remains applicable. Updates that are expected to reinstall regularly, such as self-updating Microsoft tools, are shown separately so real problems stand out.

• See which security settings are left over on an endpoint. The Effective Policy view now identifies tattooed settings: security values that remain configured on an endpoint after the policy that applied them was removed, or that no current policy manages. Only values that differ from the Windows factory default are reported, so a healthy stock endpoint shows none. Each one shows its current value, the location it was observed at, and guidance on how to take ownership of it by adding the setting to a policy.

• Close your account from Settings under Privacy and Data. Closing locks the account immediately, keeps your data restorable for 90 days, and then deletes it permanently. Account admins can restore the account during that window right from the closed-account screen.

Improved

• The published data retention commitments now describe the account closure and deletion lifecycle precisely: closed accounts are deactivated immediately, and all customer data is permanently deleted from production systems within ninety (90) days, with backup copies aging out on a fixed rotation. The security page, Terms of Service, privacy policy, and product documentation all carry the same commitments, and the subscription-cancellation email now explains how to close your account.

• Update rollouts now act on confirmed results: when a system update reports success but the follow-up check shows it did not take effect, TridentStack Control automatically schedules that endpoint for another attempt in the next maintenance window, with a safety cap on retries.

• Vulnerability dashboards and reports now load faster for large fleets. The fleet vulnerability summary tiles, the most-at-risk endpoints list, and the executive most-improved report return the same figures with far less work behind the scenes, so they stay quick even for organizations managing many endpoints and a large backlog of findings.

• Very large endpoint rollouts are now admission-controlled during enrollment: new endpoint registrations above a generous per-organization daily and weekly volume receive a clear retry signal instead of degrading platform performance for everyone. Re-enrollment of endpoints that are already yours is never limited, and typical onboarding volumes are unaffected.

• The API operation for previewing update applicability from manually supplied system details (POST /api/system-updates/applicable) has been removed from the API and its reference documentation. It evaluated updates with a separate scoring path whose results could diverge from what your endpoints are actually offered, so automation built on it could mislead. The per-endpoint applicable-updates operations, which return the same results the platform acts on, remain the supported way to read applicability.

• Compliance scoring now discloses its data basis everywhere scores appear: the Overview tab shows how many endpoints have current data, the Per-Agent tab flags stale or incompletely evaluated endpoints, each endpoint's compliance tab shows "Data as of" and how many controls were evaluated, and PDF reports state the coverage and freshness of every number. Evaluation errors are now reported distinctly instead of being folded into "unknown". The Vulnerabilities tab flags findings based on an outdated software inventory. Compliance scores also now count only the frameworks currently assigned to an endpoint, so a percentage may shift slightly where a framework that is no longer assigned was previously still included.

• Adding an application to an update policy from an endpoint's Software Inventory is now clearer. Selecting a policy takes you straight to that policy with the application staged and shows a clear reminder to click Save Changes to apply it, so a staged addition is no longer easy to miss and lose before it is saved.

Fixed

• Adding a second application to an update policy that already had unsaved changes no longer fails with an error. Additions after the first now stage correctly, including for macOS applications.

• Security benchmark registry settings in configuration policies now always offer a value editor. Previously, certain benchmark-sourced settings found under Administrative Templates could be added and enabled with no way to enter the required value, leaving a policy showing a setting that did nothing, and values brought in through a Group Policy import could not be viewed or edited afterward. These settings now show their registry target and a typed value field, imported values display and edit correctly, enabling such a setting without a value is rejected, and settings that already exist under Security Settings with a proper labeled editor no longer appear as unusable duplicates in the add-setting search.

• Endpoints protected by a third-party antivirus now report their Windows Defender status accurately. When another security product is active, Windows Defender stands by in a passive state; previously such an endpoint could show a green Up to Date Defender signature badge with no last-updated date, and an endpoint whose active protection changed could keep displaying its old Defender signature details indefinitely. Defender signature details now clear as soon as the Defender engine stops actively scanning, the endpoint's Defender card shows Disabled, and a signature is only reported as Up to Date when its freshness is actually known.

• Report queries that cannot be run now tell you why. When the Reporting query builder rejects a SQL query, the error now names the specific table, identifier, or rule that blocked it, such as data that is not available for reporting, instead of a generic validation message. Exporting, saving, updating, or running a saved report with a query that is rejected now returns the same clear explanation instead of a generic failure.

• Requesting a compliance PDF report now reliably produces the report. Previously, a service configuration defect could leave a requested compliance report showing as queued indefinitely without ever completing; report generation now finishes and the download becomes available as expected. Report headers also no longer repeat the framework version when it is already part of the framework name.

• Exempting a compliance control now updates the endpoint's Level 1 and Level 2 compliance scores right away, not just the combined score. Previously the level scores kept counting an exempted control until the next full evaluation, so they could disagree with the combined score.

• On narrower desktop windows, the filter controls on an endpoint's Vulnerabilities tab no longer overlap the last-updated timestamp. Crowded filter rows now wrap onto a second line instead.

• Administrator controls for shared dashboards now appear for every administrator. Previously, administrators whose access came from an assigned role could be missing the Set as Org Default option and unable to edit or delete dashboards created by teammates.

• Automatic deployment rings for Linux endpoints now re-arm on their own when new system updates become available. A completed ring picks up newly released Linux security updates on its next maintenance window without a manual reset, matching how Windows and macOS rings already behave. A ring's final phase also correctly stays open while approved Linux updates are still pending, instead of reporting complete early.

• Newly enrolled endpoints now begin reporting their installed software and available updates right away. Previously, a just-added endpoint could sit showing "Collecting..." for its pending updates until a background refresh caught up, up to about half an hour later.

• Configuration policies that include settings with adjustable values, such as maximum log sizes or specific folder and path entries, now apply reliably to Windows endpoints. Previously, a single such setting could stop the entire policy from being applied, leaving the endpoint without any of that policy's settings. This most affected large imported and benchmark-based policies.

• Advanced configuration policy settings now deploy completely to Windows endpoints. Settings that combine a list with other options now apply every part, including the setting's own on/off value, instead of only the list entries. List settings saved by older product versions now deploy again. And checkbox settings that control multiple registry values at once now write, and on disable clean up, all of their values. Previously these shapes could apply only partially, leaving an endpoint configured differently than the policy showed.

• The Effective Policy view and policy impact preview now show every value a configuration policy setting writes, with the exact desired value for each, including settings with adjustable options such as sizes, paths, and lists. Values a policy removes now display as Remove value. Previously these settings could display an unknown or incorrect desired value, and some enforced values did not appear at all or were mislabeled as leftovers from a removed policy.

• Blocking a Windows update for your organization now applies everywhere an install can start. Previously the block reliably stopped scheduled deployment-ring installs, but an update blocked for your organization could still be installed through the endpoint's Install button, a bulk install across endpoints, or a vulnerability remediation. All install paths now respect the block: manual installs of a blocked update are declined, and bulk installs skip the blocked update while installing the rest.

• Configuration policy settings that offer a dropdown of choices now save and deploy correctly to Windows endpoints. Previously a saved choice could be stored in a broken form, was never applied to the endpoint, and could display as garbled text in the policy view. Saved choices now display by name everywhere the policy is shown, and switching to a different choice also cleans up any endpoint values the previous choice had written.

• Enabling a policy setting that carries no preset value no longer removes the setting's value from the endpoint. Security baseline controls that are meant to be present but empty, such as the interactive logon message and the anonymous access lists for named pipes and shares, are now written in that hardened empty state, and endpoint conformance tracks them. Settings whose value cannot be determined are now left untouched instead of being removed.

• Policy settings that pair an on/off switch with adjustable entries, such as security scan exclusion lists, now deploy completely to Windows endpoints: the value that activates the feature is written along with the entries, so the setting takes effect instead of being silently ignored. Simple on/off settings without a preset value also now write their expected on value when enabled and remove it when disabled, using the correct value type, and the Effective Policy view shows the enforced value.

• Disabling a security setting in a configuration policy now restores the Windows default value on the endpoint where TridentStack Control knows it, instead of silently doing nothing. The setting editor now states exactly what each state does: Enabled applies the value below, Disabled restores the Windows default value, and Not Configured stops managing the setting without changing the endpoint. When a setting is Disabled, the editor shows the exact default value that will be restored, and where a setting has no reliable Windows default, such as defaults that vary by Windows edition or user rights assignments, the editor says so plainly and the endpoint is left untouched. The Effective Policy view shows and scores the restored default for Disabled settings, and disabling a user rights assignment can now be saved without entering placeholder accounts.

• Windows endpoints now reliably show and receive their .NET Framework security updates. A combined update that covers more than one .NET Framework version, such as one for both 3.5 and 4.8.1, is now offered whenever the endpoint has any one of the covered versions installed, matching how Windows Update itself applies it. Previously it was offered only when every named version was detected, so an endpoint could correctly flag a .NET Framework vulnerability while the update that resolves it never appeared as a pending update.

• Windows update catalog entries now always describe one installer. Previously an update's download link, file hash, and file size could each come from a different architecture's installer, so the listed size or hash might not match the actual download. Every entry now keeps these details consistent, updates published for several architectures show their 64-bit listing as the main entry, and existing entries with mismatched details have been repaired. Endpoint installs were unaffected: each endpoint always received the installer matching its own architecture.

• Endpoints targeted by a Windows feature upgrade policy now continue to receive their monthly cumulative updates, .NET updates, Defender platform updates, and MSRT while the upgrade is pending. Previously these updates were hidden until the upgrade completed, which could leave endpoints behind on security updates when the upgrade was deferred, blocked by hardware, or not yet deployed. Pending update counts on affected endpoints will rise to reflect the true state.

• Sorting the endpoint list now handles endpoints with a blank value consistently. A blank now sorts as the lowest value: it leads the list in ascending order and trails it in descending order, and flips ends when you reverse the sort. Previously a blank value, such as an endpoint with no scheduled Next Window, stayed pinned to the bottom whichever direction you sorted, so those rows looked like they never sorted at all.

• The endpoint list no longer reshuffles or snaps back while you are scrolling through it. The list refreshes its data in the background every few seconds; previously that refresh could reorder rows under you, and after scrolling through a large fleet it could reset the list to a shorter view. Rows now hold their position and update in place during a background refresh, and the order changes only when you sort or refresh the page yourself.

• Sorting the endpoint list now works on every column that offers it. Several columns (Last Reboot Duration, Reboots (30d), Last Vuln Scan, Installed Software, Managed Software, Current User, Architecture, Edition, External IP, Directory Join, and Secure Boot) looked sortable but quietly reordered by Last Check-in instead, so clicking their header did nothing useful. Each now sorts by its own values, with blank entries treated as the lowest value: leading in ascending order and trailing in descending.

Security

• Audit log entries are now enforced as append-only at the database layer in addition to the application layer: recorded audit events cannot be edited, and removal happens only through documented data retention and account lifecycle processes. Database schema changes are now also captured in server logs, strengthening the audit trail evidence available for compliance reviews such as SOC 2.

New

• Dashboards are now shared across your organization. Every dashboard, including ones created before this change, is visible to everyone in your account, so a dashboard a teammate builds is immediately available to you. Creators keep edit and delete rights over their dashboards, and administrators can manage any dashboard.

• You can set any dashboard as your personal favorite, not just ones you created. Your favorite loads automatically when you sign in and never affects anyone else's view.

• Administrators can set an organization default dashboard. Pick any dashboard as the landing page for everyone in your organization; users who have chosen their own favorite keep their choice.

• Add a note to any endpoint to record context such as its owner, location, or handling instructions. The note appears in the endpoint header, expands on click to show the full text, and shows who last edited it and when. If you clear a note, the header still shows who cleared it and when. Notes are shared with everyone in your account.

• Restrict and audit NTLM authentication across your fleet. Security policies now offer the complete set of seven Windows "Network security: Restrict NTLM" settings: outgoing NTLM traffic to remote servers, incoming NTLM traffic, client and domain controller NTLM auditing, NTLM authentication in this domain, and both server exception lists. Group Policy imports that carry these settings now match them automatically; previously only incoming NTLM traffic auditing was available.

Fixed

• Security policy settings that hold a list of values, such as the NTLM server exception lists, now apply to the endpoint as separate entries. Previously a multi-line list could land as a single combined entry that Windows would not honor.

• Confirmation dialogs for deleting a dashboard or a saved report now show their intended action button, such as Delete, instead of a generic Confirm label.

• On iPhone and iPad, the endpoint Health tab now lays out correctly: the 30-day health trend chart and the Servicing Health panel no longer overlap. The trend, history, and Servicing Health sections stack cleanly down the page.

• On an endpoint's Effective Policy view, configuration policy settings the endpoint has already applied now show as Pass instead of N/A, and the endpoint's conformance percentage counts them. Previously a setting could stay N/A even after the endpoint confirmed it applied the policy, understating conformance. Each endpoint's result is now judged only by what that endpoint itself applied, so one endpoint's result never colors another's.

• On an endpoint's Effective Policy view, a policy that configures the same setting at both the computer and user scope no longer appears to conflict with itself, and both values are now listed. Previously the two scopes were mistaken for a single competing setting, so one was hidden and the policy showed as overriding itself.

• .NET Framework vulnerability findings now show the correct fix and a working remediation action instead of "No remediation available" whenever the endpoint has an applicable cumulative .NET Framework update that resolves them. Previously, a finding tied to an older, preview, or different-edition .NET Framework update could show no remediation even though installing the latest applicable cumulative update would clear it.

New

• Dashboards now have shareable links. The address bar reflects the dashboard you are viewing, so you can bookmark a specific dashboard or send the URL to a teammate. Links open the recipient's default dashboard when they do not have access to the linked one.

• Dashboard widgets for Endpoint Checks: pie and time series panels that chart check policy compliance, showing passing, failing, and exempt endpoint counts for one or more selected policies. Counts combine across the selected policies, so a Windows and a Linux policy for the same requirement can be charted as one series. Compliance history begins recording when this update ships, so trend charts fill in from day one.

Fixed

• Dashboard widgets no longer disappear after picking certain time ranges. The time range picker now lists only the ranges dashboards support (1 hour to 90 days), each dashboard opens at its own configured default range when you switch to it, and dashboards built around reporting periods (such as the Executive Overview) now show just the period selector instead of a time range picker.

Fixed

• System updates that a newer update has already replaced are no longer offered to an endpoint, including updates that apply to both a Windows client and its matching Windows Server version. This removes a class of spurious "not applicable" update failures.

• Four Windows security settings (Restrict NTLM: Audit incoming NTLM traffic, Smart card removal behavior, LDAP server signing requirements, and Sharing and security model for local accounts) now list their selectable options by name when configured in a security policy. Previously the option list rendered blank, so these settings could not be configured.

Improved

• On Windows computers, the TridentStack Control tray application now loads its interface only when you open it and fully releases it when you close it. While the window is closed the app runs as a small native tray icon, freeing the memory, processes, and background disk activity the hidden interface previously kept in every signed-in session. On remote desktop and terminal servers with many signed-in users this cuts the per-session footprint substantially, and update checks from multiple sessions on the same computer are now coordinated so one check serves them all instead of each session scanning on its own.

• TridentStack Control now flags when a Windows endpoint is running an out-of-date Microsoft Defender antimalware platform or Windows Update Health Tools. These components update under a fixed KB number with rolling contents, so they never appear in the normal installed-updates history and a stale version could previously hide indefinitely. Affected endpoints now show this on the endpoint's servicing-health detail as an informational note.

• Setting up a Service or Process check in Endpoint Checks no longer trips over a file extension: if you enter a name with a trailing .exe, the check still matches, and the editor tells you how the name will be matched as you type. Previously a name entered with the extension could silently never match on any endpoint.

Fixed

• On Windows computers, the TridentStack Control tray application now recovers on its own if its interface ever stops responding, and it reliably stays a single instance for each signed-in user. Previously, after an update a rare timing issue could leave the tray unresponsive with no way to recover short of a reboot, or allow a duplicate copy to run alongside it. The app now detects a stuck interface and restarts it automatically, and a stray attempt to close the tray can no longer leave a session without single-instance protection.

• On Windows computers, a single click on the TridentStack Control tray icon now opens the app cleanly instead of also showing the right-click menu at the same time. The tray menu is also simplified: the redundant "Check for Updates" entry has been removed, since the app checks for updates automatically and its update screens have their own check button.

• On Windows computers, a per-user application update that a security product blocks or corrupts no longer stalls or leaves an error dialog on a signed-in user's screen. Previously such an install could hang for a long time, holding a Windows "this app can't run on your PC" dialog on the desktop. These installs are now time-bounded and cleaned up automatically, and the Windows error dialog is suppressed.

• On CentOS, RHEL, and Amazon Linux computers, the agent now refreshes package repository metadata before each update check. Previously it could scan against the system's cached metadata, so a newly published update might not be detected until that cache expired on its own.

• Removing the Windows agent now completes reliably instead of occasionally appearing to stall at the end of uninstall.

• Uninstalling the TridentStack Control agent from a Windows computer no longer clears an existing Windows Update or WSUS policy that was in place before the agent was installed. If your organization pointed Windows Update at its own server before installing the agent, that original setting is now restored during uninstall instead of being removed.

• On multi-user Windows computers, such as a shared remote desktop server, the TridentStack Control app now launches for every signed-in user. Previously only the first session's app opened, leaving other users without the tray icon, status, and reboot prompts.

• Windows computers now report their status to the dashboard steadily instead of occasionally flickering between online and offline. Previously a slow system query on the computer could briefly stall the agent's regular check-in, so a perfectly healthy computer could show as stale or offline for a short time even though nothing was wrong.

• On Windows computers, the TridentStack Control tray icon now stays a single, stable icon. Previously, on shared or remote desktop machines it could be rebuilt repeatedly and leave a growing cluster of duplicate, unresponsive icons in the notification area.

• On computers where more than one person is signed in at the same time, such as a shared remote desktop server, every signed-in user's TridentStack Control app now receives live install and update progress. Previously only one session's app got these updates while the others silently missed them.

• Saving Health Scoring settings now works for organization administrators. Previously, changing score weights or high-risk ports always ended in a "Failed to save health settings" error, so the settings could never be customized. Administrators can now save these settings and they apply to your organization's health scores.

• After making a change, a page refresh could briefly show the pre-change data for up to 30 seconds if the change happened while that page was already loading. Changes now always appear immediately.

• The Linux agent installer now runs on older distributions, including CentOS 7 and RHEL 7. On these systems the installer previously stopped partway through downloading the agent; installs now complete and the agent comes online normally, while newer distributions keep the full set of service protections.

Fixed

• TridentStack Control now detects vulnerabilities in the .NET Framework that is built into Windows. When .NET Framework is present as a built-in Windows component rather than a separately installed application, its version was previously invisible to vulnerability scanning, so known .NET Framework security issues could go unreported on an affected endpoint. TridentStack Control now reads the installed .NET Framework version on the endpoint and flags any endpoint running a version below the fixed release for a given vulnerability.

Fixed

• Searching the Package Catalog no longer flashes or redraws the whole page. Results now update in place while the search box stays put, keeping your text and cursor as the new matches load.
• The Pending Application Updates panel on the endpoint details page no longer shows a horizontal scroll bar: its columns now scale to fit the panel at every window size. Application rows also keep the same height as Pending System Updates rows; supplementary notes (such as an update requiring a machine-scope install) now appear in a hover tooltip on an info icon next to the application name instead of a second line.

Improved

• In the configuration policy editor, settings that share the same name now display their full category path, so you can tell near-identical options apart at a glance instead of expanding each one to check.
• Status labels in the configuration policy editor, such as the setting type and whether a setting is enabled or disabled, now appear as distinct badges instead of looking like buttons, making the Edit and Remove actions easier to find.
• Malicious Software Removal Tool (KB890830) applicability is now accurate on endpoints that do not report a tool version: TridentStack Control learns each monthly release's run marker across the fleet and uses it to tell up-to-date endpoints from outdated ones instead of always offering the update.

Fixed

• Search in the configuration policy editor now returns results immediately. Previously, typing a search term before selecting a settings category returned nothing until you first clicked into the settings tree.
• The configuration policy editor's configured view now shows every setting in the policy, including custom registry settings, each with its own Edit and Remove actions, and settings you add now appear there right away before you save.
• Resolved vulnerabilities now always leave a matching entry in the vulnerability history timeline, including ones cleared when you uninstall the affected software or, on Linux, when a fix arrives through a distribution backport or a newer kernel, so a vulnerability no longer drops off your list without a record of how it was resolved.
• Your policy version history now records custom registry setting changes. Adding, editing, or removing a registry setting in a policy creates a version entry, so you have a complete audit trail and can roll back to any point that includes those changes.
• Policy changes made through the API, for example from your own automation or RMM integration, are now captured in the policy's version history the same as changes made in the dashboard, so automated updates to security settings and registry settings no longer leave a gap in the audit trail.
• On an endpoint's Effective Policy view, configured settings no longer leave the Desired or Actual columns blank: each shows its value, a value known from a successful deployment rather than a live reading is marked as inferred so you can tell the two apart, and any setting listed as Not Available now explains why it could not be verified yet.

New

• Report on the effective policy for every endpoint. A new "Effective Policy per Agent" saved report, and the reportable data source behind it, shows which update policy wins for each device, the app and configuration policies that apply, and its conformance, all in one row per endpoint. Build your own reports from the same data source or export the fleet to CSV.
• Endpoint Checks can now alert you the moment an endpoint starts failing a check policy. Turn alerts on per policy, and if a policy suddenly starts failing across many endpoints at once you get a single summary instead of a flood of individual alerts. A scheduled compliance summary, daily or weekly, rounds up every policy that has failing endpoints, and a new Report tab shows in-scope, passing, and failing counts per policy with a CSV export you can run for the whole fleet or one policy. Alerts and summaries are delivered by email and any Slack, Microsoft Teams, Discord, or custom webhook channels you have configured.
• Advance notice before an extended endpoint allowance ends. When your account has been granted a temporary increase to its licensed endpoint count, TridentStack Control now sends an in-app notification and an email ahead of the expiry date, so you have time to plan before the extra capacity ends.

Improved

• Every email TridentStack Control sends now shares one consistent, branded look, from sign-in codes and teammate invitations to update, vulnerability, and compliance alerts. The design is tuned for light mode and reads cleanly in dark-mode email clients too, and the logo renders crisply on both.

Fixed

• An application installed for a specific user is no longer mislabeled as Not Installed when its update can only be applied system-wide. The endpoint now shows the app as installed with the update available, and the app details show it needs a system-wide install, so a program that is present is never reported as missing.
• Applications and updates that install successfully no longer get scheduled to run again shortly afterward. Previously a small number of applications and security updates could report a successful install and then reappear for installation minutes later, repeating on a loop. TridentStack Control now confirms an update against the version actually present on the endpoint, so a completed update is recognized as done and is not re-attempted.
• Endpoints already at or past a cumulative update's build are no longer offered that update when its catalog entry is missing the build number. TridentStack Control now falls back to the build printed in the update's title before deciding applicability, so a device that has the newer build does not see the older update as pending or get a scheduled install that Windows then refuses.
• An older Windows cumulative update is now correctly marked as replaced when its successor is published under the paired Windows version that shares the same update stream (for example, a version 24H2 update replaced by a version 25H2 release). Previously these replacements went unrecognized, so endpoints could keep seeing the older update as pending after installing the newer one. Each catalog sync also re-checks recent updates for replacement links that were missed earlier, so a missed link heals on the next sync.
• Optional non-security Windows cumulative updates, such as preview releases and out-of-band fixes Microsoft aims at specific affected devices, are no longer auto-approved by policies that do not filter on update classification. These updates stay visible and can still be approved manually for the devices that need them, and standing automatic approvals of this kind are withdrawn. Policies with a Classification rule keep their configured behavior, and security cumulative updates, hotpatches, and all other update types are unaffected.

Improved

• The Rollout Status page now explains endpoint results in place. Click a green Success or Completed badge to see why each update was judged successful (reported install, confirmed no longer needed after a reboot, definition updates, already up to date); a Partial or Failed badge to see which updates landed and which did not; or an Unjudged, Not Converged, Gated, Superseded, Abandoned, or Cancelled badge for a plain-language description of what happened and how it affects the rollout's success and failure numbers. Status labels are also now consistent between the overall and per-category columns.
• Maintenance windows that install only version-tracked Microsoft tools (such as the Malicious Software Removal Tool) now report a verified Success outcome once the endpoint's measured version reaches the deployed version, instead of remaining Unjudged.

Fixed

• Air-gapped agent enrollment through a self-hosted relay now works end to end. Turning on air-gapped enrollment for a relay automatically starts the secure listener that isolated endpoints use to download and enroll the agent, and the relay pre-loads the current agent installers as soon as it comes online, so a newly deployed relay no longer serves an empty catalog. The Docker run command shown in Settings now publishes every port the relay needs, and the setup and air-gapped guides spell out the port and firewall requirements. Installer errors now distinguish a bad enrollment token from a missing relay build, instead of always blaming the token.
• Fixed a case where an update or action sent to an endpoint that had recently gone offline could fail to reach it and show as incomplete. Endpoint online status is now tracked more accurately, so these actions dispatch reliably once the endpoint reconnects.
• Fixed remediating a vulnerability across every affected endpoint at once: the fleet-wide fix now reliably queues the update on each endpoint. Previously this action could finish without queuing the fix on any of them.
• Endpoint status no longer briefly flips to offline or stale while the endpoint is still connected. Status now reflects any live contact from the endpoint, so a connected endpoint whose routine system check is momentarily slow keeps showing as online.

New

• You can now block a specific Windows update from ever being deployed to your endpoints. A blocked update is refused on every install path, including scheduled deployment rings, bulk installs, and vulnerability remediation; installs that were already queued but had not started are cancelled; and the update stops counting against your compliance and health numbers. Each block records who created it and the reason, the reason is shown wherever the update is refused, and removing the block returns the update to your normal deployment flow. Manage blocked updates from the System Update Policies page.

Improved

• Updates that can only be installed by hand now show up on the endpoint that needs them, in its Update Health, naming each update and what it needs. That endpoint reads "Action recommended" rather than Healthy, so the work is visible instead of quietly skipped, with a link explaining why these updates cannot be installed remotely. The notice never stops the endpoint's other updates from installing and never causes an update run to be reported as failed, and you can dismiss it if you have decided not to act on it.

Fixed

• Signing up for the billing dashboard with an email code now reliably creates and signs you into your new account. Previously, if you had already signed into a different account in the same browser, a first-time email signup could sign you into that earlier account, and the account setup form could appear for a moment and then disappear. First-time email signups now keep the setup form on screen and finish into the correct new account.

Improved

• Installing a custom package now runs a vulnerability scan automatically once it completes, and groups that scan and the follow-up application check under the install in the endpoint's history, so the whole sequence reads as one action instead of separate entries.
• On an Endpoint Checks policy's results, you can now expand any endpoint to see its individual checks inline, passed and failed, without opening the endpoint. Failing checks are listed first, each with the reason it failed.
• Setting how much a check policy affects endpoint health is simpler: give the policy a single health penalty and it is deducted once when the policy is failing, instead of tuning a number on every check. Existing policies keep a starting penalty based on their current checks, which you can adjust in the policy editor.
• Sign in to your billing dashboard with the same options as TridentStack Control: continue with Microsoft, continue with Google, or sign in with an email code. Continuing with Microsoft or Google now always shows your account picker, so you choose which account to use every time, and picking an account you are already signed in to signs you in right away without retyping your password.
• The email with your sign-in code now matches the rest of TridentStack Control's look.
• If you request an email sign-in code but your organization signs in a different way, you now receive an email pointing you to the right sign-in option, instead of the request appearing to do nothing.
• Signing in with an email code is faster on iPhone and iPad: your device offers the code above the keyboard so you can fill it in with one tap instead of typing it, and pasting a copied code fills all six boxes at once.

Fixed

• Fixed Windows cumulative updates that Microsoft publishes under another architecture's catalog listing (for example, an update titled "for arm64-based Systems" that also ships the x64 package) not being offered to endpoints of the matching architecture. Previously, an affected monthly update could show as not applicable for an entire fleet; those updates now appear and install normally, and monitoring was added so this class of gap is caught the same day it appears.
• Fixed the search box on an endpoint's Software Inventory losing focus when you deleted text (for example, pressing Backspace) while no results matched, which forced you to click back into the field to keep searching. The search box now stays focused while you type and edit.
• Fixed deploying an application to an endpoint failing with "No installer available for this package" on some newly added Windows machines. When an endpoint's built-in installer is not yet ready, TridentStack Control now falls back to a direct download of the application, so a one-time deployment installs the same way it already did for scheduled and bulk installs.
• Fixed being able to start a second update install on an endpoint while the previous install was still being verified. TridentStack Control now waits for the current install to finish its post-install check before accepting another, on every path that can start one: manual installs, bulk "Update All", one-time deployments, scheduled deployment rings, and vulnerability remediation. An endpoint no longer shows two installs in progress at the same time, and a scheduled deployment that reaches an endpoint still verifying simply picks it up in the next maintenance window.
• Fixed a bulk or scheduled update install being reported as accepted even when none of the selected updates could be delivered to the endpoint, which left an update task that never ran. An install with nothing deliverable is no longer started, the updates that could not be installed are named back to you, and any updates in the same request that can be installed still go ahead. This applies on every path: bulk "Update All", scheduled deployment rings, and single-endpoint installs.

Improved

• The account portal sign-in now lets you switch accounts. If your browser keeps signing you into the wrong Microsoft or Google account, turn on "Use a different account" and you will be shown the account chooser instead of being sent straight back into the same one.
• When you build an Endpoint Check that watches a log file, the match-count field now reads correctly for the direction you picked. A check that fails when a pattern is missing (for example a heartbeat line that stopped appearing) labels the field "Fail if fewer than this many matches", so it reads as the minimum you expect to see rather than a ceiling. The label updates the moment you change the mode.

Fixed

• Team members who do not manage billing are no longer locked out of your account portal. Before, anyone without billing access was blocked from the entire portal, including support. Now they can sign in, open a support request if they are eligible, and any billing area they cannot manage shows a clear message that names your account's billing owner and explains how to be granted access.
• Deploying a custom package, or an application from the catalog, to your Windows endpoints downloads and installs reliably again. A recent change to how installer files are delivered could make the download step fail immediately on the endpoint before any data was fetched; those deployments now complete as expected.
• Endpoint Checks now keep reporting on endpoints that have stayed connected for a long time. Previously a check could sit on "Pending" and never return a result until the endpoint reconnected; those endpoints now recover on their own and their checks report on schedule.
• System update validation no longer stalls on "Validating" when an endpoint drops offline partway through the post-install checks. Those installs now reach a final result on their own instead of showing "Validating" indefinitely.

Security

• Your audit log now covers more of the administrative actions that change endpoint tags. Disconnecting your Microsoft Entra integration or deleting a group-to-tag mapping is now recorded, including how many endpoints lost a synced tag, and deleting an endpoint now records how many tags it carried. Every change that strips a tag from an endpoint is traceable in your account history.

New

• Endpoint Checks let you define what a correctly configured endpoint looks like, then watch continuously for the ones that drift. A check policy is a set of checks covering installed applications, services, running processes, files, registry values, scheduled tasks, certificates, and patterns in a log file. You assign it by tag and choose how often it re-evaluates. Results land on each endpoint's Checks tab, in its health score, and in a Checks column on the endpoints list, and every check shows the value that was observed, so an uninstalled security agent or an expired certificate surfaces on its own instead of waiting for someone to notice. Checks can be grouped so a policy passes when any one group is satisfied, which covers endpoints that meet a requirement in more than one valid way. Windows and Linux endpoints are supported.

Improved

• On the Endpoint Checks page, selecting a check policy now opens it in place to show its full configuration, its assignments, and the checks it runs, so you can review a policy without leaving the list. You can also right-click any policy, or use its actions menu, to edit, duplicate, or delete it directly from the list.

• The endpoints list now opens with a more useful default column layout focused on patch and health: pending system and application updates, critical and total vulnerabilities, last reboot duration, and update health, alongside status, hostname, operating system, current user, and uptime. New accounts get this layout automatically, and "Reset to defaults" in the Columns menu returns any view to it. Saved views you created are left untouched.

• Saving and managing your saved table views is clearer. The Columns menu now shows a labeled "Save view" button in place of a bare plus sign, and each saved view's actions (rename, share with your team, set as default, delete) sit behind a clearer options menu, so it is obvious there is more available than renaming.

• Windows updates that can only be installed by hand on the endpoint, such as recovery environment and Secure Boot updates, are now labeled "Requires manual installation" in vulnerability remediation instead of offering a remote install that cannot succeed. This applies to the fleet remediation dialog and each endpoint's remediation details, with a link explaining why these updates are different.

• Known issues are now shown for more Windows updates. Microsoft documents some known issues only on an update's support article rather than in its structured feed, and those had stopped coming through. They are included again, so the known issues listed on a Windows update are more complete, including for older Windows Server and long-term-servicing releases.

• A Windows system update is now reported as successful only once TridentStack Control confirms the update actually took effect on the endpoint, rather than the moment the endpoint says it finished installing. An install that has been reported but not yet confirmed shows a Validating stage in the endpoint's history, and expanding it lists each update as cleared or still present. If an update needs a reboot, the install waits for that reboot instead of being marked failed, and picks up where it left off when the endpoint comes back, even days later.

• A small set of Windows updates cannot be confirmed from outside the endpoint, no matter how the install went. These now finish as "Installed, not verified" instead of alternating between success and failure, with an explanation available right on the result. They are never counted as failures, and they no longer distort success rates or endpoint health.

Fixed

• The left navigation now keeps Endpoints highlighted while you are viewing an individual endpoint's details, so it stays clear where you are and where the back button returns you.

• Sorting the endpoints list by free disk space works again. Choosing that column previously failed to load the list; it now orders your endpoints by available space, most or least free first.

• Deleting a custom package from the Package Catalog now removes the package and all of its versions in one step, even when several versions exist. Before, the delete was refused with a request to remove every version first, and that error could leave the Custom packages list unable to load until you refreshed.

• Creating, renaming, or deleting a custom package is now recorded in your System Audit, so every change to your custom package library shows who made it and when. Before, these actions left no audit trail.

• Running or editing a saved report or a report template from the Reporting Templates page works again. Selecting Run sent you to the Query Builder but stopped short of executing the report; it now runs right away and shows your results, and Edit opens the report ready to change.

• When you set up an Endpoint Check that scans a log file on Windows endpoints, a log path that is not a valid Windows location is now caught the moment you save it, with a message showing the expected format (a drive letter such as C:\ or a network share). Before, a mistyped path could be saved and would then quietly fail on every Windows endpoint it applied to.

• When an application update has been paused after repeated attempts that did not change the installed version, that pause now shows directly on the endpoint's pending updates, with a Retry action to try it again without leaving the page. This state was previously visible only on a separate inventory view, so an update could sit paused with no sign of it where you look for pending work.

• The install success figure shown next to each pending application update is now clearly labelled as a success rate across all endpoints that have installed that package, so it is not mistaken for this endpoint's own result. A package with a zero percent success rate also now shows that figure instead of appearing to have no data.

• Pre-staged update files are cleaned off your endpoints again once they pass the retention window you set. A fault stopped the scheduled cleanup partway through, so cached update files from ring pre-staging could pile up on endpoints instead of being reclaimed after retention. The cleanup now runs to completion and removes them as configured.

• Update installs no longer occasionally appear as Failed in an endpoint's history when the install actually completed. The final status is now recorded after TridentStack Control finishes processing the result, so the history reflects what happened on the endpoint.

• Estimated install times for Windows system updates are now based on each update's own install time. Previously, every update installed in the same maintenance run was credited with the run's full elapsed time, which made fast updates such as monthly security tools and .NET patches look dramatically slower than they are. Historical statistics have been recalculated, so estimates correct themselves immediately.

• Vulnerabilities now clear reliably once the fixed version of the affected software is installed. Some vulnerabilities could stay flagged on an endpoint that had already been updated, because two forms of the same version number were not compared as equal. The version comparison is now exact, so a remediated endpoint stops showing the vulnerability on its next scan.

• A vulnerability fix that is scheduled for a future maintenance window now reads "Scheduled to install" and shows the exact date and time it will install, the same time shown for that update in your pending updates, instead of the inaccurate "is installing on this endpoint." The remediation panel and the fleet remediation view report an install as in progress only when one is running.

• Vulnerability remediation status is now accurate for endpoints that already installed the fix. A patched endpoint could show a vulnerability as "Approved, awaiting next applicability sync" indefinitely, naming an update meant for a different Windows edition that could never apply. The platform now recognizes the installed fix anywhere in an update's supersedence history, no longer offers updates from another Windows family as a fix, suppresses the detection when the endpoint's own build shows it is already patched, and names the exact update in the remediation status instead of a generic message.

• Windows Server 2025 endpoints now show monthly Windows Security platform updates (KB5007651) as missing when they need them. Server 2025 runs the same Windows security app as Windows 11, but the missing-updates list previously treated this update as Windows 11 only, so Server 2025 endpoints under-reported. Missing-update counts on Server 2025 endpoints may rise when this takes effect: that is the list becoming accurate, not new problems appearing.

• A cumulative update an endpoint reports as installed is now checked against the endpoint's actual OS build before it is removed from the missing-updates list. If the build shows the update has not taken effect, for example after a pending reboot or a stale report, the update stays visible instead of the endpoint looking fully patched while still on the older build. Updates that are re-released monthly under the same identifier are also no longer hidden just because a previous month's release is present. Missing-update counts may rise when this takes effect: those updates were always needed and were hidden by self-reported install status.

• TridentStack Control no longer hides a monthly re-released update, such as the Malicious Software Removal Tool, from the missing-updates list for 7 days after an install reports success. Visibility now follows the endpoint's reported state directly, so an install that did not take effect surfaces again right away instead of a week later.

• Updates whose install state cannot be confirmed from outside the endpoint, such as the Malicious Software Removal Tool and the Windows Security platform update, no longer count for or against deployment automation and scores. Their outcomes previously fed ring progression, emergency halts, endpoint health scores, missing-update counts, and per-update success rates, which could hold a deployment ring at its final phase for weeks or lower an endpoint's health score for updates that were working as intended. These updates remain visible on each endpoint's update list; they are simply no longer scored.

New

• Remediate a CVE across every affected endpoint from one place. Open Reporting, Vulnerabilities, then the Remediate action on any CVE row to review each affected endpoint, pick which ones to patch, and push the fix. The fix does not need to be part of a policy first, so you can push a one-off patch for an urgent vulnerability without authoring policy around it.

Improved

• Pre-staging downloads are now skipped for endpoints with less than 2 GB of free disk space, preventing large update files from filling drives that are already near capacity.

• When a pre-staged download fails hash verification on first attempt, TridentStack Control now dispatches a cleanup command so the corrupt file is deleted before retry. Previously only repeated failures triggered cleanup, allowing corrupt files to loop indefinitely.

Fixed

• Force Reboot at end of execution now fires correctly after feature upgrades (e.g. Windows 11 25H2 enablement). Previously, feature upgrade completions bypassed the Force Reboot check, so endpoints completing a feature upgrade were not rebooted even when Force Reboot was enabled.

• Relays that are still waiting to be set up can now be renamed or deleted. Previously, only the Resume Setup button was available, so abandoning a relay you no longer need required completing setup first.

• Installing app updates across several endpoints at once now counts only the updates that were queued, and names any that were left out. Previously the confirmation counted every app you selected, including ones that were declined because the endpoint had no pending update for them, so the number could be higher than what appeared in the endpoint's history.

New

• Self-hosted relay servers let endpoints connect to TridentStack Control through a local relay instead of reaching the gateway directly, so sites with restricted outbound access can be managed without opening a per-endpoint firewall rule. Create a relay in Settings, run a single command to install it on Linux, Windows, or Docker, and copy the pre-filled agent install commands from the relay card to connect endpoints. Endpoints with no internet access at all can install and enroll entirely through the relay. Relays update themselves automatically when a newer version is available.

Improved

• The client app can now be locked down on specific endpoints instead of the whole organization. Hiding the tray icon, blocking manual system update installs, and blocking manual application update installs each accept a list of tags on Settings > Client, so a shared machine such as a terminal server can be restricted while everyone else keeps the client app as it is. The lists only ever add restriction, and they apply within seconds of saving or of tagging an endpoint.

• Network port history is now retained for 90 days. An endpoint's Network tab shows the last 90 days of port and service activity, and older entries are removed automatically.

Fixed

• Searching for a CVE ID in the System Update Catalog Browse page no longer returns an error.

• System updates that target a specific processor architecture (x86 or ARM64) are no longer offered to endpoints running a different architecture, preventing unnecessary failed install attempts.

• Granting temporary support access from Privacy settings now works. Creating a grant previously failed, so the time-limited access it is meant to issue could never be issued.

• Paging through a sorted Endpoints list no longer skips or repeats an endpoint. When two endpoints tied on the column you sorted by, their order was undefined and could differ between page 1 and page 2, so an endpoint could appear twice or not at all.

• The Vendor Access Log in Privacy settings now names the staff member on each row. The Staff Member column previously showed a dash for every entry, so the log recorded that access happened without recording who.

• An update install that installed nothing no longer reports success. When an endpoint returns no results for the updates it was sent, the task now finishes as Blocked and shows the reason the endpoint gave, so a run that quietly did nothing is visible instead of appearing complete.

• On a phone, tapping the Update Health status on an endpoint card now opens its details properly. The details panel appeared squeezed inside the card instead of sliding up from the bottom of the screen, and dismissing it opened the endpoint you were reading about.

• Settings that hold a list of entries, such as SNMP communities and permitted managers, now each appear as their own row on an endpoint's Effective Policy tab. Two list settings in the same policy previously shared one row, so one of them was missing from the list and the policy was reported as conflicting with itself. The settings were always applied correctly on the endpoint; only the report was wrong.

• A vulnerability whose fix only exists in a newer major version of an application is now labeled as a major version migration instead of offered as a routine update. This was already the case for most applications, but not when the vulnerable component was installed as part of a larger package. Installing the routine update in that situation would not have closed the vulnerability, so it could look resolved when it was not. The migration target is now named on the vulnerability, so you can plan the upgrade.

Improved

• The endpoints list on a phone now shows each endpoint's tags and lets you change them without opening the endpoint. Tap the actions button on any card and choose Manage Tags. Previously tags were neither visible nor editable from the list on mobile, so every tag change meant opening each endpoint one at a time.

• Deployment ring rollout status now shows endpoints that belong to a ring's policies but have not been dispatched yet. Each "Not Targeted" endpoint shows a reason (offline, already up to date, or awaiting deployment) so you can see at a glance why an endpoint is not part of the current rollout without leaving the page.

• The free CVE lookup now has its own navigation bar. You can move straight between the catalog, the CISA Known Exploited list, the weakness index, the statistics page, the API docs, and the data-sources page from any one of them, instead of going back to the catalog first.

• Every CVE page now ends with a plain-language summary answering what people actually ask about a vulnerability: how to fix it, whether it is being exploited, how severe it is, and what it affects. The answers are assembled only from the advisories already cited on that page, and a question with no sourced answer is left out rather than guessed at.

Fixed

• The vulnerability scanner now detects CVEs that NVD files under year-specific or edition-specific product names, not just the generic name. This closes a gap where products like SQL Server, Edge pre-release channels, and Azure DevOps Server could miss hundreds of applicable CVEs because the scanner only checked one product name when NVD uses two.

• Deployment rings now rotate which endpoints are picked for each phase instead of always selecting the same ones. Previously, if a phase had more eligible endpoints than slots, the same subset was chosen every cycle, leaving the rest permanently unpatched until the phase filled.

• Custom packages can now be deployed to Linux endpoints from the Deploy Application dialog. Previously the Custom tab only appeared when your selection included a Windows or macOS endpoint, so a Linux-only selection could not reach it, even though DEB and RPM packages install correctly.

• Subscribing to the CVE feed in a feed reader works again. Feed readers were being shown a browser verification step that they cannot complete, so subscriptions quietly stopped updating with no visible error. If your reader dropped the TridentStack Control CVE feed recently, it will pick it up again on its next refresh.

• Pre-staged updates that reported a hash validation failure without a computed hash could get stuck: shown as downloaded but never eligible for installation and never re-downloaded. The platform now resets these to pending so the next pre-staging cycle re-downloads them, and stops deployment rings from dispatching a pre-staged file whose hash was never confirmed.

Improved

• Reorganized the left navigation so related pages sit together. Configuration Policies now lives under a new Orchestration section, and Vulnerabilities, Compliance, and reporting all live under Reporting. Saved reports and report templates moved out of the query surface onto their own Reporting > Templates page, so building a query and browsing saved work are no longer the same crowded screen. Automation is now labelled Tag Automation to match what it does. Page addresses now match the new grouping, and any existing bookmark or saved dashboard link redirects to the new address automatically, so nothing you have saved stops working.

Fixed

• Files and screenshots you attach to a support ticket now reach us and stay attached. Attachments uploaded since late June were being rejected at the point of saving, so a ticket that said "see the screenshot" arrived with nothing on it. Attachments now save reliably, survive platform updates, and open from the ticket for our support team. If you opened a ticket recently and referenced a screenshot we never mentioned, it is worth re-attaching it.
• Opening a support ticket now tells you if an attachment could not be uploaded. Previously the ticket was created and you were taken straight to it with no indication that the files had been dropped, so neither you nor we knew anything was missing. You now get a clear notice naming the ticket, with the option to email the files instead.
• An endpoint with no policy assigned no longer reports itself as up to date. Both the Pending System Updates and Pending Application Updates panels used to show a green tick and "up to date" for these endpoints, which read as a clean bill of health when in fact nothing had checked them. They now show "Update status unknown" with which policy is missing and a shortcut to fix it.
• An endpoint that no policy targets no longer lists system updates as pending. Previously, if an endpoint lost the tag that connected it to its update policy, the updates worked out under the old policy stayed on the endpoint page as pending for up to fifteen minutes, so the page could show updates waiting to install directly underneath a note saying nothing was checking that endpoint. The pending list now empties the moment the policy stops applying.
• The "no update policy is checking this endpoint" warning is now a quiet line inside the Pending System Updates panel with a Manage Tags shortcut, matching how the Pending Application Updates panel already reads. It was previously a large warning banner across the top of the panel, which overstated a routine setup step.
• Turning off "Count app-update failures toward this halt" now genuinely stops app update failures from halting a rollout. Previously the setting only covered rollouts that install app and system updates together, so a rollout that installs applications only could still be stopped by a single stubborn app that would not install, night after night. Rollouts that install applications only now honor the setting, and a failed app no longer counts against the safety threshold unless you ask it to. Failures that also affect system or feature updates still count, so genuine problems still stop a rollout.
• A rollout phase that targets tags now shows those tags on the phase card instead of a target percentage. The card previously displayed a percentage and a minimum endpoint count that a tag-targeted phase never uses, which made it look like the phase would deploy to a slice of the fleet rather than to exactly the tagged endpoints. Which endpoints a tag-targeted phase deploys to has not changed.
• The tridentstack.com website now reads correctly on a phone. On narrower handsets the dashboard illustrations were overlapping their own text, the product tables were squeezing columns down to a few unreadable pixels, and some pages could be dragged sideways off the edge of the screen. Every page has been rechecked at eleven screen widths from 320 pixels up to desktop, and the illustrations now simplify to a single column with readable labels rather than being crushed into a desktop layout.

Improved

• CVE detail pages on the public vulnerability lookup now load substantially faster, especially for widely-affecting CVEs that list fixes across thousands of packages. The busiest pages previously re-fetched their full fix list on every view; they are now served from cache.
• Agent connections recover more steadily after a platform interruption. When a large number of endpoints reconnect at once, policy synchronization is now paced instead of being attempted for every endpoint simultaneously. Every endpoint still syncs, and recovery is less likely to be slowed by the reconnection itself.
• Automated tools that consume the CVE catalog are now pointed at the bulk download endpoint, which returns the entire catalog in a single request. They were previously steered away from it and toward the much slower page-by-page route.

Fixed

• CVE pages that list an unusually large number of affected packages now say when the fix list shown is not the complete one, and point to the referenced advisories for full coverage. These pages previously showed a shortened list with nothing to indicate anything was missing.

Improved

• Application updates that cannot install on an endpoint's Windows version are now identified automatically and held back at the newest version that does work, instead of failing to install over and over. A held update stays visible on the endpoint with the reason it is held, is not offered for installation, and no longer counts against the endpoint's health score. If a newer version later installs successfully on that Windows version, the hold lifts on its own.

Fixed

• Installing updates on several endpoints at once now reports what actually happened. The activity record previously showed zero updates for these runs even when the updates were queued and installed successfully, and the confirmation message reported success even when every selected endpoint already had nothing pending. Both now show the real number of updates queued, how many endpoints were skipped, and why.
• Attaching an update policy to a tag from the policy's own page now refreshes pending update counts for the affected endpoints right away, instead of leaving them showing stale counts until the next scheduled refresh.
• Windows and macOS endpoints that no update policy targets now say so directly, instead of showing an empty update list that looks the same as being fully up to date. The message explains that a policy reaches an endpoint through the tags it carries. Endpoints whose assigned policy is currently disabled get their own message naming that policy.
• Links from the update coverage message now open the System Updates page instead of silently returning you to the Dashboard.
• The conflict count on an endpoint's Effective Policy tab now matches the settings you can actually find. Settings contested by two of your own policies, or by two domain policies, are now marked in the Conflict column alongside cross-source conflicts, and the count is clickable to filter the table down to just those settings.
• A setting configured twice by the same policy no longer appears as two identical rows on the Effective Policy tab, where it also skewed the conformance percentage.
• The vulnerability count at the top of an endpoint now matches the list beneath it. When one CVE affected several installed packages it was counted once per package, so the headline could claim several times more vulnerabilities than the endpoint actually had. Counts are now per CVE, so some endpoints, mostly Linux ones, will show a lower and more accurate number.
• The Enabled and Disabled counts on the Automation page now describe every rule instead of only the ones scrolled into view, so they add up to the total again for tenants with more than fifty rules.
• The endpoint list header now accounts for endpoints that have registered but not yet reported in, under a new Enrolling count, so Online and Offline add up to the total instead of leaving an unexplained remainder.
• On a phone, the endpoint list now keeps loading as you scroll instead of stopping after the first page while the header promised more.
• The Managed count on an endpoint's Software Inventory now counts the same applications the list marks as managed. Software managed through a macOS package policy was previously missing from the count entirely, an application installed for several users was counted once per user, and the Scope filter narrowed the list without narrowing the counts above it.
• The conformance percentage on an endpoint is now the share of settings that actually match, out of the settings the endpoint has reported a value for. Settings it has not reported yet are shown as an Unknown count but no longer count as failures, so endpoints with nothing non-conformant now read 100% instead of an unexplained lower score.
• The network summary on an endpoint now counts the same listeners the port list shows. A Linux service listening on both IPv4 and IPv6 was counted twice above a table that showed it once, so the listening, exposed, and high-risk counts could all read higher than anything you could find.
• Custom application packages you upload for deployment are no longer incorrectly held back during upload scanning, so legitimate packages deploy as expected.

Improved

• The dashboard Fleet Health Score now aggregates the same per-endpoint health scores shown in your endpoints list and its trend line, so the headline figure stays consistent with the detail beneath it.
• Windows feature update downloads now scale cleanly on large sites where many endpoints share a single public IP address, so a deployment ring can roll a feature update out to an entire office without the downloads being throttled.

Fixed

• Deployment rings now keep a rollout moving while long-running updates finish installing, and they follow your safety-control settings exactly, halting only on genuine failures when those controls are enabled.
• Deployment ring safety control settings now display and save exactly as you configure them.
• Application updates now select the English installer when a package offers several language variants, for more consistent installs.

New

• New accounts now start with a complete, conservative baseline: automatic OS-based endpoint tagging, a system update policy with a 7-day quality bake, two app update policies (popular apps kept current, server tools held at N-1), and three ready-to-attach deployment rings. Nothing installs until you attach a ring.
• Monthly and twice-a-month deployment ring schedules. A deployment ring window can now open on a specific occurrence of a weekday each month, such as the 2nd Tuesday, instead of only a weekly day-of-week schedule. In the window's Repeat setting, choose Monthly, pick a weekday, and select one occurrence (1st, 2nd, 3rd, 4th, or Last) for a once-a-month cadence or two for twice a month. Existing weekly windows are unchanged, and the ring's Next Window time reflects the monthly cadence.
• Force Reboot for deployment rings. A deployment ring can now guarantee its endpoints reboot at the end of an update run, even when no single update required a reboot. It is off by default, respects each endpoint's own reboot opt-out, and clearly shows in the rollout status when an endpoint opted out.

Improved

• The tag selection dialog now has a search bar: when assigning tags to an endpoint (or to several at once), type to filter the tag list by name or description instead of scrolling. It appears automatically once your account has more than a handful of tags, and tags you have already checked stay selected while you filter.
• The setup guide now walks every module from Endpoints to Rollout Status, explains the defaults created for your account, and advances instantly on every click (no more timed pauses).
• Moving through the setup guide is smoother: the button that advances to the next step now glows so it is clear what to click, a new back arrow lets you return to an earlier step, and the guide explains that your starting tags, policies, and deployment rings were preloaded as sensible, best-practice defaults.
• Windows updates that fail because the endpoint's component store is corrupted now show a clear cause and the exact repair step, instead of a bare number like "Exit code 14081". This covers the common component store corruption failures (a required system component missing or damaged), so you know at a glance why a cumulative update did not install and how to fix it.
• Windows endpoints with a corrupted component store are now flagged on the endpoint's health view, with the exact repair step to run, so you can catch and fix the problem instead of only finding out when an update fails. It is detected both when a cumulative update fails with that error and from the endpoint's own servicing logs.
• Standardized reboot wording across the platform: powering an endpoint off and on is now consistently called "Reboot" (the "Reboot Endpoint" action, "Reboot Required", "Reboot pending", reboot settings), while "Restart" now refers only to a service or application. This removes the confusing "Restart Agent" label that read as if it restarted the TridentStack Control agent rather than the machine itself.
• New updates now appear on your endpoints within minutes of being published to the TridentStack Control catalog. Update and application catalogs also refresh more frequently throughout the day, so Patch Tuesday releases and new application versions show up as pending automatically, with nothing to refresh by hand.
• Uploading a custom package now shows clear, staged progress while it is scanned: preparing, scanning for malware, verifying the installer, and reading package details, with a note that it can take a minute or two and continues in the background. A thorough security scan of a large installer no longer looks like it has stalled.
• The Agent Tags list now shows, at a glance, which policies each tag applies: its System Update Policy, Application Update Policy, Compliance Frameworks, and Configuration Policies. When a tag has more than one compliance framework or configuration policy, the column shows the count. The new columns appear by default and can be shown, hidden, reordered, and resized from the Columns menu, so you can review a tag's full policy coverage without opening each tag.
• Select a range of rows at once: click one checkbox, then Shift-click another, and every row between them toggles together (endpoints, license, and update tables).

Fixed

• Uploading a large custom package now works. Installers up to 2 GB are scanned for malware and published successfully; previously an installer over roughly 100 MB could fail its security scan with an unclear message.
• Custom package details now show a clean publisher and product name. Stray trailing characters, such as a leftover slash or comma, are removed from the values TridentStack Control detects automatically from the installer.
• Software inventory now records reliably on Macs with a large number of installed applications. Previously a Mac with a very long application list could silently fail to report its installed software, leaving its software inventory empty and its vulnerability and update coverage working from incomplete data. Those endpoints now sync their full application list.
• The endpoint Health tab now loads reliably on endpoints with a very large number of detected vulnerabilities. Previously an endpoint with many thousands of findings (common on a freshly enrolled Linux server) could fail the Health tab with "Failed to load health data," and could briefly affect the Health view for other endpoints too. The health score and its vulnerability, compliance, update, and network breakdown now load as expected.
• The "last refreshed" time on the Pending System Updates view for Linux endpoints now reflects the most recent automatic update check. Previously it could show an older time even though pending updates had just been re-checked in the background.
• Removed a brief "Something went wrong" flash that could appear when clicking a navigation item in a browser tab that had been open across a TridentStack Control update. The app now shows its normal loading indicator while it refreshes itself to the new version, and the error screen is reserved for genuine failures.

New

• TridentStack now has an official community Discord server for free support, product news, and feature discussion: https://discord.gg/nNyHySNSZF. Join links are in the website and documentation footers and on the changelog page.
• Video walkthroughs are now published on the official TridentStack YouTube channel: https://www.youtube.com/@tridentstack. Links are in the website and documentation footers.

Improved

• Rollout status now clearly distinguishes an endpoint that failed but will be retried automatically ("Retry scheduled", with the next attempt time) from one that has genuinely stopped, so a failed patch no longer looks like a dead end.

Fixed

• A Windows feature update that could not start because a device was waiting on a pending restart is now correctly shown as a deferral that retries automatically after the restart, instead of being recorded as a failed upgrade. This also prevents a group of restart-pending devices from unnecessarily halting a deployment ring's rollout to the devices that are ready to upgrade.
• The advisory notice shown on a device after an operating system rollback (for example a restored snapshot or an uninstalled feature update) now clears automatically once the device's refreshed system data arrives, instead of remaining visible indefinitely. Devices that are offline when the rollback is detected also keep their automatic data refresh queued until they reconnect, no matter how long they stay offline.
• System details for Linux devices in the Enterprise Linux family (Rocky, RHEL, Alma) now populate correctly. Their longer kernel version identifiers previously failed a storage limit, which could leave a newly enrolled device's system information blank indefinitely.
• Newly enrolled Linux devices now come online as soon as their initial data collection finishes (typically under two minutes), instead of always sitting in onboarding for the full five-minute safety window.

New

• TridentStack Control now warns you before a policy or security-baseline template would set a Windows service to Disabled that Windows needs in order to install its monthly cumulative updates. Disabling one of these services silently causes those updates to fail and roll back on the affected endpoints, which can look like update corruption; the new heads-up appears while you configure the policy (and when importing settings or applying a compliance baseline) so you can choose a safe startup type instead. The warning is advisory and does not block you if the change is intended.

Improved

• Update approval criteria that check for known Microsoft issues now consider only issues Microsoft still lists as active. Updates whose reported issues have all been resolved by Microsoft are no longer held back from auto-approval, matching what the update details already show.
• The auto-approval condition for updates with known issues is now named "Unresolved Known Issues", making it obvious that an update is only held back while its reported issues remain unresolved.
• Auto-approval policy criteria now show an in-line help icon that explains what each condition matches, so it is clear what a rule such as "Unresolved Known Issues" or "Update Age" actually does while you build a policy.
• Known Microsoft issues on recently released Windows updates now refresh daily instead of weekly, so newly reported problems and Microsoft resolutions reach your approval decisions much sooner.
• A Windows update that TridentStack Control is holding back after it repeatedly failed to install (for example, one an endpoint rejects while applying it during a restart) is now clearly flagged on the endpoint's page, with a Retry control to attempt it again once you have resolved the underlying endpoint issue. Previously a held-back update stayed in the list with no indication it was being held back or how to re-attempt it.
• When a Windows feature update (a major version upgrade, such as moving an endpoint to a newer release of Windows 11) does not complete, the endpoint's History now shows the specific reason it did not finish, such as the upgrade rolling back during setup because of a device driver, being blocked by an incompatible application, or not having enough free disk space. Previously these showed only a generic failure, and finding the cause meant collecting logs from the endpoint.

Fixed

• Fixed some Windows updates (notably certain .NET runtime updates on 64-bit servers) being downloaded with a mismatched-architecture installer, which made them keep showing as needed and reinstall every maintenance window even after a successful install. TridentStack Control now downloads the architecture-matched installer, so these updates apply once and clear.
• Fixed a case where a system update that cannot successfully install on an endpoint (for example, one Windows rejects while applying it during a restart) would keep reinstalling and restarting that endpoint every maintenance window. TridentStack Control now confirms an update actually took effect after the restart; one that repeatedly does not is held back from further automatic attempts (it stays listed as needed) and can be retried from the agent once the underlying endpoint issue is resolved.
• Fixed a display issue where the system update policy editor, the application update policy builder, and the automation rule editor could show two vertical scroll bars at once. These pages now use a single scroll area.
• Fixed a rare condition where a temporary Microsoft service outage during catalog enrichment could briefly clear the known-issues list on affected updates. Known-issue data is now always preserved until fresh data is confirmed.
• Fixed auto-approval policies silently skipping updates that had previously been superseded and later became relevant again, so they now get approved the way the policy intends instead of requiring manual approval.
• Fixed agent update tasks in the endpoint History tab showing an incomplete phase timeline: the Download and Signature steps appeared blank and the Service and Install steps showed 0ms. All phases now report their real status and duration, including updates that finish while the agent restarts and reconnects.
• Fixed assigning licenses to several endpoints at once. From the Licensing settings page, selecting multiple endpoints and choosing Assign Licenses could fail with a generic error and leave the endpoints unlicensed. Bulk assignment now completes reliably.
• Fixed feature updates and system updates that TridentStack Control skips before starting (for example, when an endpoint does not have enough free disk space to install safely) appearing in the endpoint's History as a red failure with raw technical details. These now show a clear, neutral "Skipped" entry with a plain-language reason, so it is obvious the update was intentionally held off rather than having failed.

New

• Package Catalog: upload and deploy your own custom application packages. Bring your own installers, keep multiple versions of each package with their own install settings, and deploy them on demand or through your application update policies and deployment rings, exactly like catalog applications. Every uploaded installer is security-scanned before it becomes available to deploy.
• Deploy an application to your endpoints on demand. From an endpoint's actions, or as a bulk action on the Endpoints list, pick an application and the exact version to install and push it to one or many endpoints at once, without setting up a policy. Offline endpoints can either receive the install automatically the next time they reconnect, or be skipped. Track every deploy from a dedicated One-Time Deployments view on the Rollout Status page, showing who triggered each deploy and per-endpoint progress for what succeeded, what is still running, and what is queued. Click any endpoint to open its install history for that deploy, and jump straight back to the deploy from that endpoint's history. A quick identity re-verification is required before a deploy runs.
• Update how a custom package version installs without re-uploading it. Open a custom package, expand an available version, and edit its install settings in place (install arguments, success exit codes, timeout, and how the app is detected as installed), then save. The installer file you uploaded stays exactly as it was, and a quick identity re-verification is required before the change is saved.

Improved

• Searching for an application to deploy or add to a policy now puts the common, canonical version of an app at the top of the results, so the one you want is the first thing you see instead of being buried under regional or edition-specific variants. The results list also jumps back to the top each time you change your search.
• Windows system-update refreshes, whether you start them manually or they run automatically in the background, now report their progress through the same reliable, fully-narrated task view as your other refresh activities, and hold up cleanly across restarts and reconnects.
• Linux and macOS "check for updates" refreshes now report their progress through the same reliable, fully-narrated task view as Windows.
• Compliance evaluations now report their progress through the same reliable, fully-narrated task view as your other refresh and scan activities.
• Windows feature updates (moving an endpoint to a newer Windows version) now report their progress through the same reliable, fully-narrated task view as your other update activities, and track cleanly through the restarts these upgrades require, so a completed upgrade always shows as finished instead of appearing to hang.
• Office updates now report their progress through the same reliable, fully-narrated task view as your other update activities, with each step and its result shown clearly.
• Application icons render more accurately across the catalog: apps now show their full-color logo where one exists, more applications resolve to their correct icon, and applications with no recognizable logo show a clean placeholder instead of a generic silhouette.
• Package Catalog now uses a single Windows / macOS / Custom switch with a consistent table across all three, and a New Package button that is always one click away.
• Rollouts now have a dedicated detail page. Click any ring on the Rollout Status page to see live per-endpoint progress, installed updates, restart timelines, and full attempt history, with filters and search. Endpoint names link straight to the endpoint's page, and the ring's activity feed loads older entries on demand with a Load more button.
• Rollout and endpoint history are now linked both ways: clicking an endpoint on a rollout page jumps straight to that endpoint's history with the exact task expanded, and ring-driven tasks in endpoint history link back to their rollout.
• Configuration policy editor: when viewing configured settings, each section (Administrative Templates, Security Settings, System Services, Registry) can now be collapsed so you can move between them quickly, and every setting's Edit and Remove actions now sit together on the right of the row, clearly separated from the status labels so it is easy to tell actions from labels at a glance.
• Opening a custom package now goes straight to its details and versions instead of an add-a-version form. Add a version on demand with the Add version button, and the form pre-fills the installer type and install settings from your most recent version, so adding another build no longer means re-entering the same configuration. The editor also scrolls as a single, clean view.
• The Application Update Policies list now shows a Schedule column, so you can see at a glance when each policy's updates are set to deploy, based on its assigned deployment ring's window, without opening the policy. This matches the Schedule column already on the System Update Policies list.
• The dashboard's Patches Applied (30 days) tile now shows a single clear total instead of a small trend line that was hard to read at a glance.
• The deployment ring rollout view no longer includes the manual bulk restart action for pending endpoints. After an update, endpoints continue to restart according to your ring's automatic restart settings and each endpoint's own restart policy.
• Rollout detail page: the paused banner and the Status tab now show who paused a ring, not just when, so you know who to check with before resuming.
• Rollout detail page: when a ring is paused or halted, the "Next check" countdown now reads "Checks suspended" instead of ticking down, making it clear nothing will dispatch until the ring is resumed or un-halted.
• Rollout detail page: the endpoint table can now be sorted by hostname, status, or last execution time.

Fixed

• Deployment ring editor: the rollout timeline preview now stays visible while you set up a deployment window. Previously, adding a new window briefly blanked the timeline and showed a "could not project the rollout timeline" warning until you finished choosing the window's days.
• Configuration policy editor: the View Configured button now reliably switches to the configured-settings view even while a settings browser (registry, services, drive mappings, or security settings) is open. Previously the click appeared to do nothing.
• Configuration policy editor: the Tag Assignments dialog now has a Done button, so it can be closed without hunting for the small corner icon.
• Endpoint details: clicking a deployment schedule badge now anchors the ring status popover to the badge. Previously it could appear detached, floating above the row it belongs to.
• New-endpoint notifications now report how the endpoint actually enrolled (enrollment token or registration key) instead of always saying "API".
• When the TridentStack Control agent updates itself, the resulting Client Update entry in an endpoint's history now shows each completed step with a clear status and a real duration instead of blank or unmarked rows, and a leftover placeholder step that never ran has been removed, so a finished self-update reads as finished at a glance.
• Configuration policies created from a template now open straight into a usable settings editor. Previously a large summary panel filled the top of the page and pushed the settings editor off-screen on smaller displays, which made a template-based policy look like it could not be edited.
• Configuration policy editor: searching your configured settings no longer switches you out of the "View Configured" view. You can type in the search box to filter within the settings you have already configured, instead of being dropped back into the full catalog.
• First-run setup guide: after you have opened the page with your install commands, coming back to it before your first endpoint has checked in now re-highlights the commands to copy, instead of steering you back to an empty Endpoints list. The guide only points you to Endpoints once a device has actually started enrolling.
• Agent self-update rollouts no longer stall partway through a fleet. A bookkeeping issue in the update pacing could leave a rollout appearing complete while some online endpoints never received the new agent version; pacing now recovers automatically and every online endpoint receives the update.
• First-run setup guide: the guided setup no longer gets stuck on the update-policy steps when a default policy is not present (for example, if you deleted it or your account predates the auto-created defaults). Each step now always offers a clear way to continue, and the guidance adapts to what you actually have set up instead of assuming a policy was created for you.
• Newly enrolled endpoints could show a mostly empty System State tab (missing edition, version, locale, installed updates, and component versions) for many hours if their very first check-in was interrupted, and refreshing did not help. The first report is now recorded reliably, and a refresh always brings the System State tab up to date.

Improved

• Patch Tuesday updates now reach the update catalog within about an hour of Microsoft publishing them.

Fixed

• Rollout Status now shows an accurate duration and an explanatory note for a run that only cleared a pending restart, instead of a blank "--" that looked like missing data.
• Searching the update catalog now ignores accidental leading or trailing spaces in the search box on every platform tab, so a pasted search term with a stray space no longer comes back empty.
• Automation rules set to match all endpoints now show that clearly in the rule list, instead of displaying leftover condition rules from before the toggle was turned on.
• Automation rules set to match all endpoints now correctly tag brand-new endpoints as soon as they enroll, instead of only picking them up on the next scheduled run.
• Removed the "Last sync" indicator from the update catalog header. It always displayed "Never" and could look like the catalog was broken.

Improved

• The rollout detail page now shows each rollout phase as an interactive card, matching how phases are configured in the deployment ring editor. Cards carry the phase's live status, how many endpoints have completed or failed, and exactly what the phase is waiting on; clicking a card filters the endpoint list to that phase.
• Rollout phase timing is now always truthful: a phase that is soaking shows a future advancement time, a phase held by its success criteria says why (for example "Waiting for results from 3 agents" or "Success rate 62% is below the required 80%"), and a fully completed rollout shows a clear "Rollout 100% complete" banner with when it automatically restarts for the next update cycle.
• The rollout endpoint list's Status column now includes a full status key, and endpoints whose update reported success but did not actually apply ("Not Converged") get their own filter and an explanation of how TridentStack Control automatically retries them.

Fixed

• Uploading an installer for a custom package now works from the browser. Adding a new version would previously fail at the point of saving the file; that upload path now completes reliably.
• Windows 11 25H2 endpoints are no longer offered .NET Framework cumulative updates built for version 24H2. These packages are version-specific, so Windows rejected them as "not applicable" and the failed install could stall a deployment run. Endpoints on 25H2 now only receive the 25H2 .NET Framework package.
• Fixed a pre-download verification defect where an update staged ahead of its deployment window could be checked against the wrong file signature when Microsoft publishes one update entry covering multiple processor architectures. The install then failed with "Installer hash verification failed" even though the downloaded file was correct. Affected endpoints are healed automatically with this release, with no re-download needed.
• Rollout phases no longer show contradictory states such as an "Active" badge next to a "Completed" timestamp, an advancement date in the past, or a completed rollout reading 67% complete.
• Rollout phase health is now measured against the current rollout cycle only, so results from a previous cycle can no longer stall a phase or freeze its advancement projection.
• Failed Windows feature upgrades in a deployment ring now record the actual reason for the failure (for example which pre-upgrade check blocked the upgrade, or that the endpoint's build did not advance after its restart) instead of the unhelpful "Feature upgrade failed: Unknown error".

New

• Connect your AI assistant to the TridentStack Control documentation. If you use Claude, Cursor, or another assistant that supports the Model Context Protocol (MCP), you can now add our documentation server so the assistant searches and reads our guides, API reference, changelog, and roadmap directly, keeping its answers grounded in the current docs. Setup takes one line and is covered in the Getting Started guide, "Connect your AI assistant."
• Endpoints can now inherit multiple application update policies through their tags. Compose focused policies (browsers, runtimes, tooling) and layer them per endpoint - each policy updates only the applications it selects, within its own deployment ring window. When two policies target the same application, the more conservative one wins automatically, and a pinned version never downgrades an already-newer install.
• Disabled update policies can now be assigned to tags and stay visible everywhere they matter. A disabled system update or application update policy remains selectable in the tag editor with a clear Disabled status, and an endpoint whose tags carry one shows it as Disabled on the endpoint's details instead of hiding it. A disabled policy applies nothing while disabled. For system update policies, a disabled policy also keeps its place in the priority order: if the highest-priority policy on an endpoint is disabled, updates simply pause for that endpoint rather than unexpectedly falling through to a lower-priority policy carried by another tag.

Improved

• The Client settings page now makes clear exactly what each update setting controls. Windows Update Management has moved into its own section explaining that it governs the endpoint's built-in Windows Update at the operating system level, with expanded descriptions of what Exclusive and Hybrid each do, and Manual Update Installation now states that it only controls whether a person at the endpoint can start installs from the client app. Because changing Windows Update Management reconfigures every Windows endpoint in your organization, saving that change now asks for confirmation and lists exactly what will happen before it is applied.
• Two settings were retired from the Client settings page to reduce clutter: the update notification toggle (the only client notification is the restart prompt, which has its own "Show reboot prompts" setting) and the update check frequency intervals (update refresh timing is managed automatically by the platform and spread across your fleet to avoid load spikes; it no longer needs manual tuning).
• The Columns menu on list pages now has a search box. When a table has many columns, type a column name to quickly find the one you want to show or hide, instead of scrolling the full list.
• Deployment ring safety halts are now configurable per rollout phase, so an early, cautious phase and a broad later phase can each use their own halt threshold. You can also choose whether a failed application update counts toward halting a ring.
• The deployment ring phase settings now read more clearly and are cleaner to fill in: an "or" label between the success-rate and maximum-failures thresholds makes explicit that reaching either limit will hold a phase, and time fields no longer keep a stray leading zero (for example "048") while you edit them.
• The maximum executions per window setting in the deployment ring editor now caps itself to what actually fits in the ring's schedule: roughly one full deployment cycle per 30 minutes of the longest window, up to 10. The helper text explains the cap for your ring, and if a later schedule change shrinks the window below an already-saved value, the editor points that out instead of leaving a limit that can never be reached.
• The deployment ring editor now makes clear that every deployment window needs at least one day selected: a window with no days shows the requirement inline and the ring cannot be saved until a day is chosen. Previously the editor let you attempt the save and only failed afterwards with a technical error, even though a window with no days would simply never open.
• The deployment ring editor now flows in the order a rollout actually works: deployment windows come before rollout phases, and each phase card shows the projected date and time that phase will start (with the whole rollout's projected completion shown beneath), updating live as you adjust the ring. Window durations are now capped at 23 hours, since each selected day opens its own occurrence of a window and a longer duration would overlap the next day's; rings meant to deploy around the clock simply use no windows. Applying a phase preset also no longer fills in the ring description, so the description stays exactly what you wrote.
• The endpoint Actions menu now shows a "No Policy" indicator on Install Application Updates when no application update policy is assigned, matching the existing indicator on Install System Updates, on desktop and mobile alike. Menu entries also no longer wrap onto two lines when an indicator is shown.
• Policy priority now uses one consistent 0-100 scale on system update policies and automation rules, with new items defaulting to 50. Higher numbers still take precedence, and any existing priorities from the old wider scale were converted to the new scale automatically, keeping their relative order.
• Assigning a configuration policy to tags is now a simple add and remove, matching the way system update policies work. The per-assignment priority and enable/disable switch, which were unused and only added confusion, have been removed; a configuration policy applies to every tag it is assigned to.

Fixed

• The "Show all rings" toggle on the rollout status page now reliably updates the list on the first click. Previously, toggling it (especially quickly) could briefly leave the list showing the previous selection until another click, because a slower background refresh could finish last and overwrite the newer result.
• Switching the Windows Update Management client setting to Hybrid now reliably returns Windows Update to the endpoint's own control in every case. Previously, if TridentStack Control's update configuration had been partially altered on the endpoint, switching to Hybrid could silently leave the remaining blocking settings in place, keeping the endpoint's built-in Windows Update disabled. The agent now detects and removes every remaining piece of its own configuration, restores each setting it changed to the value it had before, and never touches Windows Update settings that belong to your own policies or another management tool. Note that the Windows Update page in the endpoint's Settings app can take a while to reflect the change; updates themselves resume immediately.
• Saving a column layout as a preset now works on every list page. Previously, the Columns menu's "save as preset" option only took effect on the Endpoints page; on other lists (such as System Update Policies, Application Update Policies, Tags, Automation, Policy Objects, and Custom Packages) saving a preset appeared to do nothing. You can now save, name, switch between, and set a default column layout on any list page, and your default view loads automatically each time you open it.
• Running a saved report works again. Since the previous release, running any saved report failed with a "Failed to run report" error even though the report itself was valid; the run now completes and the report's run history (last run time and run count) is recorded correctly.
• macOS endpoints now only offer application updates that an assigned application update policy actually covers. Previously, a macOS endpoint could list and attempt updates for applications outside any assigned policy, and the install was then rejected. Uncovered applications are now excluded from install actions and labeled in the pending list: "No Policy" when no application update policy is assigned, or "Not in Policy" when the assigned policies do not cover that application.
• Application updates that hit a transient download problem now fail cleanly and retry, instead of occasionally reporting a confusing installer error.
• An application installed only for the signed-in user, whose newer version is only offered as a system-wide installer, is no longer shown as "not installed." It now correctly shows as installed, with the available update flagged as requiring a system-wide install.
• The Rollout Status tab now reports a deployment ring's next timing accurately. A ring that has finished everything it can do in the current maintenance window shows the next real window (when installs resume), instead of a "Next Dispatch" countdown implying an install is moments away or a "Next Window" that looked like it opened at the current minute.
• A deployment ring set to run at all times (every day, around the clock) now clearly reads as always open everywhere it appears, including the rollout status view and the calendar, instead of a shifting "Next Window" time or a calendar entry that looked like it started at a specific hour.
• An endpoint whose application updates all fail now still receives its pending system and security updates in the same maintenance window, instead of having them skipped because an application update failed. An application that fails is not retried again within that window, while the endpoint's other updates continue.
• Data tables now render correctly in Firefox. Previously, list pages such as Endpoints showed rows with no visible content in Firefox because the table stretched far beyond the screen, which also made search results appear blank.
• Creating or renaming a tag with characters that are not allowed now explains exactly what went wrong, naming the specific invalid characters you used (for example a space or an underscore), instead of a generic save-failed message with no detail.
• The All Vulnerabilities view now reports exact figures for fleets of any size. On very large fleets, the severity counts and the vulnerability list were previously computed from only part of the data, so the counts on the severity buttons could shift each time you changed the selection and some affected endpoints went uncounted. Counts are now complete, stable, and consistent no matter which severity or filter you pick. When the same vulnerability is assessed differently across endpoints, the view now also reports the most severe assessment and shows a fix as available if any affected endpoint has one, rather than an arbitrary one.
• The severity buttons on the All Vulnerabilities tab now respond to the KEV Only, Fix Available, Hide ESU, search, and Min EPSS filters: each button shows exactly how many matching vulnerabilities of that severity exist, and selecting one shows exactly that many results. Sorting the Severity column now always keeps Critical rows above High, regardless of underlying scores.
• Vulnerability numbers now agree across the product. The Dashboard vulnerability tiles, the Vulnerabilities page header, and the Overview tab all use the same definition of an active detection: open vulnerabilities on active endpoints, excluding anything you have excepted, counting each vulnerability once per affected endpoint. Previously the Dashboard tiles also counted acknowledged findings, retired endpoints, and excepted vulnerabilities, so they could never match the Vulnerabilities page. Counts of endpoint detections are now labeled as detections to distinguish them from counts of unique CVEs.
• A vulnerability's detail page now shows the status breakdown (open, resolved, and so on) across all affected endpoints instead of only the endpoints on the first page, and its endpoint search now searches every affected endpoint rather than the visible page.
• Exporting vulnerability exceptions to CSV now includes every exception matching your filters, not only the rows on the current page.
• Vulnerability views refresh immediately after a scan finishes, including the automatic re-scan after an update installs and manual scans of offline endpoints, instead of showing pre-scan numbers for up to a minute.
• An endpoint's Vulnerabilities tab now reports the same total as the By Agent list you clicked through from. Both now use the same definition: open vulnerabilities, excluding anything you have excepted. Previously the endpoint's own tab also counted acknowledged findings and ignored your exceptions, so a vulnerability you had explicitly excepted could reappear in the endpoint's list and counts as if the exception did not exist.
• A vulnerability's severity now reads the same everywhere. The rating shown on a vulnerability's detail page now matches the severity used by every list, filter, and count in the product, instead of occasionally showing a different rating, or a raw vendor term such as Important, sourced from a separate database.
• The By Agent tab now loads quickly on large fleets. Its counts were previously recomputed from every individual finding on every page view; they are now aggregated in the database and briefly cached.
• A deployment ring's rollout status now counts each endpoint once. Previously, an endpoint whose install was repeatedly held back (for example by a pre-flight health check) counted every held-back attempt as another endpoint, so a ring could report dozens of endpoints and a low completion figure when it actually covered a single endpoint that later succeeded. Total agents, progress, and success rate now reflect each endpoint's latest result, and the filter counts in the ring's Agent Details view now show how many endpoints appear under each filter.
• Saving a deployment ring whose phase wait time is longer than its maintenance window now works. A phase's wait is a minimum bake time that counts continuously from when the phase first deploys, so it is normal for the wait to span several windows (the built-in Conservative preset, for example, waits 48 hours after its first cautious phase). The editor previously blocked these rings with an error claiming the rollout could never advance; that incorrect check has been removed. The wait now elapses on its own schedule and the phase advances at the next open window.
• The Install Updates dialog on an endpoint's page no longer gets stuck open. Opening it to install system or application updates could leave the dialog unresponsive, with its close, Cancel, and Select Updates buttons doing nothing and no way out but reloading the page. The dialog now opens, selects, confirms, and closes normally on Windows, macOS, and Linux endpoints.
• An endpoint's Pending Application Updates list now shows its Scheduled column again, alongside the new Policy column, so you can see at a glance both which policy governs each application update and its deployment-ring schedule. The list also lays out more cleanly: the Application column no longer takes more room than it needs, a long policy name shortens with the full name shown on hover, and column headings stay on a single line. On the Pending System Updates list, the notice that a restart is required now sits at the bottom of the section instead of above the list, so it no longer pushes the updates down.
• Update pre-staging now stays out of the way of installations. Pre-staging downloads no longer start while a deployment ring's maintenance window is open or while an endpoint is installing updates, so an install never competes with a background download for the endpoint's bandwidth and disk.
• Pre-staging now stages the correct file when an update is published with several downloadable files, and verifies it against that exact file's checksum. Previously, affected endpoints could repeatedly download the wrong file, fail verification each time, and end up downloading the update again during the maintenance window itself.
• A pre-staging download whose file fails integrity verification is now reported as failed instead of succeeded, so the task result matches the per-file detail shown when you expand it. Failed verifications also now wait out their retry cooldown instead of re-downloading on every cycle.

New

• When an endpoint enrolls but then cannot establish its secure connection to TridentStack Control, its detail page now explains the likely cause, such as a network security device intercepting the connection, a firewall blocking outbound access, or DNS filtering, and tells you what your network team needs to allow. The Endpoints list also flags affected endpoints at a glance.
• Multiple sign-in domains per organization: Organizations that own more than one email domain can now use all of them with a single TridentStack Control workspace. Domains verify automatically when your team signs in with Microsoft work accounts from the same Microsoft organization, or manually with a DNS record under Settings, then Authentication. Each domain gets its own sign-in method controls.

Improved

• Easier to find the TridentStack Control community: the documentation site footer, the changelog page, and the welcome email now link to r/TridentStack, where we post weekly release rollups and patch management discussion.
• Timestamps across the console now use one consistent format: a relative time (like "3 hours ago") with the exact date and time below it. This applies to the Endpoints Registered column, Tags, Configurations, System Update Policies, Policy Objects, and Automation.
• Per-domain sign-in methods, redesigned: Each of your organization's sign-in domains now has its own card with independent controls for which sign-in methods it allows. Your primary domain and any additional domains are configured the same way, in one place, with single sign-on kept as an organization-wide setting.
• Update Health details are now a popover you can select and copy to send to whoever owns an endpoint, and you can dismiss a specific servicing warning for a single endpoint (shown as Exempted, and restorable). Servicing Health now lives on the endpoint Health tab.

Fixed

• Saving a system update policy after selecting a macOS Office update channel no longer fails. Policy save errors now also show the specific reason instead of a generic "Failed to save changes" message.
• Dismissing a notification from the notification center now works; previously dismissed notifications could instantly reappear. The same fix restores adding and removing break-glass admins, identity provider group mappings, and SCIM provisioning tokens on the single sign-on settings page.
• Driver update installations that fail before any driver is attempted now record and display the failure reason instead of showing a failed task with empty details.
• Installing all pending system updates or application updates on several selected endpoints at once now works. Previously this bulk action failed with an error and no updates were installed.
• Editing a deployment ring's phases after its rollout has already started no longer causes the ring to stall. Affected rings now self-correct and continue advancing through their phases automatically.
• Searching your Endpoints list now shows a clear "no matching endpoints" result when nothing matches. Previously, a search that returned no matches could show the new-workspace "waiting for your first endpoint to connect" screen, which looked alarming for organizations that already had endpoints enrolled.
• Windows 11 version 25H2 endpoints now receive the latest monthly Windows quality updates. Previously the monthly update could be detected as applicable to a 25H2 device but was not offered for installation on it.
• Applications that are already installed are no longer incorrectly shown as available to install. An application whose installed name carried an extra locale or architecture label (for example, Mozilla Firefox) could be misreported as not installed and offered as a new installation even though it was present and current.

Improved

• Agent update pilots are now evaluated per operating system. When a new agent version is released, it is validated on your pilot devices of that same operating system before the rest of that platform's fleet updates, so a Windows pilot no longer holds back a Linux update (or the reverse). Settings > Agent Updates now shows a per-operating-system breakdown of your pilot coverage and flags any operating system that has endpoints but no pilots, whose updates roll out governed by your update delay only.

Fixed

• App updates that briefly collide with another installation already running on a Windows endpoint (such as a Windows Update or another installer) now wait for it to finish and retry automatically, instead of failing. (Requires the updated endpoint agent.)
• Resuming a halted deployment ring with the "retry failed agents" option now succeeds even when an endpoint had failed the same update on more than one prior attempt. Previously this could return an error and leave the ring halted; each affected endpoint is now re-queued exactly once.
• An automatic software inventory refresh no longer appears in an endpoint's activity history as a long-running task that eventually reports a timeout. Previously, when an endpoint's software inventory came due for a refresh at the same time as another routine check (such as its network details or its pending application updates), a duplicate refresh entry was created that never completed and timed out after 30 minutes, even though the installed-software list had already refreshed successfully. The refresh is now recorded once, under its correct name.
• Per-user application updates now succeed on Windows Server 2016 and other endpoints where the standard package manager is unavailable. Previously such an update could fail even though a direct installer was available; the endpoint now downloads and runs that installer directly. (Requires the updated endpoint agent.)

Improved

• The agent downloads page and documentation now list the full set of supported Linux distributions: Ubuntu, Debian, RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Fedora, and Amazon Linux. The same one-line install command works on all of them; the installer detects your distribution automatically.
• Update installs now show their complete follow-up work in one place. The automatic post-update vulnerability scan appears as a sub-task of the install itself instead of a separate disconnected entry, system update installs now get a post-update scan too (previously only app updates did, and only when started manually), and duplicate software inventory collection after app updates was eliminated so endpoints do less redundant work. When several updates finish on the same endpoint around the same time, they share a single scan. Endpoints without an application configuration now show an explicit "Skipped" step with the reason, instead of showing nothing.
• Product and app searches now tolerate punctuation and spacing differences, so searching "7zip" finds "7-Zip".
• Search boxes now look and behave consistently across every list and table, each with a visible search icon and a one-click clear button.
• Dashboard layout changes saved through the API are now recorded in the System Audit log, matching layout changes saved in the app.
• Critical vulnerability alerts now roll up into a daily digest instead of emailing on every scan, so large fleets stop getting flooded. Configure delivery right from the Critical Vulnerabilities alert in Settings > Notifications: switch between daily, hourly, or immediate, pick the daily digest send time, and tune the "send immediately" threshold. The digest goes out in a time zone you choose, defaulting to your account's time zone so it lands at the same local hour for your team. Actively-exploited findings still alert immediately.
• Endpoints that are removed from TridentStack Control without uninstalling the agent now stop retrying the server at full speed. After a short recovery window the agent backs off to one check per hour, and it returns to normal service automatically the moment it is re-enrolled or its record is restored.

Fixed

• Red Hat family Linux endpoints (RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Fedora, Amazon Linux) now report their software inventory and pending updates correctly, and updates can be installed from the console just like on Ubuntu and Debian. Previously these endpoints enrolled and stayed connected but showed an empty software list and no available updates.
• Linux and macOS endpoints now run the same automatic post-update vulnerability scan that Windows endpoints get: after any package, app, or system update installs, a Vulnerability Scan appears as a sub-task of the install showing exactly what was checked and found. This also fixed a defect where Linux endpoints were not being re-scanned after updates at all, so vulnerability data on Linux could go stale until the next scheduled fleet scan.
• App update installs on macOS now complete their follow-up work faster and more reliably: the post-install refresh that updates the pending-apps list finishes the moment the endpoint reports back instead of waiting on a fixed timer, and failed refreshes now show an honest failed status instead of lingering. Windows post-install app refreshes carry richer detail on the applicability computation step (how many apps were evaluated and how long it took).
• Deployment rings are now much better behaved around failures and edge cases. A ring no longer marks a phase as failed minutes into its very first deployment wave: the health clock now starts when results actually begin arriving, and the ring always gets at least one more maintenance window to recover before being halted. When a ring is halted, the reason now states the actual cause (for example "1 application update failure in Early Adopters phase - success rate 88.9% below 95% target") instead of a vague timeout message, and the Rollout Status view shows Halted or Paused in the Next Phase column instead of a misleading "Ready now". The "Deployment Started" notification is sent once per maintenance window instead of repeating on every internal scheduler pass, and an endpoint that declines an install for a benign reason (such as low disk space) is retried at most 3 times per window with an hour between attempts, instead of every few minutes all night.
• Resetting a rollout is clearer and safer. The action is now called "Reset Ring", and its confirmation explains exactly what happens: progress and any halt are cleared, in-progress work is voided without being counted as failures, nothing is uninstalled, and deployments start over from the first phase at the next window. The un-halt dialog now also explains what each choice means, including when deployments will actually resume and whether retrying the failed endpoints can advance the rollout to its next phase.
• The monthly Windows Malicious Software Removal Tool update is now handled correctly end to end. It installs using Microsoft's supported quiet-install method (so the malware scan actually runs after each update, and endpoint security products no longer flag the update as suspicious file activity), 64-bit endpoints reliably get the correct current 64-bit build, and the update keeps being offered every month instead of freezing at an old version once installed. The scan also runs at a low priority so it stays out of the way on busy machines.
• Windows on Arm devices (such as Snapdragon-based PCs) are now correctly recognized, so their app updates install the right versions and the device's processor type is reported accurately.
• The scan button on an endpoint's Vulnerabilities tab is now accurate about when a scan is already running. It stays disabled while a vulnerability scan started automatically by a recent update install is still finishing in the background, so you cannot accidentally kick off a second overlapping scan. And if a scan request fails to start, the button no longer keeps spinning indefinitely.
• Repeat manual restarts on the same endpoint now track their status correctly. Previously the restart command still went out, but after an endpoint's first tracked restart completed, later manual restarts kept showing the old completed state instead of the new restart's progress.
• App updates that could intermittently fail to download now retry automatically, so more of them complete on the first attempt instead of reporting a failure.
• Agent Tags search now filters as you type (and works on mobile), instead of only responding when you pressed Enter.
• Vulnerability exceptions can now be searched by CVE or endpoint name.
• The built-in default dashboard is now truly read-only, so its layout can no longer be changed unintentionally and always renders as designed. To customize your Home view, clone the default dashboard and edit your copy.
• The free CVE lookup tool no longer shows an unnecessary horizontal scrollbar when an expanded vulnerability's remediation includes long version strings; the details now wrap cleanly on any screen size.
• Removed a broken "Documentation" destination from dashboard link widgets that navigated nowhere.

New

• The free CVE lookup tool now shows how to fix each vulnerability: the version to upgrade to for affected applications and Linux distributions, the exact security update to install for affected Windows editions and core Microsoft products (Office, Exchange Server, SharePoint, and SQL Server), and the version to update to for affected Apple platforms (macOS, iOS, iPadOS, and more), each linked to the vendor or distribution security advisory it comes from. When no published fix has been found yet, the page says so plainly instead of guessing.
• Settings > Client now lets you hide the TridentStack Control tray icon on endpoints. The agent keeps running and managing the device in the background; only the tray icon and the window users can open are hidden. Applies to Windows and macOS.
• A new Windows update management choice in Settings > Client lets you keep TridentStack Control in sole control of Windows updates (recommended), or switch to a hybrid mode where Windows can also install updates on its own alongside TridentStack Control.
• Settings > Client now lets you control whether endpoints show a restart prompt before a managed restart. Turn it off for unattended endpoints that should restart silently after updates finish.
• The security dashboard now charts Open Vulnerabilities by Severity over time, plotting your total, critical, high, medium, and low open vulnerabilities as separate color-coded lines across the selected window, so you can see at a glance whether your exposure is trending up or down.
• On the dashboard, clicking a slice (or legend entry) of the Vulnerability Severity breakdown now opens the full vulnerability list filtered to that severity, so you can jump straight from the overview to the affected CVEs.
• The free CVE lookup tool now has an About page that explains what the tool is, defines the key terms (CVE, CVSS, EPSS, and CISA KEV), and shows exactly where every CVE record and fix comes from, the license behind each source, and how much of the catalog has an available fix. It is linked from the CVE tool and the site footer.
• Endpoints list: new Compliance % column showing each endpoint's overall framework compliance.
• Endpoints list: new Last Deployment column showing each endpoint's most recent update deployment result.
• Admins can set a default column layout for each table that new users inherit automatically.

Improved

• Saved table views: click the star on any column preset to make it your default; your default now follows you across devices.
• The free CVE lookup is now a dedicated, full-screen tool that mirrors the experience inside TridentStack Control. It scrolls as a single focused view with no competing scrollbars, adds a Fix column you can filter and sort by to surface vulnerabilities that have an available fix, and expanding any CVE now shows the same rich detail layout (CVSS breakdown, exploit intelligence, references) and a "Remediation Available" panel with the exact fixed versions to upgrade to, each linked to its vendor or distribution advisory.
• The free CVE lookup tool now works well on phones: the catalog shows tappable cards (severity, CVSS, exploit-prediction, exploited status, and fix availability at a glance) with a sort control, instead of a wide table you had to scroll sideways. Tapping a card opens the same full CVE detail inline. The desktop table view is unchanged.
• The free CVE lookup tool now gives actionable guidance for vulnerabilities that have no published fix yet, instead of a dead end: it flags end-of-life products that should be taken offline, shows the official CISA remediation action and due date for actively-exploited vulnerabilities awaiting a patch, and points to the relevant vendor advisories.
• The free CVE lookup tool now covers open-source software dependencies: vulnerabilities in npm, PyPI (Python), Go, Maven (Java), RubyGems, crates.io (Rust), NuGet (.NET), and Packagist (PHP) packages now show the package version to upgrade to, each linked to its source advisory.
• The free CVE lookup tool now shows Red Hat's official guidance when available: which products Red Hat has decided not to patch, and the recommended mitigation steps, linked to Red Hat's advisory.
• The free CVE lookup tool now flags when a fix lands on a Linux distribution release that has reached end-of-life (such as older Ubuntu, Debian, or Red Hat releases), including whether extended security maintenance is still available, so you know to plan an upgrade rather than rely on an unsupported platform.
• On the free CVE lookup tool, each CVE's reference links are now grouped by type (patch, vendor advisory, exploit, third-party advisory, and more), so you can jump straight to the official fix or advisory instead of scanning a flat list. CVE pages that have an available fix now also highlight that in the page title and search-result preview.
• The free CVE lookup tool now lets you browse vulnerabilities by weakness type (such as Cross-Site Scripting, SQL Injection, or Use After Free) and adds a dedicated page for actively-exploited (CISA KEV) vulnerabilities. Each view ranks the CVEs by exploitability and shows the fixes available, so you can quickly find every vulnerability of a given kind or every one that is being exploited.
• The free CVE lookup tool now offers subscribable feeds, in both RSS and JSON, for recently-added CVEs, newly-added actively-exploited (CISA KEV) vulnerabilities, and the highest-risk vulnerabilities. Follow them from your feed reader or wire them into your own tooling to track new threats as they appear.
• The free CVE lookup tool now has a live statistics page showing the size of the vulnerability catalog, how many CVEs have an available fix, the breakdown by severity and year, and the most common weakness types. Every CVE page also now offers an embeddable status badge you can add to a README, security advisory, or site, showing the CVE's severity and exploited status at a glance.
• The free CVE lookup tool now shows a fix for tens of thousands more vulnerabilities, roughly doubling its remediation coverage, by deriving the fixed version from the affected-version data published with each CVE (clearly marked as derived). This is especially impactful for actively-exploited vulnerabilities, many of which now show a concrete version to upgrade to. A vendor-stated fix, when one exists, is always shown in preference.
• The page for tracking in-progress deployment rollouts is now labeled "Rollout Status" in the navigation (previously "Rollouts"), making it clearer at a glance what the page is for.
• Endpoints list: new Applicable Updates column (combined system + app updates) and a shorter Sys Updates label.
• Remediate a vulnerability on a single endpoint even when no update policy covers the fix. The Remediate dialog now offers a one-off install, clearly marked as outside policy, showing the exact app or update and target version. Works for both application updates and Windows system updates where the fix applies.

Fixed

• Fixed an issue where a Windows update intended only for Windows client editions could be offered to a Windows Server endpoint that shares an underlying version, where it would fail to install. These updates are no longer offered to servers they do not apply to, and Server cumulative updates continue to install normally.
• Fixed an issue where a long-running Windows feature update (such as Windows 10 to Windows 11) could be reported as timed out, and stop short of completing, when its preparation stage ran longer than expected and the endpoint briefly stopped reporting in. These upgrades are now given the full time they need to finish and report their real result.
• Fixed a case where a leftover status check from an earlier feature-update attempt on an endpoint could cause a later, unrelated feature update on that same endpoint to be misreported as failed or stuck awaiting a restart. Feature update results are now tracked accurately for each attempt.
• Fixed a case where a Windows feature update (such as Windows 10 to Windows 11) that finished its lengthy preparation stage while the endpoint was briefly offline could stall and never finish, because the endpoint's "preparation complete" report was lost. The endpoint now re-sends that report as soon as it reconnects, so the update resumes and completes on its own.
• Fixed an issue where, after a Windows feature update (such as Windows 10 to Windows 11) finished installing and the endpoint restarted, the TridentStack Control app on that endpoint could keep showing a "Finalizing Windows upgrade..." status indefinitely even though the update was already complete. The status now clears on its own once the update finishes.
• Fixed the deployment ring status shown on an endpoint's update list so it reflects the real maintenance-window state. A ring on a set schedule (for example, Thursday nights) no longer appears to be actively deploying around the clock; outside its window it now shows when the next window opens, and it only shows as active while its window is genuinely open.
• Fixed an issue where a phased Windows feature update rollout (for example, Windows 10 to Windows 11) could halt for an entire deployment ring when just one endpoint was safely skipped by a pre-flight readiness check, such as not enough free disk space, hardware that does not meet the upgrade's requirements, or a prerequisite update not yet installed. Those endpoints are now treated as safely skipped rather than failed, are retried automatically on the ring's next window once they are ready, and no longer hold up the upgrade for the rest of the ring.
• Fixed an issue where a deployment ring that automatically halted (after too many endpoints failed) would not send its halt alert, so the auto-halt could go unnoticed. These alerts, including the list of endpoints that triggered the halt, are now delivered reliably.
• Fixed search on the Agent Tags page: typing in the tag search box returned no results even when matching tags existed. Searching your tags by name now works as expected.
• Fixed endpoint search on the Endpoints list: results could briefly appear and then disappear as the list refreshed, and search only looked at endpoints already loaded on the page. Searching now covers your entire fleet (by hostname, IP address, operating system, user, agent version, update policy, or tag), stays stable while the list auto-refreshes, and "Select All" while searching selects every matching endpoint.
• Fixed an issue where some administrators could not share a saved table view with their team, or set a team-wide default column layout, even though they had the necessary settings permission. These actions now work for any administrator with settings access.
• Fixed an issue where an endpoint with no application update policy assigned could still show pending application updates (and offer to remediate a vulnerability as though a policy already covered it). Endpoints without an application policy now correctly show no pending application updates, and the count is kept accurate automatically if a policy is later removed or deactivated.
• Fixed an issue where applying several automation rules in a row (the rules that automatically tag your endpoints) could start failing with a generic "Failed to apply rule" error after only a few, even though nothing was wrong. You can now apply all of your automation rules in one pass, and in the rare case a temporary limit is reached, the message clearly asks you to wait a moment and try again instead of looking like a broken button.
• Fixed an issue where a vulnerability in an endpoint's list could keep showing an application's old name (with an outdated version number baked into the name) even after the application had been updated, making the row appear to list two different versions. The product name shown for a vulnerability now refreshes on the next scan to match the currently installed software.
• Fixed an issue where an endpoint with no system update policy assigned could still show a system update policy, and pending system updates, as though one were assigned. System update policies now apply to endpoints only through tags, exactly like application update policies; an endpoint with no policy tag now correctly shows "None assigned" and no pending system updates. The count is kept accurate automatically if a policy is later removed or deactivated. (Linux endpoints are unaffected.)

Fixed

• Fixed a scheduling issue that could let compliance evaluations for Windows endpoints fall behind in environments running many Linux endpoints. Compliance results now refresh evenly across Windows, Linux, and macOS regardless of fleet mix.

Improved

• Update Health now covers Linux endpoints - Linux endpoints report disk space (root and /boot) and pending restarts, so the Update Health column shows real readiness, including a "Restart pending" badge when a restart is needed to finish applying updates.
• Bulk license management - The License Management page (Settings > Licensing) now lets you select multiple endpoints at once and license or unlicense them in a single action, on a refreshed, searchable, sortable table that no longer jumps when you click a row. If you try to license more endpoints than you have free slots, it licenses as many as it can (oldest endpoints first) and tells you how many more licenses you would need.

Fixed

• License management links now go where you expect - The "Manage licenses" link in the over-cap banner now opens your License Management page directly instead of the general settings page, and the "Add Licenses" button now takes you straight to billing to add endpoints.
• Endpoint Online and Offline counts now reflect your whole fleet - The Online and Offline totals at the top of the Endpoints page now count every endpoint, not just the ones currently scrolled into view.
• Select All on the Endpoints page now covers your whole fleet - The "Select All" button selects every endpoint across all pages (not just the ones scrolled into view), so a bulk action can target your entire fleet in one go. The checkbox at the top of the list selects the endpoints shown at the top as a quick batch, and its state stays in sync with what you have selected.
• Deployment ring notifications now open the Rollouts page - Clicking an in-app notification that a deployment ring is halted or awaiting approval now takes you straight to the Rollouts page, where you can un-halt or approve, instead of dropping you on the dashboard.

Improved

• You can now sort the endpoints list by Update Health, bringing the endpoints whose updates are blocked or need attention to the top in one click (sort runs across your whole fleet, not just the endpoints currently on screen).
• Applying tag changes to many endpoints at once is now near-instant. Selecting a large group of endpoints and updating their tags previously could take several minutes to finish; it now completes in about a second. Only the tags you actually changed are updated, so tags already in place on some of the selected endpoints are left untouched.
• The Rollouts page now shows when the next batch of endpoints will be picked up while a maintenance window is open, so a rollout that just advanced to its next group no longer looks idle for a few minutes between batches.

Fixed

• Application updates no longer restart an endpoint while other updates are still installing. Previously, updating certain applications that were open at the time could trigger an unexpected restart partway through an update batch, interrupting the remaining updates. Those applications now close and reopen cleanly during the update without an unplanned restart, and the rest of the batch completes as scheduled.
• Phased rollouts no longer stall when an endpoint is safely skipped by a pre-update safety check (for example, low free disk space before a large update). The skipped endpoint is now shown as a neutral "blocked" state instead of a failure, and the rollout continues to its remaining endpoints on schedule and retries the skipped endpoint in its next window.
• Fixed an issue where certain Windows updates for optional server tools could be listed as pending on endpoints that did not have those tools installed, causing the update to repeatedly retry and fail each maintenance window. Updates that do not apply to an endpoint are now correctly excluded from its pending list.
• Fixed a case where an endpoint that restarted while installing updates during a rollout could show as stuck "in progress" for up to a day. The interrupted update is now marked as interrupted right away, and the endpoint is retried in its next maintenance window.
• The Linux agent now installs and runs across the full range of supported Linux releases. Installs on older but supported releases (including Ubuntu 20.04, Red Hat Enterprise Linux / Rocky Linux / AlmaLinux 8, and Amazon Linux 2) that could previously fail to start now complete and run normally. The installer also gives a clear, specific message if a system is older than the supported minimum, and a failed upgrade now keeps the previously working agent in place instead of leaving the endpoint without one.
• A brief black command window no longer flashes on a Windows endpoint's desktop. When a user signed in to or reconnected to a managed endpoint, and during certain application installs that run in a signed-in user's session, a console window could momentarily appear and disappear on screen. These background steps now run silently, with no visible window.
• On Linux and macOS endpoints, the pending system updates shown on the endpoint's page now list only the updates your assigned update policy will actually install, matching how Windows endpoints already work. Previously the list could include updates your policy intentionally leaves out (for example, non-security package updates under a security-focused policy), which made an endpoint look out of date when it was already current for its policy. The manual install options on these endpoints now match as well, offering only policy-approved updates.

Improved

• Saving a deployment rollout now flags a phase whose wait time is longer than its maintenance window, instead of silently accepting a configuration that would leave the rollout unable to advance.

Fixed

• Application updates installed through automatic update rollouts now show the correct application name and the full step-by-step timeline (Compatibility Check, Download, Install) in an endpoint's update history. Previously these installs could appear as "Unknown" with parts of the timeline missing.
• The Next Window time on the Update Management rollouts view now shows the exact scheduled window start and holds steady, instead of creeping forward minute by minute and reading a few minutes later than the real start time.
• Editing a rollout phase's wait time or success criteria now takes effect on an in-progress rollout. Previously a phase that was already running kept using the settings it had when it started, so lowering a phase's wait had no effect until the rollout moved on, which in some cases prevented it from advancing at all.
• A rollout that is briefly held between phases while a canary group is still installing now reads "waiting on … canary" instead of the alarming "… canary failing." A healthy, in-progress rollout with zero failures no longer looks like a failure.
• For updates installed through an automatic rollout, the Download step in an endpoint's update history now reads "Pre-staged" when the file was downloaded ahead of the maintenance window, instead of showing a blank row. (Manually triggered installs continue to show the live download with progress.)
• Windows update titles now show the architecture that matches the endpoint. For example, an x64 PC no longer displays a .NET update labeled "ARM64 Client." The correct update was always installed; only the displayed label was wrong.

Improved

• The System Update Policies and Application Update Policies lists now show an Assigned Tags column, so you can see at a glance which tags route endpoints to each policy without opening it.
• Expanding a policy on either list now shows its assigned tags, and you can click a tag, status, or schedule to instantly filter the list to (or exclude) policies with that value. Active filters appear as removable chips above the table.
• Both lists now include a Deployment Ring column showing the rollout ring assigned to each policy, and you can filter either list by deployment ring from a policy's expanded details.
• Administrators can now add any email address as a notification recipient, not just members of your team. In Settings, Notifications, type a shared inbox or distribution list address for any event category and add it alongside the team members you select.
• Installing the TridentStack Control agent on older Windows systems (Windows Server 2016 and 2012 R2) is now reliable. The Agent Installers screen has a new "Older Windows" toggle that adjusts the one-line install command so it connects on systems that previously failed with a secure-connection (TLS) error. Modern Windows keeps the cleaner, shorter command by default.
• On endpoints running an operating system past its end-of-support date, the vulnerabilities filter now separates the two kinds of fixes: a Fixable toggle for updates you can apply today, and a separate ESU only toggle for fixes that require an Extended Security Update (ESU) license. Endpoints that do not need ESU are unchanged, with a single Fixable toggle.
• Status page timestamps now display in your local time instead of UTC.
• Returning to the console after the browser has been idle is now snappier: the first page you open after stepping away loads right away, instead of briefly pausing on an empty screen.

Fixed

• When an endpoint goes offline while updates are being downloaded ahead of their scheduled window, that download now shows in the endpoint's history as deferred and is retried automatically, instead of being recorded as a failed task. A laptop going to sleep mid-download no longer looks like something went wrong.
• An endpoint's Application Updates list no longer shows an "Updates blocked" warning that only applies to operating system updates. The system readiness checks behind that warning (such as available disk space and recovery partition sizing) gate system updates only, so they no longer appear on application updates, which install through a separate path.
• A small Windows recovery partition no longer blocks an endpoint's updates and is no longer flagged as a critical problem. A too-small recovery partition only affects the Windows recovery environment, not regular or feature updates, so it now appears as advisory guidance with the correct resize steps instead of holding back updates.
• Opening a Linux endpoint's details now loads the Pending System Updates list almost instantly. On endpoints whose update policy automatically approves updates, this list could previously take around 30 seconds to appear.
• Saving changes in Settings, Notifications now works reliably. Turning the in-app channel on or off, and choosing which channels deliver each type of event, now save correctly. Previously these changes could appear to save but silently fail to take effect.
• When you have unsaved changes on a Settings page and switch to another section, the prompt to save or discard now appears before the page changes, instead of switching first and then warning.
• The status page now waits for several minutes of continuous downtime before reporting an incident, so brief, self-resolving blips no longer show up as incidents.

New

• Linux system update policies now include an option to install all available updates, so a deployment ring can automatically apply every pending Linux package update, not only those tied to a published security advisory.
• Update Health column on the endpoints list - see at a glance which endpoints have issues that will block or fail update installs (such as low disk space and other pre-flight checks), and filter the list to just the blocked ones. Add it from the endpoints column menu.

Improved

• Update Health now covers macOS endpoints - macOS endpoints report startup-volume disk space, so the Update Health column shows real readiness (Healthy, Action recommended, or Blocked) instead of a dash.
• Pending Application Updates now shows when a per-user app update is already scheduled to install at the user's next sign-in, and clearly marks per-user installs with the account they apply to.
• System updates that report success but remain applicable are now detected and automatically re-attempted a few times before being flagged, so a transient install that did not fully take effect recovers on its own instead of lingering. The deployment ring status for an endpoint now shows when this is happening, including when automatic retries did not resolve it and the update needs attention. An endpoint's activity history now flags a past update install that still applies after reporting success, so you can see exactly which update needs attention right where the install was recorded.
• Rollout status and the deployment calendar now have their own Rollouts page in the sidebar, so the Deployment Rings page stays focused on configuration.
• Your Vendor Access Log now records every time TridentStack Control support staff view your environment, and your Support Access setting governs that access across all of TridentStack Control's support tools, giving you complete visibility into and control over when staff can view your data.
• Deployment ring canary phases now validate each kind of update on its own. When a ring's early phase happens to include endpoints needing different update types (for example application updates on one endpoint and system updates on another), the rollout confirms each type succeeds before widening, and it holds the rollout for any update type that is failing its early validation instead of letting other successful updates mask the failure. Within the same phase size, early-phase endpoint selection now also prefers a mix that exercises each pending update type when the endpoints to do so are available.
• The sidebar now shows a count badge on Rollouts when a deployment ring is halted or waiting for your approval to continue, so the rings that need your attention are visible at a glance without opening the notifications panel. The badge moves up to the Update Management menu when that section or the sidebar is collapsed, and appears on mobile as well. These deployment ring alerts now reach everyone with permission to approve updates, in both the sidebar badge and the notifications panel.
• On the Rollouts Status view, a deployment ring that is halted or waiting for your approval is now highlighted in its row, so the ring that needs your attention stands out at a glance from the rest.

Fixed

• Bulk and automatic application updates now show the same detailed per-app progress (compatibility check, download, install) and nested follow-up steps as manually triggered updates.
• The projected rollout timeline on a deployment ring now anchors each phase to its deployment window's scheduled start time, so the preview no longer drifts to the current time when you open it while a window is already active.
• The deployment ring rollout status now shows the next phase advancing at its deployment window's scheduled start, instead of when the phase's wait period simply elapses, so the time reflects when the rollout will actually progress rather than implying it could advance while the window is closed.
• Applications that are already current no longer appear as if they were re-installed; they now show a clear "Up to date" state instead of a misleading version change.
• A vulnerability scan that was canceled or did not finish no longer shows a duration timer that keeps counting up forever, and no longer reports a misleading "no vulnerabilities detected" result. Interrupted scans now clearly indicate that the scan did not complete, and any earlier scans affected by this display issue are corrected automatically.
• Endpoints no longer run extra redundant vulnerability scans once they have already been scanned, so an endpoint's activity history reflects the scans that actually matter instead of repeated near-duplicate entries.
• Your System Audit log now shows your full activity history with smooth continuous scrolling, instead of appearing limited to the 50 most recent entries.
• When TridentStack Control support staff view your environment, your System Audit log now records each support session as a single clear entry instead of many repeated entries.
• Approving a system update for a policy now updates the affected endpoints right away, instead of waiting for the next scheduled refresh, so newly approved updates become available to those endpoints promptly.
• Windows feature updates that are downloaded and staged ahead of time through a deployment ring now reliably complete their final install step, instead of staying staged without finishing.

New

• A new public CVE and CISA-KEV catalog at tridentstack.com/cve. Search and filter the full vulnerability catalog by severity, exploit-prediction score (EPSS), active-exploitation (CISA Known Exploited Vulnerabilities) status, ransomware association, and year, then open any CVE for its full record, including CVSS, references, and remediation context. Anyone can browse it directly from the website.
• New organizations are ready to manage updates the moment they are created. A new TridentStack Control organization now starts with a default system update policy, a default application update policy covering more than 30 common business applications, and an "all endpoints" tag that newly enrolled devices join automatically. As soon as you enroll your first endpoint, applicable operating system and application updates begin appearing, with no manual setup. Updates are surfaced and pre-approved for review; to start installing them, you create and assign a deployment ring.
• Tag automation rules can now match every endpoint in your organization with a single "Match all endpoints" option, with no conditions to build.
• Tag automation rules can now assign more than one tag. When you build a rule, pick any number of target tags, and every endpoint the rule matches receives all of them. Existing rules that assign a single tag keep working unchanged.
• See at a glance which update policies govern each endpoint. The endpoint list has two new optional columns, System Update Policy and Application Update Policy, showing the policy each device effectively follows. Enable them from the column menu, sort by them, and filter the list to a specific policy using the plus and minus buttons in any expanded endpoint row. The search box now also matches tag names and policy names, so you can type part of a tag or policy and instantly narrow the list.
• Target a deployment ring stage by tag, not just by percentage. Point a stage at one or more tags and it deploys to exactly the endpoints carrying those tags, giving you a stable, predictable set of devices in each wave of a rollout. Percentage-based stages still work the same way, and existing rings continue to roll out by percentage exactly as before.

Improved

• Vulnerabilities now appear within moments of enrolling a new endpoint. Newly onboarded devices are scanned as soon as their software inventory is received, instead of after a delay.
• New endpoints now show their setup progress live. A freshly enrolled device stays in an "Onboarding" state, and each section of its detail page shows a clear "Collecting…" indicator while its software inventory, system state, vulnerabilities, and update applicability are gathered, switching to the data the moment each one arrives, so you can see at a glance that everything is being fetched and computed.
• A refreshed getting-started tour reflects the new ready-made setup, guiding you to review your default update policies and create a deployment ring when you are ready to begin installing updates.
• More complete vulnerability detection for installed Python. Known issues affecting older Python builds are now surfaced more reliably, so out-of-date Python installs no longer appear cleaner than they are.
• More complete operating system vulnerability detection for Windows and Windows Server. Recent security issues are now surfaced in full on systems with long update histories, where lower-severity findings could previously be left out.
• More complete vulnerability severity scoring. Many recently published CVEs carry only a newer-format (CVSS v4.0) score, which was previously not read, so those vulnerabilities appeared unscored and could be deprioritized or left out of severity views. They now show their severity and score and are prioritized like any other vulnerability, across the endpoint vulnerability views and the public CVE catalog.
• More accurate third-party software vulnerability detection. Vulnerabilities in installed device and chipset drivers, such as Intel chipset software, are now detected, so out-of-date drivers no longer appear up to date. Separately, when a vendor publishes a lightweight monitoring agent and a full server product under one shared set of vulnerability identifiers, findings that only affect the server component are no longer shown on endpoints that run just the agent, removing false alerts (including some high-severity ones) from those endpoints' vulnerability lists.
• Endpoints that cannot install Windows updates because of a problem on the device (most often low free disk space) now show a clear amber "Updates blocked" indicator on the endpoint's System State view, instead of appearing idle. Select it to see exactly what is blocking updates and how to fix it. The indicator clears on its own once the underlying issue is resolved.
• A new "Hide ESU" filter on the Vulnerabilities page lets you hide vulnerabilities whose only fix requires an Extended Security Update (ESU) license. If your organization does not hold an ESU license, you can clear these unactionable findings from the list and focus on the vulnerabilities you can remediate today.
• More accurate fix guidance for vulnerabilities that are patched in a different version on each release line. When a vulnerability has a separate fix per major version line (for example, one fixed version on the 12.x line and another on the 13.x line), an endpoint's remediation details now list the correct fixed version for each line and mark the line your endpoint is on, instead of implying that any higher version number is safe. This prevents updating to a build that is numerically newer but still affected.
• Mark your most-used tags as favorites so they stay at the top of the tag picker. When you assign tags to an update policy, deployment ring, or compliance baseline, select the star next to a tag to pin it. Favorited tags appear first wherever you pick tags, and favorites are shared across your organization, so the tags your team reaches for most are always within reach.
• An automation rule's "Apply Rule" button now stays disabled until your edits are saved, so a rule is never applied with changes you have not saved yet. Save first, then apply, and what runs always matches what you see.
• The Vulnerabilities page is now easier to use on a phone. The All Vulnerabilities and By Agent views show each vulnerability or endpoint as a tap-friendly card instead of a wide table you have to scroll sideways, with search, filtering, and sorting all within reach.
• Filter auto-approved system updates by name: add an "Update Name / Title" condition with */? wildcards to include or exclude updates by title (for example, exclude *Preview*).
• New tag automation rules now start enabled. Once you set a rule's conditions and target tags, it takes effect right away, instead of having to switch the rule on as a separate step. You can still disable any rule at any time.
• Endpoint enrollments now appear on the System Audit log. When a device enrolls and begins onboarding, the platform records a System event for it, so you can see exactly when each endpoint joined your organization, filter the log for these events, and include them in your audit exports for change management and compliance.
• See exactly when each endpoint's next deployment window opens. The endpoint list's Next Window column now shows a specific date and time alongside the relative time (such as "in 1 day"), so you can tell at a glance precisely when scheduled updates are due to begin.
• The Moderate deployment ring preset now waits a full day at its second stage before widening to a full rollout. New rings created from the Moderate preset give the early-adopter group a longer soak so issues can surface on a smaller set of endpoints first. Existing rings keep their current settings, and you can still adjust any stage's wait time yourself.
• The health score dial on an endpoint's Health view now opens its breakdown when you tap or click it, showing how the overall score is weighted across vulnerabilities, compliance, pending updates, and network exposure. The breakdown was previously available only by hovering, so it is now reachable on phones and tablets too.
• Choose your agent-update pilot group by tag, not just by individual device. In the Agent Updates settings, add one or more tags to your Pilot Group and every endpoint carrying a selected tag automatically becomes a pilot, receiving a new agent version first before the rest of your fleet. You can still select individual devices, and combine devices and tags in the same pilot group.
• Deployment windows are simpler to set up. Instead of building separate day-of-week and time-of-day rules, you pick a start time and a duration, for example "Wednesday 10:00 PM for 6 hours". Windows that run past midnight are handled correctly, so an overnight maintenance window covers exactly the hours you intend. Your existing deployment windows are carried over automatically and keep running on the same schedule.
• See exactly how a deployment ring will roll out before you save. A ring widens to its next stage as soon as that stage's wait time and success criteria are met, and installs happen during your next deployment window, so a rollout flows on its own observation schedule while still respecting your maintenance windows. A new Projected Timeline shows the specific date and time each stage is expected to begin and when the rollout will finish, updating as you adjust the schedule, stages, and wait times and staying current as time passes.
• A deployment ring's final stage is locked at 100% and always sits last in the pipeline, so a rollout always finishes by covering every targeted endpoint. This makes the stage editor clearer and removes the chance of saving a ring that never reaches your whole fleet.
• For deployment rings that run around the clock with no schedule, settings that only apply to scheduled windows, such as pre-staging, automatic safety halt, and per-window execution limits, are now clearly shown as unavailable with a short explanation, so it is obvious which controls apply to your ring.

Fixed

• Offline endpoints no longer record repeated failed pre-staging download attempts. Update pre-staging now targets only endpoints that are online or recently connected, keeping endpoint history clean and accurate.
• Assigning a tag now works reliably wherever you are on the page. When you add a tag to a policy, deployment ring, or compliance baseline, the tag picker stays fully on screen, opening upward or scrolling within itself when space is tight, instead of opening partly below the bottom of the window. It also stays anchored to the button as you scroll.
• The endpoint Vulnerabilities tab no longer shows an occasional "Failed to load" error when a brief network interruption happens while the page is loading. Data views now retry automatically and recover on their own, instead of leaving you to refresh by hand.
• Confirming a sensitive change with a passkey now works on the first try. Passkeys created with Windows Hello, or saved to your device or password manager, are now reliably accepted when you verify a sensitive action, instead of sometimes needing to be set up again.
• An endpoint's activity history now reliably records system and application update refresh activity. Some of these refreshes could previously be left out of an endpoint's history; they now appear consistently.
• Software inventory refresh activity is now recorded for every endpoint, including devices that have an unusual character in an installed application's name.
• The search box on the Vulnerabilities page no longer loses focus while you type. Previously, once your search narrowed to no matches, the field would deselect itself and drop the keystrokes that followed; you can now type a full CVE search without interruption.
• Installing the Windows agent now works on older Windows and PowerShell versions. On some older systems, the quick-install command or the downloaded install script could fail to download the agent with a secure-connection (TLS) error; the installer now enables the required TLS version automatically, so the agent installs without manual workarounds.
• Large fleet rollouts now enroll without interruption. Adding many endpoints in quick succession from the same network location no longer pauses enrollment partway through, so you can bring an entire fleet online in one go.
• The "By Agent" view on the Vulnerabilities page can now be filtered. Its search box and "Has Critical" toggle now narrow the list of endpoints as you would expect, instead of having no effect.
• Sorting the automation rules list now works. Selecting a column header, such as Name, re-sorts the list as expected, instead of having no effect.
• You can now page through every vulnerability on the Vulnerabilities page. Previously the All Vulnerabilities and By Agent views showed only the first page of results with no way to reach the rest; page navigation now appears and works whenever there is more than one page.
• Opening an endpoint's details page is now smoother. The page no longer briefly flashes a "not found" message while it is still loading, and a momentary hiccup loading one part of the page no longer replaces the whole page with an error.
• Staged deployment ring rollouts now honor the full wait time you configure at each stage. A stage's wait timer now starts when that stage actually begins deploying during its maintenance window, so a stage set to wait one day reliably waits a full day of real deployment before widening to the next group, instead of sometimes advancing early. The notification you receive when a stage advances also now names the correct previous and next stage and shows that stage's true success rate.
• Deployment ring stage cards now display at a consistent size. The final stage card, which has no wait time, previously rendered slightly shorter than the others; every stage in a ring's rollout now lines up evenly.
• Endpoint health scores now stay up to date on their own. The platform refreshes each endpoint's health score automatically in the background as its condition changes, so the score you see stays current even for devices you have not opened recently.

Improved

• The install script you download from the Agent Installers page (Windows, macOS, and Linux) now comes pre-filled with your enrollment token, so an endpoint installs and registers correctly even when you run the downloaded script by hand. The page is also simpler: each platform shows a single Download Script button, with the advanced and manual install commands grouped together under Other Install Options.

Fixed

• On the Endpoints list, every endpoint row is now the same height, regardless of how many tags an endpoint has or how long it has been running, so the list is easier to scan.
• On phones, the Endpoints screen header no longer crowds the endpoint count, Add Agent button, and auto-refresh control into a single cramped row, so each control is easy to read and tap.
• On phones, save and confirmation dialogs (such as when saving a deployment ring) now keep their action buttons fully visible above the bottom navigation bar, so the Save and Confirm buttons are always reachable.
• Leaving a settings page that has unsaved changes (for example a deployment ring) using your browser or phone's Back button now prompts you to confirm before leaving, so edits are no longer discarded silently.
• A deployment ring whose rollout phases were edited after it was created could quietly stop sending scheduled updates to its endpoints, showing an idle schedule even when updates were pending. Affected rings now automatically resume deploying on their next scheduled window.
• A configuration policy whose settings are all set to "Disabled" is now correctly applied to your Windows endpoints. Previously such a policy was skipped and its settings were never enforced, even though it showed as assigned.
• Adding a Windows endpoint to a tag that has configuration policies now applies those policies to the endpoint right away, instead of only after the endpoint next restarts or reconnects. This also applies to tags assigned automatically by tag rules.
• Linux endpoints that are fully up to date no longer show a large list of operating-system vulnerabilities that have no available fix. The vulnerability list now reflects only the security updates that actually apply to the installed Linux kernel, so it matches the endpoint's update status.
• Adding a Linux endpoint to a tag that carries a system-update policy no longer makes it briefly show "System is up to date" while it actually has pending operating-system updates. The pending-update count for Linux endpoints now stays accurate through tag and policy changes.

Fixed

• Configuration policy changes now take effect on a Windows endpoint right away: assigning a policy applies it immediately, and removing an assignment removes it immediately, instead of waiting for the endpoint's next reconnect. The endpoint's Policies screen also now lists every assigned policy, where before it could show only the most recently applied one.

New

• Configuration Policies now include a built-in catalog of well-known Windows security hardening settings, including Certificate Padding enforcement, SMB v1 controls, credential protection, and a range of network-hardening options (the Microsoft Security Guide and MSS recommendations). They appear under Administrative Templates in a policy, are searchable, and show the recommended value for each, so you can apply trusted endpoint hardening without tracking down each setting yourself.

Improved

• The Vulnerabilities list now has an Affected Software column, so you can see which product each vulnerability affects (for example Google Chrome, Mozilla Firefox, 7-Zip, or a specific Windows edition) at a glance without opening each one. The affected software also appears in your vulnerability reports, and you can now search the list by software name.
• Expanded the opt-in Usage Analytics signals to include anonymized interaction and error diagnostics (counts and patterns only) so we can find and fix friction and bugs faster. No field values or identifiers are collected, and turning Usage Analytics off stops all of it. (Settings > Privacy)
• When a deployment ring has no schedule rules and runs around the clock, the ring editor now explains how the Pre-Staging, Safety Controls, and Execution Limits sections behave in that mode, so it is clear what each setting does when there is no maintenance window.

Fixed

• Fixed the Fix Available and KEV Only filters and the search box on the Vulnerabilities list, which previously had no effect. They now correctly narrow the list (including searching by affected software name), so you can focus on, for example, only the vulnerabilities that already have a fix available.
• Fixed an error that could occur when editing a setting you had just added to a Configuration Policy but had not saved yet. Adding, editing, and saving settings in Configuration Policies now works reliably whether the setting is new or already saved.
• Fixed an intermittent "Invalid or expired sign-in, please try again" error that could appear when signing in with Microsoft or Google, most often on phones and on privacy-focused browsers. Sign-in now completes reliably on the first try.
• The sign-in screen now offers a "Use a different account" option for Microsoft and Google, so you can choose or switch which account to use whenever you need to. Routine sign-in stays seamless: when your session expires, TridentStack Control reconnects you with your existing Microsoft or Google session instead of making you sign in again.
• Configuration Policy settings that accept a list of values, such as antivirus path, process, and file-type exclusions, now apply every value you enter. You can add and remove individual entries, and all of them take effect on your endpoints.
• Duplicating a deployment ring now copies all of its settings, including restart behavior and restart verification, per-window execution limits, and the Linux and macOS restart and service options. Previously some of these sections quietly reverted to their defaults on the copy, so a duplicate did not fully match the original.
• Fixed an issue where a deployment ring running around the clock (with no schedule rules) could permanently stop applying updates to an endpoint once it reached the per-window execution limit. The limit now resets on a rolling 24-hour basis, so endpoints keep receiving approved updates.
• Creating, importing, or duplicating a deployment ring through the API now works the same as it does in the dashboard. Previously these requests could fail when made with an API key.
• Deleting a Configuration Policy now reliably removes its settings from the endpoints it was applied to. Previously, settings from a deleted policy could remain in place on a device; they are now cleaned up automatically on the next check-in.

Fixed

• Editing an already-configured security setting in a configuration policy now shows its current values instead of opening a blank editor. Reopening a configured setting loads exactly what is currently set.
• The same sign-in method no longer appears more than once under Linked Sign-in Methods in user settings. Each linked sign-in method now appears only once.
• A large Windows feature update that has finished preparing and is waiting to be finalized is no longer incorrectly reported as failed shortly after it stages. Prepared feature updates now stay ready to complete as expected.

Improved

• The security settings catalog in Configuration Policies now includes the full set of Windows audit and security policy settings, including the complete Advanced Audit Policy Configuration subcategories (such as Kerberos authentication, process termination, and filtering platform auditing). Settings that were previously unavailable can now be found in search and configured.

Fixed

• Audit policy settings no longer revert to "No Auditing" while you are editing them, and the recommended-baseline indicator now correctly reflects whether audit policy and user rights settings match their recommended values.
• After saving a policy, audit policy and user rights settings now show their configured value (such as Success, Failure, or the assigned accounts) instead of appearing enabled but blank. The values were always saved correctly; this corrects a display issue in the editor.
• Windows 11 feature updates (for example, version 24H2 to 25H2) now apply correctly on a broader range of device configurations. A pre-installation compatibility check was stricter than necessary and could prevent eligible devices from receiving an in-place feature update. This improvement is rolling out to Windows agents now.
• Fixed an error that prevented saving certain restart settings, such as the maximum number of restarts allowed per maintenance window, when editing a policy.
• A scheduled update install that is skipped because another update is already running on the same device is no longer reported as a failure. It is now marked as superseded and retried in the next maintenance window.

Improved

• Security settings in Configuration Policies now show their category directly in the catalog, so settings that share a name (such as the two "Audit directory service access" settings) are easy to tell apart at a glance.
• Many more Windows security settings now include a plain-language description of what the setting controls, shown when you expand a setting in the catalog or open it to configure.

Fixed

• Advanced Audit Policy settings under the DS Access and Object Access folders now appear under those folders in the Configuration Policy editor's settings tree, matching the Windows layout, instead of only being reachable from the top level or from search.

Fixed

• Windows feature updates that finish installing but still need a restart to take effect now show as "Pending Restart" instead of incorrectly reporting as "Failed." The update is already staged and completes automatically the next time the device restarts.

New

• Preview the impact of a configuration policy before you apply it. For Windows configuration policies, you can now run a Preview Impact check against any group of endpoints (selected by tag or individually) and see, endpoint by endpoint, exactly which settings the policy would change and where it would conflict with another policy already in effect. A fleet summary shows how many endpoints would change and how many have conflicts, so you can catch surprises before anything is enforced. Open it from a policy's detail page or from the actions menu on the policy list.

Improved

• More control over how agent updates reach your fleet. Choose a pilot group that receives new agent versions first, and optionally hold updates for a set delay window before rolling out to everyone else. These controls now apply to your own fleet and reflect its real update status.
• Application icons load faster throughout the package catalog, including on large policy and application pages.

Improved

• New update policies now default to targeting every operating system present in your fleet, so a policy can't be created that accidentally covers none of your endpoints.
• Endpoints now show a clear notice when no active policy targets their operating system, making it obvious why an endpoint is not receiving updates.
• Linux endpoints now display their available update counts and policy coverage details in the updates view, matching the Windows experience.

Fixed

• API keys can now be used to create update policies and configurations. These requests previously returned an error.

New

• You can now follow TridentStack Control updates on our public changelog at tridentstack.com/changelog, including an RSS feed for your reader of choice.

Improved

• The dashboard now loads noticeably faster and picks up where you left off instantly while refreshing data in the background.
• Vulnerability lists on agent pages load significantly faster.
• Pages that poll for updates now skip downloading data that has not changed, reducing background data transfer throughout the console.
• The Reporting page loads much faster on first visit.

Fixed

• Raw SQL report queries ending with a semicolon are now accepted instead of being rejected.
• When a report query fails, the error message now remains visible instead of leaving the results area blank.

New

• Import your existing Group Policy configuration: upload a Group Policy backup from the Policy Objects page, preview which settings TridentStack Control recognizes, and import them as policy objects. Imported policies arrive disabled so you can review them before enabling enforcement.

Improved

• Agent 1.1.57 began rolling out with stronger pre-installation checks for application updates, reducing failed installs.
• Windows feature upgrades now verify available disk space before starting, and report clearly when an endpoint does not have enough free space to upgrade.

Fixed

• Fixed an issue where some macOS application updates could fail to download.

New

• Microsoft Entra ID group sync: connect your Entra tenant under Settings, map groups to endpoint tags, and group membership stays in sync automatically every hour. Tag-based policies follow your directory without manual upkeep.
• EPSS exploit-prediction scores on vulnerabilities: both vulnerability views now show each CVE's likelihood of real-world exploitation alongside CVSS severity, with sorting and a minimum-EPSS filter to focus on what is most likely to be attacked.
• A guided setup experience for new tenants walks through enrolling your first endpoint, creating update policies, and organizing endpoints with tags. Replay or turn it off any time from User Settings.

Improved

• Vulnerability scanning is now incremental: endpoints are rescanned when their software actually changes instead of on every cycle, so results appear faster and fleet-wide scans finish sooner.
• The endpoints list refreshes automatically in the background, with a toggle to turn this off.

Fixed

• Notifications for newly detected critical vulnerabilities are now delivered reliably.

Security

• Ongoing security hardening across the platform as part of our regular security review process.

New

• A public status page is available at tridentstack.com/status, covering the application, agent connectivity, documentation, and website with uptime history.

Improved

• Vulnerability remediation status is clearer: when a fix has been installed but the endpoint has not been rescanned yet, the vulnerability now shows "Update installed, refresh on next scan" with a one-click Re-scan now button, instead of an ambiguous state.
• After remediating a vulnerability on an endpoint, a follow-up scan runs automatically so the result reflects the fix without waiting for the next scheduled scan.

Fixed

• Vulnerabilities that only affect the mobile edition of an application are no longer flagged against the desktop edition installed on your endpoints.

New

• macOS endpoints can now enroll in TridentStack Control. Manage Apple devices alongside your Windows and Linux fleet, including software inventory, update visibility, and policy assignment.

Security

• The macOS and Linux agent installers now verify the integrity and authenticity of the installation package before installing, protecting against tampered downloads.

New

• Billing is now live. Your first 200 endpoints remain free forever; beyond that, endpoints are $5 per month each, with an annual option that saves two months.
• Manage your payment method, view invoices, and track license usage directly from the dashboard.
• Licenses are assigned automatically as endpoints enroll, so there is nothing to provision by hand.

New

• Windows hotpatch updates are now identified in the update catalog with a dedicated badge, so you can see at a glance which updates install without requiring a restart. Endpoint detail views show whether each device is hotpatch ready, with a guide for enabling hotpatching in your environment.
• Compliance templates now show a risk summary before you apply them: how many controls could affect connectivity or sign-in behavior, with the highest-risk controls called out for review.

Improved

• Hotpatch releases carry full severity information and link to Microsoft's release documentation from the update detail view.
• Policies created from compliance templates record which framework they came from, so you can trace a setting back to its DISA STIG source.

New

• TridentStack Control is now generally available and serving production customers. One platform for patch management, third-party application updates, vulnerability detection, compliance tracking, and policy management.
• Native OS update management for Windows and Linux endpoints, with approval workflows, deployment rings for phased rollouts, and supersedence tracking.
• Third-party application updates with version targeting, silent installation, and per-group configuration profiles.
• Automatic vulnerability detection from your software inventory, with CVSS severity prioritization and exception management.
• Compliance framework tracking for DISA STIGs and Microsoft Security Baselines, with automated scoring, plus NIST 800-53 control mapping.
• Policy management with a web-based settings catalog that works with or without Active Directory.
• Your first 200 endpoints are free forever, with every feature included.