What is new
Detection drops and product notes, in the order they shipped
Written by the people who shipped the thing, not by a marketing team summarising a sprint board.
12 Aug 2026
Detection
Prompt-injection detection pack v3
41 new checks covering tool-calling agents, RAG retrieval and system-prompt exfiltration. The pack back-ran against every scan from the last 90 days, which surfaced 9 findings on applications that had already been reported clean.
04 Aug 2026
Product
Cloud Posture leaves beta
642 checks across AWS, Azure and GCP, now included on every plan at no extra cost. Delta sweeps triggered after a deployment finish in under sixty seconds.
28 Jul 2026
Product
Retest SLA cut to 24 hours
Ask for a retest before 4pm and the engineer who filed the finding verifies it the same day. Retests stay unlimited and are never billed separately.
19 Jul 2026
Detection
SAML replay class added
Three new checks covering assertion replay, audience confusion and acceptance of unsigned responses. Found on a live engagement on the 17th and shipped to every customer within six hours.
09 Jul 2026
Product
Diff-only scanning
App Scanner can now test only what a pull request changed. Median diff scan is 84 seconds, against a median full scan of six minutes, which makes it viable as a required check.
27 Jun 2026
Platform
Attack paths across surfaces
App, API and cloud findings now share one graph. A leaked key plus a public bucket plus a permissive IAM role is reported as one path with one owner, instead of three tickets in three queues.
14 Jun 2026
Integration
Linear two-way sync
Close a finding in Linear and the retest starts in Osprey. Status, severity and assignee stay in step in both directions, and the finding history records who closed what.
02 Jun 2026
Detection
Authorisation matrix testing
API Surface now replays every endpoint as every role you define, rather than testing route by route. Object-level ownership checks are included, which is where most new findings come from.