What's new in TridentStack Control

Improved

• The dashboard Fleet Health Score now aggregates the same per-endpoint health scores shown in your endpoints list and its trend line, so the headline figure stays consistent with the detail beneath it.
• Windows feature update downloads now scale cleanly on large sites where many endpoints share a single public IP address, so a deployment ring can roll a feature update out to an entire office without the downloads being throttled.

Fixed

• Deployment rings now keep a rollout moving while long-running updates finish installing, and they follow your safety-control settings exactly, halting only on genuine failures when those controls are enabled.
• Deployment ring safety control settings now display and save exactly as you configure them.
• Application updates now select the English installer when a package offers several language variants, for more consistent installs.

New

• New accounts now start with a complete, conservative baseline: automatic OS-based endpoint tagging, a system update policy with a 7-day quality bake, two app update policies (popular apps kept current, server tools held at N-1), and three ready-to-attach deployment rings. Nothing installs until you attach a ring.
• Monthly and twice-a-month deployment ring schedules. A deployment ring window can now open on a specific occurrence of a weekday each month, such as the 2nd Tuesday, instead of only a weekly day-of-week schedule. In the window's Repeat setting, choose Monthly, pick a weekday, and select one occurrence (1st, 2nd, 3rd, 4th, or Last) for a once-a-month cadence or two for twice a month. Existing weekly windows are unchanged, and the ring's Next Window time reflects the monthly cadence.
• Force Reboot for deployment rings. A deployment ring can now guarantee its endpoints reboot at the end of an update run, even when no single update required a reboot. It is off by default, respects each endpoint's own reboot opt-out, and clearly shows in the rollout status when an endpoint opted out.

Improved

• The tag selection dialog now has a search bar: when assigning tags to an endpoint (or to several at once), type to filter the tag list by name or description instead of scrolling. It appears automatically once your account has more than a handful of tags, and tags you have already checked stay selected while you filter.
• The setup guide now walks every module from Endpoints to Rollout Status, explains the defaults created for your account, and advances instantly on every click (no more timed pauses).
• Moving through the setup guide is smoother: the button that advances to the next step now glows so it is clear what to click, a new back arrow lets you return to an earlier step, and the guide explains that your starting tags, policies, and deployment rings were preloaded as sensible, best-practice defaults.
• Windows updates that fail because the endpoint's component store is corrupted now show a clear cause and the exact repair step, instead of a bare number like "Exit code 14081". This covers the common component store corruption failures (a required system component missing or damaged), so you know at a glance why a cumulative update did not install and how to fix it.
• Windows endpoints with a corrupted component store are now flagged on the endpoint's health view, with the exact repair step to run, so you can catch and fix the problem instead of only finding out when an update fails. It is detected both when a cumulative update fails with that error and from the endpoint's own servicing logs.
• Standardized reboot wording across the platform: powering an endpoint off and on is now consistently called "Reboot" (the "Reboot Endpoint" action, "Reboot Required", "Reboot pending", reboot settings), while "Restart" now refers only to a service or application. This removes the confusing "Restart Agent" label that read as if it restarted the TridentStack Control agent rather than the machine itself.
• New updates now appear on your endpoints within minutes of being published to the TridentStack Control catalog. Update and application catalogs also refresh more frequently throughout the day, so Patch Tuesday releases and new application versions show up as pending automatically, with nothing to refresh by hand.
• Uploading a custom package now shows clear, staged progress while it is scanned: preparing, scanning for malware, verifying the installer, and reading package details, with a note that it can take a minute or two and continues in the background. A thorough security scan of a large installer no longer looks like it has stalled.
• The Agent Tags list now shows, at a glance, which policies each tag applies: its System Update Policy, Application Update Policy, Compliance Frameworks, and Configuration Policies. When a tag has more than one compliance framework or configuration policy, the column shows the count. The new columns appear by default and can be shown, hidden, reordered, and resized from the Columns menu, so you can review a tag's full policy coverage without opening each tag.
• Select a range of rows at once: click one checkbox, then Shift-click another, and every row between them toggles together (endpoints, license, and update tables).

Fixed

• Uploading a large custom package now works. Installers up to 2 GB are scanned for malware and published successfully; previously an installer over roughly 100 MB could fail its security scan with an unclear message.
• Custom package details now show a clean publisher and product name. Stray trailing characters, such as a leftover slash or comma, are removed from the values TridentStack Control detects automatically from the installer.
• Software inventory now records reliably on Macs with a large number of installed applications. Previously a Mac with a very long application list could silently fail to report its installed software, leaving its software inventory empty and its vulnerability and update coverage working from incomplete data. Those endpoints now sync their full application list.
• The endpoint Health tab now loads reliably on endpoints with a very large number of detected vulnerabilities. Previously an endpoint with many thousands of findings (common on a freshly enrolled Linux server) could fail the Health tab with "Failed to load health data," and could briefly affect the Health view for other endpoints too. The health score and its vulnerability, compliance, update, and network breakdown now load as expected.
• The "last refreshed" time on the Pending System Updates view for Linux endpoints now reflects the most recent automatic update check. Previously it could show an older time even though pending updates had just been re-checked in the background.
• Removed a brief "Something went wrong" flash that could appear when clicking a navigation item in a browser tab that had been open across a TridentStack Control update. The app now shows its normal loading indicator while it refreshes itself to the new version, and the error screen is reserved for genuine failures.

New

• TridentStack now has an official community Discord server for free support, product news, and feature discussion: https://discord.gg/nNyHySNSZF. Join links are in the website and documentation footers and on the changelog page.
• Video walkthroughs are now published on the official TridentStack YouTube channel: https://www.youtube.com/@tridentstack. Links are in the website and documentation footers.

Improved

• Rollout status now clearly distinguishes an endpoint that failed but will be retried automatically ("Retry scheduled", with the next attempt time) from one that has genuinely stopped, so a failed patch no longer looks like a dead end.

Fixed

• A Windows feature update that could not start because a device was waiting on a pending restart is now correctly shown as a deferral that retries automatically after the restart, instead of being recorded as a failed upgrade. This also prevents a group of restart-pending devices from unnecessarily halting a deployment ring's rollout to the devices that are ready to upgrade.
• The advisory notice shown on a device after an operating system rollback (for example a restored snapshot or an uninstalled feature update) now clears automatically once the device's refreshed system data arrives, instead of remaining visible indefinitely. Devices that are offline when the rollback is detected also keep their automatic data refresh queued until they reconnect, no matter how long they stay offline.
• System details for Linux devices in the Enterprise Linux family (Rocky, RHEL, Alma) now populate correctly. Their longer kernel version identifiers previously failed a storage limit, which could leave a newly enrolled device's system information blank indefinitely.
• Newly enrolled Linux devices now come online as soon as their initial data collection finishes (typically under two minutes), instead of always sitting in onboarding for the full five-minute safety window.

New

• TridentStack Control now warns you before a policy or security-baseline template would set a Windows service to Disabled that Windows needs in order to install its monthly cumulative updates. Disabling one of these services silently causes those updates to fail and roll back on the affected endpoints, which can look like update corruption; the new heads-up appears while you configure the policy (and when importing settings or applying a compliance baseline) so you can choose a safe startup type instead. The warning is advisory and does not block you if the change is intended.

Improved

• Update approval criteria that check for known Microsoft issues now consider only issues Microsoft still lists as active. Updates whose reported issues have all been resolved by Microsoft are no longer held back from auto-approval, matching what the update details already show.
• The auto-approval condition for updates with known issues is now named "Unresolved Known Issues", making it obvious that an update is only held back while its reported issues remain unresolved.
• Auto-approval policy criteria now show an in-line help icon that explains what each condition matches, so it is clear what a rule such as "Unresolved Known Issues" or "Update Age" actually does while you build a policy.
• Known Microsoft issues on recently released Windows updates now refresh daily instead of weekly, so newly reported problems and Microsoft resolutions reach your approval decisions much sooner.
• A Windows update that TridentStack Control is holding back after it repeatedly failed to install (for example, one an endpoint rejects while applying it during a restart) is now clearly flagged on the endpoint's page, with a Retry control to attempt it again once you have resolved the underlying endpoint issue. Previously a held-back update stayed in the list with no indication it was being held back or how to re-attempt it.
• When a Windows feature update (a major version upgrade, such as moving an endpoint to a newer release of Windows 11) does not complete, the endpoint's History now shows the specific reason it did not finish, such as the upgrade rolling back during setup because of a device driver, being blocked by an incompatible application, or not having enough free disk space. Previously these showed only a generic failure, and finding the cause meant collecting logs from the endpoint.

Fixed

• Fixed some Windows updates (notably certain .NET runtime updates on 64-bit servers) being downloaded with a mismatched-architecture installer, which made them keep showing as needed and reinstall every maintenance window even after a successful install. TridentStack Control now downloads the architecture-matched installer, so these updates apply once and clear.
• Fixed a case where a system update that cannot successfully install on an endpoint (for example, one Windows rejects while applying it during a restart) would keep reinstalling and restarting that endpoint every maintenance window. TridentStack Control now confirms an update actually took effect after the restart; one that repeatedly does not is held back from further automatic attempts (it stays listed as needed) and can be retried from the agent once the underlying endpoint issue is resolved.
• Fixed a display issue where the system update policy editor, the application update policy builder, and the automation rule editor could show two vertical scroll bars at once. These pages now use a single scroll area.
• Fixed a rare condition where a temporary Microsoft service outage during catalog enrichment could briefly clear the known-issues list on affected updates. Known-issue data is now always preserved until fresh data is confirmed.
• Fixed auto-approval policies silently skipping updates that had previously been superseded and later became relevant again, so they now get approved the way the policy intends instead of requiring manual approval.
• Fixed agent update tasks in the endpoint History tab showing an incomplete phase timeline: the Download and Signature steps appeared blank and the Service and Install steps showed 0ms. All phases now report their real status and duration, including updates that finish while the agent restarts and reconnects.
• Fixed assigning licenses to several endpoints at once. From the Licensing settings page, selecting multiple endpoints and choosing Assign Licenses could fail with a generic error and leave the endpoints unlicensed. Bulk assignment now completes reliably.
• Fixed feature updates and system updates that TridentStack Control skips before starting (for example, when an endpoint does not have enough free disk space to install safely) appearing in the endpoint's History as a red failure with raw technical details. These now show a clear, neutral "Skipped" entry with a plain-language reason, so it is obvious the update was intentionally held off rather than having failed.

New

• Package Catalog: upload and deploy your own custom application packages. Bring your own installers, keep multiple versions of each package with their own install settings, and deploy them on demand or through your application update policies and deployment rings, exactly like catalog applications. Every uploaded installer is security-scanned before it becomes available to deploy.
• Deploy an application to your endpoints on demand. From an endpoint's actions, or as a bulk action on the Endpoints list, pick an application and the exact version to install and push it to one or many endpoints at once, without setting up a policy. Offline endpoints can either receive the install automatically the next time they reconnect, or be skipped. Track every deploy from a dedicated One-Time Deployments view on the Rollout Status page, showing who triggered each deploy and per-endpoint progress for what succeeded, what is still running, and what is queued. Click any endpoint to open its install history for that deploy, and jump straight back to the deploy from that endpoint's history. A quick identity re-verification is required before a deploy runs.
• Update how a custom package version installs without re-uploading it. Open a custom package, expand an available version, and edit its install settings in place (install arguments, success exit codes, timeout, and how the app is detected as installed), then save. The installer file you uploaded stays exactly as it was, and a quick identity re-verification is required before the change is saved.

Improved

• Searching for an application to deploy or add to a policy now puts the common, canonical version of an app at the top of the results, so the one you want is the first thing you see instead of being buried under regional or edition-specific variants. The results list also jumps back to the top each time you change your search.
• Windows system-update refreshes, whether you start them manually or they run automatically in the background, now report their progress through the same reliable, fully-narrated task view as your other refresh activities, and hold up cleanly across restarts and reconnects.
• Linux and macOS "check for updates" refreshes now report their progress through the same reliable, fully-narrated task view as Windows.
• Compliance evaluations now report their progress through the same reliable, fully-narrated task view as your other refresh and scan activities.
• Windows feature updates (moving an endpoint to a newer Windows version) now report their progress through the same reliable, fully-narrated task view as your other update activities, and track cleanly through the restarts these upgrades require, so a completed upgrade always shows as finished instead of appearing to hang.
• Office updates now report their progress through the same reliable, fully-narrated task view as your other update activities, with each step and its result shown clearly.
• Application icons render more accurately across the catalog: apps now show their full-color logo where one exists, more applications resolve to their correct icon, and applications with no recognizable logo show a clean placeholder instead of a generic silhouette.
• Package Catalog now uses a single Windows / macOS / Custom switch with a consistent table across all three, and a New Package button that is always one click away.
• Rollouts now have a dedicated detail page. Click any ring on the Rollout Status page to see live per-endpoint progress, installed updates, restart timelines, and full attempt history, with filters and search. Endpoint names link straight to the endpoint's page, and the ring's activity feed loads older entries on demand with a Load more button.
• Rollout and endpoint history are now linked both ways: clicking an endpoint on a rollout page jumps straight to that endpoint's history with the exact task expanded, and ring-driven tasks in endpoint history link back to their rollout.
• Configuration policy editor: when viewing configured settings, each section (Administrative Templates, Security Settings, System Services, Registry) can now be collapsed so you can move between them quickly, and every setting's Edit and Remove actions now sit together on the right of the row, clearly separated from the status labels so it is easy to tell actions from labels at a glance.
• Opening a custom package now goes straight to its details and versions instead of an add-a-version form. Add a version on demand with the Add version button, and the form pre-fills the installer type and install settings from your most recent version, so adding another build no longer means re-entering the same configuration. The editor also scrolls as a single, clean view.
• The Application Update Policies list now shows a Schedule column, so you can see at a glance when each policy's updates are set to deploy, based on its assigned deployment ring's window, without opening the policy. This matches the Schedule column already on the System Update Policies list.
• The dashboard's Patches Applied (30 days) tile now shows a single clear total instead of a small trend line that was hard to read at a glance.
• The deployment ring rollout view no longer includes the manual bulk restart action for pending endpoints. After an update, endpoints continue to restart according to your ring's automatic restart settings and each endpoint's own restart policy.
• Rollout detail page: the paused banner and the Status tab now show who paused a ring, not just when, so you know who to check with before resuming.
• Rollout detail page: when a ring is paused or halted, the "Next check" countdown now reads "Checks suspended" instead of ticking down, making it clear nothing will dispatch until the ring is resumed or un-halted.
• Rollout detail page: the endpoint table can now be sorted by hostname, status, or last execution time.

Fixed

• Deployment ring editor: the rollout timeline preview now stays visible while you set up a deployment window. Previously, adding a new window briefly blanked the timeline and showed a "could not project the rollout timeline" warning until you finished choosing the window's days.
• Configuration policy editor: the View Configured button now reliably switches to the configured-settings view even while a settings browser (registry, services, drive mappings, or security settings) is open. Previously the click appeared to do nothing.
• Configuration policy editor: the Tag Assignments dialog now has a Done button, so it can be closed without hunting for the small corner icon.
• Endpoint details: clicking a deployment schedule badge now anchors the ring status popover to the badge. Previously it could appear detached, floating above the row it belongs to.
• New-endpoint notifications now report how the endpoint actually enrolled (enrollment token or registration key) instead of always saying "API".
• When the TridentStack Control agent updates itself, the resulting Client Update entry in an endpoint's history now shows each completed step with a clear status and a real duration instead of blank or unmarked rows, and a leftover placeholder step that never ran has been removed, so a finished self-update reads as finished at a glance.
• Configuration policies created from a template now open straight into a usable settings editor. Previously a large summary panel filled the top of the page and pushed the settings editor off-screen on smaller displays, which made a template-based policy look like it could not be edited.
• Configuration policy editor: searching your configured settings no longer switches you out of the "View Configured" view. You can type in the search box to filter within the settings you have already configured, instead of being dropped back into the full catalog.
• First-run setup guide: after you have opened the page with your install commands, coming back to it before your first endpoint has checked in now re-highlights the commands to copy, instead of steering you back to an empty Endpoints list. The guide only points you to Endpoints once a device has actually started enrolling.
• Agent self-update rollouts no longer stall partway through a fleet. A bookkeeping issue in the update pacing could leave a rollout appearing complete while some online endpoints never received the new agent version; pacing now recovers automatically and every online endpoint receives the update.
• First-run setup guide: the guided setup no longer gets stuck on the update-policy steps when a default policy is not present (for example, if you deleted it or your account predates the auto-created defaults). Each step now always offers a clear way to continue, and the guidance adapts to what you actually have set up instead of assuming a policy was created for you.
• Newly enrolled endpoints could show a mostly empty System State tab (missing edition, version, locale, installed updates, and component versions) for many hours if their very first check-in was interrupted, and refreshing did not help. The first report is now recorded reliably, and a refresh always brings the System State tab up to date.

Improved

• Patch Tuesday updates now reach the update catalog within about an hour of Microsoft publishing them.

Fixed

• Rollout Status now shows an accurate duration and an explanatory note for a run that only cleared a pending restart, instead of a blank "--" that looked like missing data.
• Searching the update catalog now ignores accidental leading or trailing spaces in the search box on every platform tab, so a pasted search term with a stray space no longer comes back empty.
• Automation rules set to match all endpoints now show that clearly in the rule list, instead of displaying leftover condition rules from before the toggle was turned on.
• Automation rules set to match all endpoints now correctly tag brand-new endpoints as soon as they enroll, instead of only picking them up on the next scheduled run.
• Removed the "Last sync" indicator from the update catalog header. It always displayed "Never" and could look like the catalog was broken.

Improved

• The rollout detail page now shows each rollout phase as an interactive card, matching how phases are configured in the deployment ring editor. Cards carry the phase's live status, how many endpoints have completed or failed, and exactly what the phase is waiting on; clicking a card filters the endpoint list to that phase.
• Rollout phase timing is now always truthful: a phase that is soaking shows a future advancement time, a phase held by its success criteria says why (for example "Waiting for results from 3 agents" or "Success rate 62% is below the required 80%"), and a fully completed rollout shows a clear "Rollout 100% complete" banner with when it automatically restarts for the next update cycle.
• The rollout endpoint list's Status column now includes a full status key, and endpoints whose update reported success but did not actually apply ("Not Converged") get their own filter and an explanation of how TridentStack Control automatically retries them.

Fixed

• Uploading an installer for a custom package now works from the browser. Adding a new version would previously fail at the point of saving the file; that upload path now completes reliably.
• Windows 11 25H2 endpoints are no longer offered .NET Framework cumulative updates built for version 24H2. These packages are version-specific, so Windows rejected them as "not applicable" and the failed install could stall a deployment run. Endpoints on 25H2 now only receive the 25H2 .NET Framework package.
• Fixed a pre-download verification defect where an update staged ahead of its deployment window could be checked against the wrong file signature when Microsoft publishes one update entry covering multiple processor architectures. The install then failed with "Installer hash verification failed" even though the downloaded file was correct. Affected endpoints are healed automatically with this release, with no re-download needed.
• Rollout phases no longer show contradictory states such as an "Active" badge next to a "Completed" timestamp, an advancement date in the past, or a completed rollout reading 67% complete.
• Rollout phase health is now measured against the current rollout cycle only, so results from a previous cycle can no longer stall a phase or freeze its advancement projection.
• Failed Windows feature upgrades in a deployment ring now record the actual reason for the failure (for example which pre-upgrade check blocked the upgrade, or that the endpoint's build did not advance after its restart) instead of the unhelpful "Feature upgrade failed: Unknown error".

New

• Connect your AI assistant to the TridentStack Control documentation. If you use Claude, Cursor, or another assistant that supports the Model Context Protocol (MCP), you can now add our documentation server so the assistant searches and reads our guides, API reference, changelog, and roadmap directly, keeping its answers grounded in the current docs. Setup takes one line and is covered in the Getting Started guide, "Connect your AI assistant."
• Endpoints can now inherit multiple application update policies through their tags. Compose focused policies (browsers, runtimes, tooling) and layer them per endpoint - each policy updates only the applications it selects, within its own deployment ring window. When two policies target the same application, the more conservative one wins automatically, and a pinned version never downgrades an already-newer install.
• Disabled update policies can now be assigned to tags and stay visible everywhere they matter. A disabled system update or application update policy remains selectable in the tag editor with a clear Disabled status, and an endpoint whose tags carry one shows it as Disabled on the endpoint's details instead of hiding it. A disabled policy applies nothing while disabled. For system update policies, a disabled policy also keeps its place in the priority order: if the highest-priority policy on an endpoint is disabled, updates simply pause for that endpoint rather than unexpectedly falling through to a lower-priority policy carried by another tag.

Improved

• The Client settings page now makes clear exactly what each update setting controls. Windows Update Management has moved into its own section explaining that it governs the endpoint's built-in Windows Update at the operating system level, with expanded descriptions of what Exclusive and Hybrid each do, and Manual Update Installation now states that it only controls whether a person at the endpoint can start installs from the client app. Because changing Windows Update Management reconfigures every Windows endpoint in your organization, saving that change now asks for confirmation and lists exactly what will happen before it is applied.
• Two settings were retired from the Client settings page to reduce clutter: the update notification toggle (the only client notification is the restart prompt, which has its own "Show reboot prompts" setting) and the update check frequency intervals (update refresh timing is managed automatically by the platform and spread across your fleet to avoid load spikes; it no longer needs manual tuning).
• The Columns menu on list pages now has a search box. When a table has many columns, type a column name to quickly find the one you want to show or hide, instead of scrolling the full list.
• Deployment ring safety halts are now configurable per rollout phase, so an early, cautious phase and a broad later phase can each use their own halt threshold. You can also choose whether a failed application update counts toward halting a ring.
• The deployment ring phase settings now read more clearly and are cleaner to fill in: an "or" label between the success-rate and maximum-failures thresholds makes explicit that reaching either limit will hold a phase, and time fields no longer keep a stray leading zero (for example "048") while you edit them.
• The maximum executions per window setting in the deployment ring editor now caps itself to what actually fits in the ring's schedule: roughly one full deployment cycle per 30 minutes of the longest window, up to 10. The helper text explains the cap for your ring, and if a later schedule change shrinks the window below an already-saved value, the editor points that out instead of leaving a limit that can never be reached.
• The deployment ring editor now makes clear that every deployment window needs at least one day selected: a window with no days shows the requirement inline and the ring cannot be saved until a day is chosen. Previously the editor let you attempt the save and only failed afterwards with a technical error, even though a window with no days would simply never open.
• The deployment ring editor now flows in the order a rollout actually works: deployment windows come before rollout phases, and each phase card shows the projected date and time that phase will start (with the whole rollout's projected completion shown beneath), updating live as you adjust the ring. Window durations are now capped at 23 hours, since each selected day opens its own occurrence of a window and a longer duration would overlap the next day's; rings meant to deploy around the clock simply use no windows. Applying a phase preset also no longer fills in the ring description, so the description stays exactly what you wrote.
• The endpoint Actions menu now shows a "No Policy" indicator on Install Application Updates when no application update policy is assigned, matching the existing indicator on Install System Updates, on desktop and mobile alike. Menu entries also no longer wrap onto two lines when an indicator is shown.
• Policy priority now uses one consistent 0-100 scale on system update policies and automation rules, with new items defaulting to 50. Higher numbers still take precedence, and any existing priorities from the old wider scale were converted to the new scale automatically, keeping their relative order.
• Assigning a configuration policy to tags is now a simple add and remove, matching the way system update policies work. The per-assignment priority and enable/disable switch, which were unused and only added confusion, have been removed; a configuration policy applies to every tag it is assigned to.

Fixed

• The "Show all rings" toggle on the rollout status page now reliably updates the list on the first click. Previously, toggling it (especially quickly) could briefly leave the list showing the previous selection until another click, because a slower background refresh could finish last and overwrite the newer result.
• Switching the Windows Update Management client setting to Hybrid now reliably returns Windows Update to the endpoint's own control in every case. Previously, if TridentStack Control's update configuration had been partially altered on the endpoint, switching to Hybrid could silently leave the remaining blocking settings in place, keeping the endpoint's built-in Windows Update disabled. The agent now detects and removes every remaining piece of its own configuration, restores each setting it changed to the value it had before, and never touches Windows Update settings that belong to your own policies or another management tool. Note that the Windows Update page in the endpoint's Settings app can take a while to reflect the change; updates themselves resume immediately.
• Saving a column layout as a preset now works on every list page. Previously, the Columns menu's "save as preset" option only took effect on the Endpoints page; on other lists (such as System Update Policies, Application Update Policies, Tags, Automation, Policy Objects, and Custom Packages) saving a preset appeared to do nothing. You can now save, name, switch between, and set a default column layout on any list page, and your default view loads automatically each time you open it.
• Running a saved report works again. Since the previous release, running any saved report failed with a "Failed to run report" error even though the report itself was valid; the run now completes and the report's run history (last run time and run count) is recorded correctly.
• macOS endpoints now only offer application updates that an assigned application update policy actually covers. Previously, a macOS endpoint could list and attempt updates for applications outside any assigned policy, and the install was then rejected. Uncovered applications are now excluded from install actions and labeled in the pending list: "No Policy" when no application update policy is assigned, or "Not in Policy" when the assigned policies do not cover that application.
• Application updates that hit a transient download problem now fail cleanly and retry, instead of occasionally reporting a confusing installer error.
• An application installed only for the signed-in user, whose newer version is only offered as a system-wide installer, is no longer shown as "not installed." It now correctly shows as installed, with the available update flagged as requiring a system-wide install.
• The Rollout Status tab now reports a deployment ring's next timing accurately. A ring that has finished everything it can do in the current maintenance window shows the next real window (when installs resume), instead of a "Next Dispatch" countdown implying an install is moments away or a "Next Window" that looked like it opened at the current minute.
• A deployment ring set to run at all times (every day, around the clock) now clearly reads as always open everywhere it appears, including the rollout status view and the calendar, instead of a shifting "Next Window" time or a calendar entry that looked like it started at a specific hour.
• An endpoint whose application updates all fail now still receives its pending system and security updates in the same maintenance window, instead of having them skipped because an application update failed. An application that fails is not retried again within that window, while the endpoint's other updates continue.
• Data tables now render correctly in Firefox. Previously, list pages such as Endpoints showed rows with no visible content in Firefox because the table stretched far beyond the screen, which also made search results appear blank.
• Creating or renaming a tag with characters that are not allowed now explains exactly what went wrong, naming the specific invalid characters you used (for example a space or an underscore), instead of a generic save-failed message with no detail.
• The All Vulnerabilities view now reports exact figures for fleets of any size. On very large fleets, the severity counts and the vulnerability list were previously computed from only part of the data, so the counts on the severity buttons could shift each time you changed the selection and some affected endpoints went uncounted. Counts are now complete, stable, and consistent no matter which severity or filter you pick. When the same vulnerability is assessed differently across endpoints, the view now also reports the most severe assessment and shows a fix as available if any affected endpoint has one, rather than an arbitrary one.
• The severity buttons on the All Vulnerabilities tab now respond to the KEV Only, Fix Available, Hide ESU, search, and Min EPSS filters: each button shows exactly how many matching vulnerabilities of that severity exist, and selecting one shows exactly that many results. Sorting the Severity column now always keeps Critical rows above High, regardless of underlying scores.
• Vulnerability numbers now agree across the product. The Dashboard vulnerability tiles, the Vulnerabilities page header, and the Overview tab all use the same definition of an active detection: open vulnerabilities on active endpoints, excluding anything you have excepted, counting each vulnerability once per affected endpoint. Previously the Dashboard tiles also counted acknowledged findings, retired endpoints, and excepted vulnerabilities, so they could never match the Vulnerabilities page. Counts of endpoint detections are now labeled as detections to distinguish them from counts of unique CVEs.
• A vulnerability's detail page now shows the status breakdown (open, resolved, and so on) across all affected endpoints instead of only the endpoints on the first page, and its endpoint search now searches every affected endpoint rather than the visible page.
• Exporting vulnerability exceptions to CSV now includes every exception matching your filters, not only the rows on the current page.
• Vulnerability views refresh immediately after a scan finishes, including the automatic re-scan after an update installs and manual scans of offline endpoints, instead of showing pre-scan numbers for up to a minute.
• An endpoint's Vulnerabilities tab now reports the same total as the By Agent list you clicked through from. Both now use the same definition: open vulnerabilities, excluding anything you have excepted. Previously the endpoint's own tab also counted acknowledged findings and ignored your exceptions, so a vulnerability you had explicitly excepted could reappear in the endpoint's list and counts as if the exception did not exist.
• A vulnerability's severity now reads the same everywhere. The rating shown on a vulnerability's detail page now matches the severity used by every list, filter, and count in the product, instead of occasionally showing a different rating, or a raw vendor term such as Important, sourced from a separate database.
• The By Agent tab now loads quickly on large fleets. Its counts were previously recomputed from every individual finding on every page view; they are now aggregated in the database and briefly cached.
• A deployment ring's rollout status now counts each endpoint once. Previously, an endpoint whose install was repeatedly held back (for example by a pre-flight health check) counted every held-back attempt as another endpoint, so a ring could report dozens of endpoints and a low completion figure when it actually covered a single endpoint that later succeeded. Total agents, progress, and success rate now reflect each endpoint's latest result, and the filter counts in the ring's Agent Details view now show how many endpoints appear under each filter.
• Saving a deployment ring whose phase wait time is longer than its maintenance window now works. A phase's wait is a minimum bake time that counts continuously from when the phase first deploys, so it is normal for the wait to span several windows (the built-in Conservative preset, for example, waits 48 hours after its first cautious phase). The editor previously blocked these rings with an error claiming the rollout could never advance; that incorrect check has been removed. The wait now elapses on its own schedule and the phase advances at the next open window.
• The Install Updates dialog on an endpoint's page no longer gets stuck open. Opening it to install system or application updates could leave the dialog unresponsive, with its close, Cancel, and Select Updates buttons doing nothing and no way out but reloading the page. The dialog now opens, selects, confirms, and closes normally on Windows, macOS, and Linux endpoints.
• An endpoint's Pending Application Updates list now shows its Scheduled column again, alongside the new Policy column, so you can see at a glance both which policy governs each application update and its deployment-ring schedule. The list also lays out more cleanly: the Application column no longer takes more room than it needs, a long policy name shortens with the full name shown on hover, and column headings stay on a single line. On the Pending System Updates list, the notice that a restart is required now sits at the bottom of the section instead of above the list, so it no longer pushes the updates down.
• Update pre-staging now stays out of the way of installations. Pre-staging downloads no longer start while a deployment ring's maintenance window is open or while an endpoint is installing updates, so an install never competes with a background download for the endpoint's bandwidth and disk.
• Pre-staging now stages the correct file when an update is published with several downloadable files, and verifies it against that exact file's checksum. Previously, affected endpoints could repeatedly download the wrong file, fail verification each time, and end up downloading the update again during the maintenance window itself.
• A pre-staging download whose file fails integrity verification is now reported as failed instead of succeeded, so the task result matches the per-file detail shown when you expand it. Failed verifications also now wait out their retry cooldown instead of re-downloading on every cycle.

New

• When an endpoint enrolls but then cannot establish its secure connection to TridentStack Control, its detail page now explains the likely cause, such as a network security device intercepting the connection, a firewall blocking outbound access, or DNS filtering, and tells you what your network team needs to allow. The Endpoints list also flags affected endpoints at a glance.
• Multiple sign-in domains per organization: Organizations that own more than one email domain can now use all of them with a single TridentStack Control workspace. Domains verify automatically when your team signs in with Microsoft work accounts from the same Microsoft organization, or manually with a DNS record under Settings, then Authentication. Each domain gets its own sign-in method controls.

Improved

• Easier to find the TridentStack Control community: the documentation site footer, the changelog page, and the welcome email now link to r/TridentStack, where we post weekly release rollups and patch management discussion.
• Timestamps across the console now use one consistent format: a relative time (like "3 hours ago") with the exact date and time below it. This applies to the Endpoints Registered column, Tags, Configurations, System Update Policies, Policy Objects, and Automation.
• Per-domain sign-in methods, redesigned: Each of your organization's sign-in domains now has its own card with independent controls for which sign-in methods it allows. Your primary domain and any additional domains are configured the same way, in one place, with single sign-on kept as an organization-wide setting.
• Update Health details are now a popover you can select and copy to send to whoever owns an endpoint, and you can dismiss a specific servicing warning for a single endpoint (shown as Exempted, and restorable). Servicing Health now lives on the endpoint Health tab.

Fixed

• Saving a system update policy after selecting a macOS Office update channel no longer fails. Policy save errors now also show the specific reason instead of a generic "Failed to save changes" message.
• Dismissing a notification from the notification center now works; previously dismissed notifications could instantly reappear. The same fix restores adding and removing break-glass admins, identity provider group mappings, and SCIM provisioning tokens on the single sign-on settings page.
• Driver update installations that fail before any driver is attempted now record and display the failure reason instead of showing a failed task with empty details.
• Installing all pending system updates or application updates on several selected endpoints at once now works. Previously this bulk action failed with an error and no updates were installed.
• Editing a deployment ring's phases after its rollout has already started no longer causes the ring to stall. Affected rings now self-correct and continue advancing through their phases automatically.
• Searching your Endpoints list now shows a clear "no matching endpoints" result when nothing matches. Previously, a search that returned no matches could show the new-workspace "waiting for your first endpoint to connect" screen, which looked alarming for organizations that already had endpoints enrolled.
• Windows 11 version 25H2 endpoints now receive the latest monthly Windows quality updates. Previously the monthly update could be detected as applicable to a 25H2 device but was not offered for installation on it.
• Applications that are already installed are no longer incorrectly shown as available to install. An application whose installed name carried an extra locale or architecture label (for example, Mozilla Firefox) could be misreported as not installed and offered as a new installation even though it was present and current.

Improved

• Agent update pilots are now evaluated per operating system. When a new agent version is released, it is validated on your pilot devices of that same operating system before the rest of that platform's fleet updates, so a Windows pilot no longer holds back a Linux update (or the reverse). Settings > Agent Updates now shows a per-operating-system breakdown of your pilot coverage and flags any operating system that has endpoints but no pilots, whose updates roll out governed by your update delay only.

Fixed

• App updates that briefly collide with another installation already running on a Windows endpoint (such as a Windows Update or another installer) now wait for it to finish and retry automatically, instead of failing. (Requires the updated endpoint agent.)
• Resuming a halted deployment ring with the "retry failed agents" option now succeeds even when an endpoint had failed the same update on more than one prior attempt. Previously this could return an error and leave the ring halted; each affected endpoint is now re-queued exactly once.
• An automatic software inventory refresh no longer appears in an endpoint's activity history as a long-running task that eventually reports a timeout. Previously, when an endpoint's software inventory came due for a refresh at the same time as another routine check (such as its network details or its pending application updates), a duplicate refresh entry was created that never completed and timed out after 30 minutes, even though the installed-software list had already refreshed successfully. The refresh is now recorded once, under its correct name.
• Per-user application updates now succeed on Windows Server 2016 and other endpoints where the standard package manager is unavailable. Previously such an update could fail even though a direct installer was available; the endpoint now downloads and runs that installer directly. (Requires the updated endpoint agent.)

Improved

• The agent downloads page and documentation now list the full set of supported Linux distributions: Ubuntu, Debian, RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Fedora, and Amazon Linux. The same one-line install command works on all of them; the installer detects your distribution automatically.
• Update installs now show their complete follow-up work in one place. The automatic post-update vulnerability scan appears as a sub-task of the install itself instead of a separate disconnected entry, system update installs now get a post-update scan too (previously only app updates did, and only when started manually), and duplicate software inventory collection after app updates was eliminated so endpoints do less redundant work. When several updates finish on the same endpoint around the same time, they share a single scan. Endpoints without an application configuration now show an explicit "Skipped" step with the reason, instead of showing nothing.
• Product and app searches now tolerate punctuation and spacing differences, so searching "7zip" finds "7-Zip".
• Search boxes now look and behave consistently across every list and table, each with a visible search icon and a one-click clear button.
• Dashboard layout changes saved through the API are now recorded in the System Audit log, matching layout changes saved in the app.
• Critical vulnerability alerts now roll up into a daily digest instead of emailing on every scan, so large fleets stop getting flooded. Configure delivery right from the Critical Vulnerabilities alert in Settings > Notifications: switch between daily, hourly, or immediate, pick the daily digest send time, and tune the "send immediately" threshold. The digest goes out in a time zone you choose, defaulting to your account's time zone so it lands at the same local hour for your team. Actively-exploited findings still alert immediately.
• Endpoints that are removed from TridentStack Control without uninstalling the agent now stop retrying the server at full speed. After a short recovery window the agent backs off to one check per hour, and it returns to normal service automatically the moment it is re-enrolled or its record is restored.

Fixed

• Red Hat family Linux endpoints (RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Fedora, Amazon Linux) now report their software inventory and pending updates correctly, and updates can be installed from the console just like on Ubuntu and Debian. Previously these endpoints enrolled and stayed connected but showed an empty software list and no available updates.
• Linux and macOS endpoints now run the same automatic post-update vulnerability scan that Windows endpoints get: after any package, app, or system update installs, a Vulnerability Scan appears as a sub-task of the install showing exactly what was checked and found. This also fixed a defect where Linux endpoints were not being re-scanned after updates at all, so vulnerability data on Linux could go stale until the next scheduled fleet scan.
• App update installs on macOS now complete their follow-up work faster and more reliably: the post-install refresh that updates the pending-apps list finishes the moment the endpoint reports back instead of waiting on a fixed timer, and failed refreshes now show an honest failed status instead of lingering. Windows post-install app refreshes carry richer detail on the applicability computation step (how many apps were evaluated and how long it took).
• Deployment rings are now much better behaved around failures and edge cases. A ring no longer marks a phase as failed minutes into its very first deployment wave: the health clock now starts when results actually begin arriving, and the ring always gets at least one more maintenance window to recover before being halted. When a ring is halted, the reason now states the actual cause (for example "1 application update failure in Early Adopters phase - success rate 88.9% below 95% target") instead of a vague timeout message, and the Rollout Status view shows Halted or Paused in the Next Phase column instead of a misleading "Ready now". The "Deployment Started" notification is sent once per maintenance window instead of repeating on every internal scheduler pass, and an endpoint that declines an install for a benign reason (such as low disk space) is retried at most 3 times per window with an hour between attempts, instead of every few minutes all night.
• Resetting a rollout is clearer and safer. The action is now called "Reset Ring", and its confirmation explains exactly what happens: progress and any halt are cleared, in-progress work is voided without being counted as failures, nothing is uninstalled, and deployments start over from the first phase at the next window. The un-halt dialog now also explains what each choice means, including when deployments will actually resume and whether retrying the failed endpoints can advance the rollout to its next phase.
• The monthly Windows Malicious Software Removal Tool update is now handled correctly end to end. It installs using Microsoft's supported quiet-install method (so the malware scan actually runs after each update, and endpoint security products no longer flag the update as suspicious file activity), 64-bit endpoints reliably get the correct current 64-bit build, and the update keeps being offered every month instead of freezing at an old version once installed. The scan also runs at a low priority so it stays out of the way on busy machines.
• Windows on Arm devices (such as Snapdragon-based PCs) are now correctly recognized, so their app updates install the right versions and the device's processor type is reported accurately.
• The scan button on an endpoint's Vulnerabilities tab is now accurate about when a scan is already running. It stays disabled while a vulnerability scan started automatically by a recent update install is still finishing in the background, so you cannot accidentally kick off a second overlapping scan. And if a scan request fails to start, the button no longer keeps spinning indefinitely.
• Repeat manual restarts on the same endpoint now track their status correctly. Previously the restart command still went out, but after an endpoint's first tracked restart completed, later manual restarts kept showing the old completed state instead of the new restart's progress.
• App updates that could intermittently fail to download now retry automatically, so more of them complete on the first attempt instead of reporting a failure.
• Agent Tags search now filters as you type (and works on mobile), instead of only responding when you pressed Enter.
• Vulnerability exceptions can now be searched by CVE or endpoint name.
• The built-in default dashboard is now truly read-only, so its layout can no longer be changed unintentionally and always renders as designed. To customize your Home view, clone the default dashboard and edit your copy.
• The free CVE lookup tool no longer shows an unnecessary horizontal scrollbar when an expanded vulnerability's remediation includes long version strings; the details now wrap cleanly on any screen size.
• Removed a broken "Documentation" destination from dashboard link widgets that navigated nowhere.

New

• The free CVE lookup tool now shows how to fix each vulnerability: the version to upgrade to for affected applications and Linux distributions, the exact security update to install for affected Windows editions and core Microsoft products (Office, Exchange Server, SharePoint, and SQL Server), and the version to update to for affected Apple platforms (macOS, iOS, iPadOS, and more), each linked to the vendor or distribution security advisory it comes from. When no published fix has been found yet, the page says so plainly instead of guessing.
• Settings > Client now lets you hide the TridentStack Control tray icon on endpoints. The agent keeps running and managing the device in the background; only the tray icon and the window users can open are hidden. Applies to Windows and macOS.
• A new Windows update management choice in Settings > Client lets you keep TridentStack Control in sole control of Windows updates (recommended), or switch to a hybrid mode where Windows can also install updates on its own alongside TridentStack Control.
• Settings > Client now lets you control whether endpoints show a restart prompt before a managed restart. Turn it off for unattended endpoints that should restart silently after updates finish.
• The security dashboard now charts Open Vulnerabilities by Severity over time, plotting your total, critical, high, medium, and low open vulnerabilities as separate color-coded lines across the selected window, so you can see at a glance whether your exposure is trending up or down.
• On the dashboard, clicking a slice (or legend entry) of the Vulnerability Severity breakdown now opens the full vulnerability list filtered to that severity, so you can jump straight from the overview to the affected CVEs.
• The free CVE lookup tool now has an About page that explains what the tool is, defines the key terms (CVE, CVSS, EPSS, and CISA KEV), and shows exactly where every CVE record and fix comes from, the license behind each source, and how much of the catalog has an available fix. It is linked from the CVE tool and the site footer.
• Endpoints list: new Compliance % column showing each endpoint's overall framework compliance.
• Endpoints list: new Last Deployment column showing each endpoint's most recent update deployment result.
• Admins can set a default column layout for each table that new users inherit automatically.

Improved

• Saved table views: click the star on any column preset to make it your default; your default now follows you across devices.
• The free CVE lookup is now a dedicated, full-screen tool that mirrors the experience inside TridentStack Control. It scrolls as a single focused view with no competing scrollbars, adds a Fix column you can filter and sort by to surface vulnerabilities that have an available fix, and expanding any CVE now shows the same rich detail layout (CVSS breakdown, exploit intelligence, references) and a "Remediation Available" panel with the exact fixed versions to upgrade to, each linked to its vendor or distribution advisory.
• The free CVE lookup tool now works well on phones: the catalog shows tappable cards (severity, CVSS, exploit-prediction, exploited status, and fix availability at a glance) with a sort control, instead of a wide table you had to scroll sideways. Tapping a card opens the same full CVE detail inline. The desktop table view is unchanged.
• The free CVE lookup tool now gives actionable guidance for vulnerabilities that have no published fix yet, instead of a dead end: it flags end-of-life products that should be taken offline, shows the official CISA remediation action and due date for actively-exploited vulnerabilities awaiting a patch, and points to the relevant vendor advisories.
• The free CVE lookup tool now covers open-source software dependencies: vulnerabilities in npm, PyPI (Python), Go, Maven (Java), RubyGems, crates.io (Rust), NuGet (.NET), and Packagist (PHP) packages now show the package version to upgrade to, each linked to its source advisory.
• The free CVE lookup tool now shows Red Hat's official guidance when available: which products Red Hat has decided not to patch, and the recommended mitigation steps, linked to Red Hat's advisory.
• The free CVE lookup tool now flags when a fix lands on a Linux distribution release that has reached end-of-life (such as older Ubuntu, Debian, or Red Hat releases), including whether extended security maintenance is still available, so you know to plan an upgrade rather than rely on an unsupported platform.
• On the free CVE lookup tool, each CVE's reference links are now grouped by type (patch, vendor advisory, exploit, third-party advisory, and more), so you can jump straight to the official fix or advisory instead of scanning a flat list. CVE pages that have an available fix now also highlight that in the page title and search-result preview.
• The free CVE lookup tool now lets you browse vulnerabilities by weakness type (such as Cross-Site Scripting, SQL Injection, or Use After Free) and adds a dedicated page for actively-exploited (CISA KEV) vulnerabilities. Each view ranks the CVEs by exploitability and shows the fixes available, so you can quickly find every vulnerability of a given kind or every one that is being exploited.
• The free CVE lookup tool now offers subscribable feeds, in both RSS and JSON, for recently-added CVEs, newly-added actively-exploited (CISA KEV) vulnerabilities, and the highest-risk vulnerabilities. Follow them from your feed reader or wire them into your own tooling to track new threats as they appear.
• The free CVE lookup tool now has a live statistics page showing the size of the vulnerability catalog, how many CVEs have an available fix, the breakdown by severity and year, and the most common weakness types. Every CVE page also now offers an embeddable status badge you can add to a README, security advisory, or site, showing the CVE's severity and exploited status at a glance.
• The free CVE lookup tool now shows a fix for tens of thousands more vulnerabilities, roughly doubling its remediation coverage, by deriving the fixed version from the affected-version data published with each CVE (clearly marked as derived). This is especially impactful for actively-exploited vulnerabilities, many of which now show a concrete version to upgrade to. A vendor-stated fix, when one exists, is always shown in preference.
• The page for tracking in-progress deployment rollouts is now labeled "Rollout Status" in the navigation (previously "Rollouts"), making it clearer at a glance what the page is for.
• Endpoints list: new Applicable Updates column (combined system + app updates) and a shorter Sys Updates label.
• Remediate a vulnerability on a single endpoint even when no update policy covers the fix. The Remediate dialog now offers a one-off install, clearly marked as outside policy, showing the exact app or update and target version. Works for both application updates and Windows system updates where the fix applies.

Fixed

• Fixed an issue where a Windows update intended only for Windows client editions could be offered to a Windows Server endpoint that shares an underlying version, where it would fail to install. These updates are no longer offered to servers they do not apply to, and Server cumulative updates continue to install normally.
• Fixed an issue where a long-running Windows feature update (such as Windows 10 to Windows 11) could be reported as timed out, and stop short of completing, when its preparation stage ran longer than expected and the endpoint briefly stopped reporting in. These upgrades are now given the full time they need to finish and report their real result.
• Fixed a case where a leftover status check from an earlier feature-update attempt on an endpoint could cause a later, unrelated feature update on that same endpoint to be misreported as failed or stuck awaiting a restart. Feature update results are now tracked accurately for each attempt.
• Fixed a case where a Windows feature update (such as Windows 10 to Windows 11) that finished its lengthy preparation stage while the endpoint was briefly offline could stall and never finish, because the endpoint's "preparation complete" report was lost. The endpoint now re-sends that report as soon as it reconnects, so the update resumes and completes on its own.
• Fixed an issue where, after a Windows feature update (such as Windows 10 to Windows 11) finished installing and the endpoint restarted, the TridentStack Control app on that endpoint could keep showing a "Finalizing Windows upgrade..." status indefinitely even though the update was already complete. The status now clears on its own once the update finishes.
• Fixed the deployment ring status shown on an endpoint's update list so it reflects the real maintenance-window state. A ring on a set schedule (for example, Thursday nights) no longer appears to be actively deploying around the clock; outside its window it now shows when the next window opens, and it only shows as active while its window is genuinely open.
• Fixed an issue where a phased Windows feature update rollout (for example, Windows 10 to Windows 11) could halt for an entire deployment ring when just one endpoint was safely skipped by a pre-flight readiness check, such as not enough free disk space, hardware that does not meet the upgrade's requirements, or a prerequisite update not yet installed. Those endpoints are now treated as safely skipped rather than failed, are retried automatically on the ring's next window once they are ready, and no longer hold up the upgrade for the rest of the ring.
• Fixed an issue where a deployment ring that automatically halted (after too many endpoints failed) would not send its halt alert, so the auto-halt could go unnoticed. These alerts, including the list of endpoints that triggered the halt, are now delivered reliably.
• Fixed search on the Agent Tags page: typing in the tag search box returned no results even when matching tags existed. Searching your tags by name now works as expected.
• Fixed endpoint search on the Endpoints list: results could briefly appear and then disappear as the list refreshed, and search only looked at endpoints already loaded on the page. Searching now covers your entire fleet (by hostname, IP address, operating system, user, agent version, update policy, or tag), stays stable while the list auto-refreshes, and "Select All" while searching selects every matching endpoint.
• Fixed an issue where some administrators could not share a saved table view with their team, or set a team-wide default column layout, even though they had the necessary settings permission. These actions now work for any administrator with settings access.
• Fixed an issue where an endpoint with no application update policy assigned could still show pending application updates (and offer to remediate a vulnerability as though a policy already covered it). Endpoints without an application policy now correctly show no pending application updates, and the count is kept accurate automatically if a policy is later removed or deactivated.
• Fixed an issue where applying several automation rules in a row (the rules that automatically tag your endpoints) could start failing with a generic "Failed to apply rule" error after only a few, even though nothing was wrong. You can now apply all of your automation rules in one pass, and in the rare case a temporary limit is reached, the message clearly asks you to wait a moment and try again instead of looking like a broken button.
• Fixed an issue where a vulnerability in an endpoint's list could keep showing an application's old name (with an outdated version number baked into the name) even after the application had been updated, making the row appear to list two different versions. The product name shown for a vulnerability now refreshes on the next scan to match the currently installed software.
• Fixed an issue where an endpoint with no system update policy assigned could still show a system update policy, and pending system updates, as though one were assigned. System update policies now apply to endpoints only through tags, exactly like application update policies; an endpoint with no policy tag now correctly shows "None assigned" and no pending system updates. The count is kept accurate automatically if a policy is later removed or deactivated. (Linux endpoints are unaffected.)

Fixed

• Fixed a scheduling issue that could let compliance evaluations for Windows endpoints fall behind in environments running many Linux endpoints. Compliance results now refresh evenly across Windows, Linux, and macOS regardless of fleet mix.

Improved

• Update Health now covers Linux endpoints - Linux endpoints report disk space (root and /boot) and pending restarts, so the Update Health column shows real readiness, including a "Restart pending" badge when a restart is needed to finish applying updates.
• Bulk license management - The License Management page (Settings > Licensing) now lets you select multiple endpoints at once and license or unlicense them in a single action, on a refreshed, searchable, sortable table that no longer jumps when you click a row. If you try to license more endpoints than you have free slots, it licenses as many as it can (oldest endpoints first) and tells you how many more licenses you would need.

Fixed

• License management links now go where you expect - The "Manage licenses" link in the over-cap banner now opens your License Management page directly instead of the general settings page, and the "Add Licenses" button now takes you straight to billing to add endpoints.
• Endpoint Online and Offline counts now reflect your whole fleet - The Online and Offline totals at the top of the Endpoints page now count every endpoint, not just the ones currently scrolled into view.
• Select All on the Endpoints page now covers your whole fleet - The "Select All" button selects every endpoint across all pages (not just the ones scrolled into view), so a bulk action can target your entire fleet in one go. The checkbox at the top of the list selects the endpoints shown at the top as a quick batch, and its state stays in sync with what you have selected.
• Deployment ring notifications now open the Rollouts page - Clicking an in-app notification that a deployment ring is halted or awaiting approval now takes you straight to the Rollouts page, where you can un-halt or approve, instead of dropping you on the dashboard.

Improved

• You can now sort the endpoints list by Update Health, bringing the endpoints whose updates are blocked or need attention to the top in one click (sort runs across your whole fleet, not just the endpoints currently on screen).
• Applying tag changes to many endpoints at once is now near-instant. Selecting a large group of endpoints and updating their tags previously could take several minutes to finish; it now completes in about a second. Only the tags you actually changed are updated, so tags already in place on some of the selected endpoints are left untouched.
• The Rollouts page now shows when the next batch of endpoints will be picked up while a maintenance window is open, so a rollout that just advanced to its next group no longer looks idle for a few minutes between batches.

Fixed

• Application updates no longer restart an endpoint while other updates are still installing. Previously, updating certain applications that were open at the time could trigger an unexpected restart partway through an update batch, interrupting the remaining updates. Those applications now close and reopen cleanly during the update without an unplanned restart, and the rest of the batch completes as scheduled.
• Phased rollouts no longer stall when an endpoint is safely skipped by a pre-update safety check (for example, low free disk space before a large update). The skipped endpoint is now shown as a neutral "blocked" state instead of a failure, and the rollout continues to its remaining endpoints on schedule and retries the skipped endpoint in its next window.
• Fixed an issue where certain Windows updates for optional server tools could be listed as pending on endpoints that did not have those tools installed, causing the update to repeatedly retry and fail each maintenance window. Updates that do not apply to an endpoint are now correctly excluded from its pending list.
• Fixed a case where an endpoint that restarted while installing updates during a rollout could show as stuck "in progress" for up to a day. The interrupted update is now marked as interrupted right away, and the endpoint is retried in its next maintenance window.
• The Linux agent now installs and runs across the full range of supported Linux releases. Installs on older but supported releases (including Ubuntu 20.04, Red Hat Enterprise Linux / Rocky Linux / AlmaLinux 8, and Amazon Linux 2) that could previously fail to start now complete and run normally. The installer also gives a clear, specific message if a system is older than the supported minimum, and a failed upgrade now keeps the previously working agent in place instead of leaving the endpoint without one.
• A brief black command window no longer flashes on a Windows endpoint's desktop. When a user signed in to or reconnected to a managed endpoint, and during certain application installs that run in a signed-in user's session, a console window could momentarily appear and disappear on screen. These background steps now run silently, with no visible window.
• On Linux and macOS endpoints, the pending system updates shown on the endpoint's page now list only the updates your assigned update policy will actually install, matching how Windows endpoints already work. Previously the list could include updates your policy intentionally leaves out (for example, non-security package updates under a security-focused policy), which made an endpoint look out of date when it was already current for its policy. The manual install options on these endpoints now match as well, offering only policy-approved updates.

Improved

• Saving a deployment rollout now flags a phase whose wait time is longer than its maintenance window, instead of silently accepting a configuration that would leave the rollout unable to advance.

Fixed

• Application updates installed through automatic update rollouts now show the correct application name and the full step-by-step timeline (Compatibility Check, Download, Install) in an endpoint's update history. Previously these installs could appear as "Unknown" with parts of the timeline missing.
• The Next Window time on the Update Management rollouts view now shows the exact scheduled window start and holds steady, instead of creeping forward minute by minute and reading a few minutes later than the real start time.
• Editing a rollout phase's wait time or success criteria now takes effect on an in-progress rollout. Previously a phase that was already running kept using the settings it had when it started, so lowering a phase's wait had no effect until the rollout moved on, which in some cases prevented it from advancing at all.
• A rollout that is briefly held between phases while a canary group is still installing now reads "waiting on … canary" instead of the alarming "… canary failing." A healthy, in-progress rollout with zero failures no longer looks like a failure.
• For updates installed through an automatic rollout, the Download step in an endpoint's update history now reads "Pre-staged" when the file was downloaded ahead of the maintenance window, instead of showing a blank row. (Manually triggered installs continue to show the live download with progress.)
• Windows update titles now show the architecture that matches the endpoint. For example, an x64 PC no longer displays a .NET update labeled "ARM64 Client." The correct update was always installed; only the displayed label was wrong.

Improved

• The System Update Policies and Application Update Policies lists now show an Assigned Tags column, so you can see at a glance which tags route endpoints to each policy without opening it.
• Expanding a policy on either list now shows its assigned tags, and you can click a tag, status, or schedule to instantly filter the list to (or exclude) policies with that value. Active filters appear as removable chips above the table.
• Both lists now include a Deployment Ring column showing the rollout ring assigned to each policy, and you can filter either list by deployment ring from a policy's expanded details.
• Administrators can now add any email address as a notification recipient, not just members of your team. In Settings, Notifications, type a shared inbox or distribution list address for any event category and add it alongside the team members you select.
• Installing the TridentStack Control agent on older Windows systems (Windows Server 2016 and 2012 R2) is now reliable. The Agent Installers screen has a new "Older Windows" toggle that adjusts the one-line install command so it connects on systems that previously failed with a secure-connection (TLS) error. Modern Windows keeps the cleaner, shorter command by default.
• On endpoints running an operating system past its end-of-support date, the vulnerabilities filter now separates the two kinds of fixes: a Fixable toggle for updates you can apply today, and a separate ESU only toggle for fixes that require an Extended Security Update (ESU) license. Endpoints that do not need ESU are unchanged, with a single Fixable toggle.
• Status page timestamps now display in your local time instead of UTC.
• Returning to the console after the browser has been idle is now snappier: the first page you open after stepping away loads right away, instead of briefly pausing on an empty screen.

Fixed

• When an endpoint goes offline while updates are being downloaded ahead of their scheduled window, that download now shows in the endpoint's history as deferred and is retried automatically, instead of being recorded as a failed task. A laptop going to sleep mid-download no longer looks like something went wrong.
• An endpoint's Application Updates list no longer shows an "Updates blocked" warning that only applies to operating system updates. The system readiness checks behind that warning (such as available disk space and recovery partition sizing) gate system updates only, so they no longer appear on application updates, which install through a separate path.
• A small Windows recovery partition no longer blocks an endpoint's updates and is no longer flagged as a critical problem. A too-small recovery partition only affects the Windows recovery environment, not regular or feature updates, so it now appears as advisory guidance with the correct resize steps instead of holding back updates.
• Opening a Linux endpoint's details now loads the Pending System Updates list almost instantly. On endpoints whose update policy automatically approves updates, this list could previously take around 30 seconds to appear.
• Saving changes in Settings, Notifications now works reliably. Turning the in-app channel on or off, and choosing which channels deliver each type of event, now save correctly. Previously these changes could appear to save but silently fail to take effect.
• When you have unsaved changes on a Settings page and switch to another section, the prompt to save or discard now appears before the page changes, instead of switching first and then warning.
• The status page now waits for several minutes of continuous downtime before reporting an incident, so brief, self-resolving blips no longer show up as incidents.

New

• Linux system update policies now include an option to install all available updates, so a deployment ring can automatically apply every pending Linux package update, not only those tied to a published security advisory.
• Update Health column on the endpoints list - see at a glance which endpoints have issues that will block or fail update installs (such as low disk space and other pre-flight checks), and filter the list to just the blocked ones. Add it from the endpoints column menu.

Improved

• Update Health now covers macOS endpoints - macOS endpoints report startup-volume disk space, so the Update Health column shows real readiness (Healthy, Action recommended, or Blocked) instead of a dash.
• Pending Application Updates now shows when a per-user app update is already scheduled to install at the user's next sign-in, and clearly marks per-user installs with the account they apply to.
• System updates that report success but remain applicable are now detected and automatically re-attempted a few times before being flagged, so a transient install that did not fully take effect recovers on its own instead of lingering. The deployment ring status for an endpoint now shows when this is happening, including when automatic retries did not resolve it and the update needs attention. An endpoint's activity history now flags a past update install that still applies after reporting success, so you can see exactly which update needs attention right where the install was recorded.
• Rollout status and the deployment calendar now have their own Rollouts page in the sidebar, so the Deployment Rings page stays focused on configuration.
• Your Vendor Access Log now records every time TridentStack Control support staff view your environment, and your Support Access setting governs that access across all of TridentStack Control's support tools, giving you complete visibility into and control over when staff can view your data.
• Deployment ring canary phases now validate each kind of update on its own. When a ring's early phase happens to include endpoints needing different update types (for example application updates on one endpoint and system updates on another), the rollout confirms each type succeeds before widening, and it holds the rollout for any update type that is failing its early validation instead of letting other successful updates mask the failure. Within the same phase size, early-phase endpoint selection now also prefers a mix that exercises each pending update type when the endpoints to do so are available.
• The sidebar now shows a count badge on Rollouts when a deployment ring is halted or waiting for your approval to continue, so the rings that need your attention are visible at a glance without opening the notifications panel. The badge moves up to the Update Management menu when that section or the sidebar is collapsed, and appears on mobile as well. These deployment ring alerts now reach everyone with permission to approve updates, in both the sidebar badge and the notifications panel.
• On the Rollouts Status view, a deployment ring that is halted or waiting for your approval is now highlighted in its row, so the ring that needs your attention stands out at a glance from the rest.

Fixed

• Bulk and automatic application updates now show the same detailed per-app progress (compatibility check, download, install) and nested follow-up steps as manually triggered updates.
• The projected rollout timeline on a deployment ring now anchors each phase to its deployment window's scheduled start time, so the preview no longer drifts to the current time when you open it while a window is already active.
• The deployment ring rollout status now shows the next phase advancing at its deployment window's scheduled start, instead of when the phase's wait period simply elapses, so the time reflects when the rollout will actually progress rather than implying it could advance while the window is closed.
• Applications that are already current no longer appear as if they were re-installed; they now show a clear "Up to date" state instead of a misleading version change.
• A vulnerability scan that was canceled or did not finish no longer shows a duration timer that keeps counting up forever, and no longer reports a misleading "no vulnerabilities detected" result. Interrupted scans now clearly indicate that the scan did not complete, and any earlier scans affected by this display issue are corrected automatically.
• Endpoints no longer run extra redundant vulnerability scans once they have already been scanned, so an endpoint's activity history reflects the scans that actually matter instead of repeated near-duplicate entries.
• Your System Audit log now shows your full activity history with smooth continuous scrolling, instead of appearing limited to the 50 most recent entries.
• When TridentStack Control support staff view your environment, your System Audit log now records each support session as a single clear entry instead of many repeated entries.
• Approving a system update for a policy now updates the affected endpoints right away, instead of waiting for the next scheduled refresh, so newly approved updates become available to those endpoints promptly.
• Windows feature updates that are downloaded and staged ahead of time through a deployment ring now reliably complete their final install step, instead of staying staged without finishing.

New

• A new public CVE and CISA-KEV catalog at tridentstack.com/cve. Search and filter the full vulnerability catalog by severity, exploit-prediction score (EPSS), active-exploitation (CISA Known Exploited Vulnerabilities) status, ransomware association, and year, then open any CVE for its full record, including CVSS, references, and remediation context. Anyone can browse it directly from the website.
• New organizations are ready to manage updates the moment they are created. A new TridentStack Control organization now starts with a default system update policy, a default application update policy covering more than 30 common business applications, and an "all endpoints" tag that newly enrolled devices join automatically. As soon as you enroll your first endpoint, applicable operating system and application updates begin appearing, with no manual setup. Updates are surfaced and pre-approved for review; to start installing them, you create and assign a deployment ring.
• Tag automation rules can now match every endpoint in your organization with a single "Match all endpoints" option, with no conditions to build.
• Tag automation rules can now assign more than one tag. When you build a rule, pick any number of target tags, and every endpoint the rule matches receives all of them. Existing rules that assign a single tag keep working unchanged.
• See at a glance which update policies govern each endpoint. The endpoint list has two new optional columns, System Update Policy and Application Update Policy, showing the policy each device effectively follows. Enable them from the column menu, sort by them, and filter the list to a specific policy using the plus and minus buttons in any expanded endpoint row. The search box now also matches tag names and policy names, so you can type part of a tag or policy and instantly narrow the list.
• Target a deployment ring stage by tag, not just by percentage. Point a stage at one or more tags and it deploys to exactly the endpoints carrying those tags, giving you a stable, predictable set of devices in each wave of a rollout. Percentage-based stages still work the same way, and existing rings continue to roll out by percentage exactly as before.

Improved

• Vulnerabilities now appear within moments of enrolling a new endpoint. Newly onboarded devices are scanned as soon as their software inventory is received, instead of after a delay.
• New endpoints now show their setup progress live. A freshly enrolled device stays in an "Onboarding" state, and each section of its detail page shows a clear "Collecting…" indicator while its software inventory, system state, vulnerabilities, and update applicability are gathered, switching to the data the moment each one arrives, so you can see at a glance that everything is being fetched and computed.
• A refreshed getting-started tour reflects the new ready-made setup, guiding you to review your default update policies and create a deployment ring when you are ready to begin installing updates.
• More complete vulnerability detection for installed Python. Known issues affecting older Python builds are now surfaced more reliably, so out-of-date Python installs no longer appear cleaner than they are.
• More complete operating system vulnerability detection for Windows and Windows Server. Recent security issues are now surfaced in full on systems with long update histories, where lower-severity findings could previously be left out.
• More complete vulnerability severity scoring. Many recently published CVEs carry only a newer-format (CVSS v4.0) score, which was previously not read, so those vulnerabilities appeared unscored and could be deprioritized or left out of severity views. They now show their severity and score and are prioritized like any other vulnerability, across the endpoint vulnerability views and the public CVE catalog.
• More accurate third-party software vulnerability detection. Vulnerabilities in installed device and chipset drivers, such as Intel chipset software, are now detected, so out-of-date drivers no longer appear up to date. Separately, when a vendor publishes a lightweight monitoring agent and a full server product under one shared set of vulnerability identifiers, findings that only affect the server component are no longer shown on endpoints that run just the agent, removing false alerts (including some high-severity ones) from those endpoints' vulnerability lists.
• Endpoints that cannot install Windows updates because of a problem on the device (most often low free disk space) now show a clear amber "Updates blocked" indicator on the endpoint's System State view, instead of appearing idle. Select it to see exactly what is blocking updates and how to fix it. The indicator clears on its own once the underlying issue is resolved.
• A new "Hide ESU" filter on the Vulnerabilities page lets you hide vulnerabilities whose only fix requires an Extended Security Update (ESU) license. If your organization does not hold an ESU license, you can clear these unactionable findings from the list and focus on the vulnerabilities you can remediate today.
• More accurate fix guidance for vulnerabilities that are patched in a different version on each release line. When a vulnerability has a separate fix per major version line (for example, one fixed version on the 12.x line and another on the 13.x line), an endpoint's remediation details now list the correct fixed version for each line and mark the line your endpoint is on, instead of implying that any higher version number is safe. This prevents updating to a build that is numerically newer but still affected.
• Mark your most-used tags as favorites so they stay at the top of the tag picker. When you assign tags to an update policy, deployment ring, or compliance baseline, select the star next to a tag to pin it. Favorited tags appear first wherever you pick tags, and favorites are shared across your organization, so the tags your team reaches for most are always within reach.
• An automation rule's "Apply Rule" button now stays disabled until your edits are saved, so a rule is never applied with changes you have not saved yet. Save first, then apply, and what runs always matches what you see.
• The Vulnerabilities page is now easier to use on a phone. The All Vulnerabilities and By Agent views show each vulnerability or endpoint as a tap-friendly card instead of a wide table you have to scroll sideways, with search, filtering, and sorting all within reach.
• Filter auto-approved system updates by name: add an "Update Name / Title" condition with */? wildcards to include or exclude updates by title (for example, exclude *Preview*).
• New tag automation rules now start enabled. Once you set a rule's conditions and target tags, it takes effect right away, instead of having to switch the rule on as a separate step. You can still disable any rule at any time.
• Endpoint enrollments now appear on the System Audit log. When a device enrolls and begins onboarding, the platform records a System event for it, so you can see exactly when each endpoint joined your organization, filter the log for these events, and include them in your audit exports for change management and compliance.
• See exactly when each endpoint's next deployment window opens. The endpoint list's Next Window column now shows a specific date and time alongside the relative time (such as "in 1 day"), so you can tell at a glance precisely when scheduled updates are due to begin.
• The Moderate deployment ring preset now waits a full day at its second stage before widening to a full rollout. New rings created from the Moderate preset give the early-adopter group a longer soak so issues can surface on a smaller set of endpoints first. Existing rings keep their current settings, and you can still adjust any stage's wait time yourself.
• The health score dial on an endpoint's Health view now opens its breakdown when you tap or click it, showing how the overall score is weighted across vulnerabilities, compliance, pending updates, and network exposure. The breakdown was previously available only by hovering, so it is now reachable on phones and tablets too.
• Choose your agent-update pilot group by tag, not just by individual device. In the Agent Updates settings, add one or more tags to your Pilot Group and every endpoint carrying a selected tag automatically becomes a pilot, receiving a new agent version first before the rest of your fleet. You can still select individual devices, and combine devices and tags in the same pilot group.
• Deployment windows are simpler to set up. Instead of building separate day-of-week and time-of-day rules, you pick a start time and a duration, for example "Wednesday 10:00 PM for 6 hours". Windows that run past midnight are handled correctly, so an overnight maintenance window covers exactly the hours you intend. Your existing deployment windows are carried over automatically and keep running on the same schedule.
• See exactly how a deployment ring will roll out before you save. A ring widens to its next stage as soon as that stage's wait time and success criteria are met, and installs happen during your next deployment window, so a rollout flows on its own observation schedule while still respecting your maintenance windows. A new Projected Timeline shows the specific date and time each stage is expected to begin and when the rollout will finish, updating as you adjust the schedule, stages, and wait times and staying current as time passes.
• A deployment ring's final stage is locked at 100% and always sits last in the pipeline, so a rollout always finishes by covering every targeted endpoint. This makes the stage editor clearer and removes the chance of saving a ring that never reaches your whole fleet.
• For deployment rings that run around the clock with no schedule, settings that only apply to scheduled windows, such as pre-staging, automatic safety halt, and per-window execution limits, are now clearly shown as unavailable with a short explanation, so it is obvious which controls apply to your ring.

Fixed

• Offline endpoints no longer record repeated failed pre-staging download attempts. Update pre-staging now targets only endpoints that are online or recently connected, keeping endpoint history clean and accurate.
• Assigning a tag now works reliably wherever you are on the page. When you add a tag to a policy, deployment ring, or compliance baseline, the tag picker stays fully on screen, opening upward or scrolling within itself when space is tight, instead of opening partly below the bottom of the window. It also stays anchored to the button as you scroll.
• The endpoint Vulnerabilities tab no longer shows an occasional "Failed to load" error when a brief network interruption happens while the page is loading. Data views now retry automatically and recover on their own, instead of leaving you to refresh by hand.
• Confirming a sensitive change with a passkey now works on the first try. Passkeys created with Windows Hello, or saved to your device or password manager, are now reliably accepted when you verify a sensitive action, instead of sometimes needing to be set up again.
• An endpoint's activity history now reliably records system and application update refresh activity. Some of these refreshes could previously be left out of an endpoint's history; they now appear consistently.
• Software inventory refresh activity is now recorded for every endpoint, including devices that have an unusual character in an installed application's name.
• The search box on the Vulnerabilities page no longer loses focus while you type. Previously, once your search narrowed to no matches, the field would deselect itself and drop the keystrokes that followed; you can now type a full CVE search without interruption.
• Installing the Windows agent now works on older Windows and PowerShell versions. On some older systems, the quick-install command or the downloaded install script could fail to download the agent with a secure-connection (TLS) error; the installer now enables the required TLS version automatically, so the agent installs without manual workarounds.
• Large fleet rollouts now enroll without interruption. Adding many endpoints in quick succession from the same network location no longer pauses enrollment partway through, so you can bring an entire fleet online in one go.
• The "By Agent" view on the Vulnerabilities page can now be filtered. Its search box and "Has Critical" toggle now narrow the list of endpoints as you would expect, instead of having no effect.
• Sorting the automation rules list now works. Selecting a column header, such as Name, re-sorts the list as expected, instead of having no effect.
• You can now page through every vulnerability on the Vulnerabilities page. Previously the All Vulnerabilities and By Agent views showed only the first page of results with no way to reach the rest; page navigation now appears and works whenever there is more than one page.
• Opening an endpoint's details page is now smoother. The page no longer briefly flashes a "not found" message while it is still loading, and a momentary hiccup loading one part of the page no longer replaces the whole page with an error.
• Staged deployment ring rollouts now honor the full wait time you configure at each stage. A stage's wait timer now starts when that stage actually begins deploying during its maintenance window, so a stage set to wait one day reliably waits a full day of real deployment before widening to the next group, instead of sometimes advancing early. The notification you receive when a stage advances also now names the correct previous and next stage and shows that stage's true success rate.
• Deployment ring stage cards now display at a consistent size. The final stage card, which has no wait time, previously rendered slightly shorter than the others; every stage in a ring's rollout now lines up evenly.
• Endpoint health scores now stay up to date on their own. The platform refreshes each endpoint's health score automatically in the background as its condition changes, so the score you see stays current even for devices you have not opened recently.

Improved

• The install script you download from the Agent Installers page (Windows, macOS, and Linux) now comes pre-filled with your enrollment token, so an endpoint installs and registers correctly even when you run the downloaded script by hand. The page is also simpler: each platform shows a single Download Script button, with the advanced and manual install commands grouped together under Other Install Options.

Fixed

• On the Endpoints list, every endpoint row is now the same height, regardless of how many tags an endpoint has or how long it has been running, so the list is easier to scan.
• On phones, the Endpoints screen header no longer crowds the endpoint count, Add Agent button, and auto-refresh control into a single cramped row, so each control is easy to read and tap.
• On phones, save and confirmation dialogs (such as when saving a deployment ring) now keep their action buttons fully visible above the bottom navigation bar, so the Save and Confirm buttons are always reachable.
• Leaving a settings page that has unsaved changes (for example a deployment ring) using your browser or phone's Back button now prompts you to confirm before leaving, so edits are no longer discarded silently.
• A deployment ring whose rollout phases were edited after it was created could quietly stop sending scheduled updates to its endpoints, showing an idle schedule even when updates were pending. Affected rings now automatically resume deploying on their next scheduled window.
• A configuration policy whose settings are all set to "Disabled" is now correctly applied to your Windows endpoints. Previously such a policy was skipped and its settings were never enforced, even though it showed as assigned.
• Adding a Windows endpoint to a tag that has configuration policies now applies those policies to the endpoint right away, instead of only after the endpoint next restarts or reconnects. This also applies to tags assigned automatically by tag rules.
• Linux endpoints that are fully up to date no longer show a large list of operating-system vulnerabilities that have no available fix. The vulnerability list now reflects only the security updates that actually apply to the installed Linux kernel, so it matches the endpoint's update status.
• Adding a Linux endpoint to a tag that carries a system-update policy no longer makes it briefly show "System is up to date" while it actually has pending operating-system updates. The pending-update count for Linux endpoints now stays accurate through tag and policy changes.

Fixed

• Configuration policy changes now take effect on a Windows endpoint right away: assigning a policy applies it immediately, and removing an assignment removes it immediately, instead of waiting for the endpoint's next reconnect. The endpoint's Policies screen also now lists every assigned policy, where before it could show only the most recently applied one.

New

• Configuration Policies now include a built-in catalog of well-known Windows security hardening settings, including Certificate Padding enforcement, SMB v1 controls, credential protection, and a range of network-hardening options (the Microsoft Security Guide and MSS recommendations). They appear under Administrative Templates in a policy, are searchable, and show the recommended value for each, so you can apply trusted endpoint hardening without tracking down each setting yourself.

Improved

• The Vulnerabilities list now has an Affected Software column, so you can see which product each vulnerability affects (for example Google Chrome, Mozilla Firefox, 7-Zip, or a specific Windows edition) at a glance without opening each one. The affected software also appears in your vulnerability reports, and you can now search the list by software name.
• Expanded the opt-in Usage Analytics signals to include anonymized interaction and error diagnostics (counts and patterns only) so we can find and fix friction and bugs faster. No field values or identifiers are collected, and turning Usage Analytics off stops all of it. (Settings > Privacy)
• When a deployment ring has no schedule rules and runs around the clock, the ring editor now explains how the Pre-Staging, Safety Controls, and Execution Limits sections behave in that mode, so it is clear what each setting does when there is no maintenance window.

Fixed

• Fixed the Fix Available and KEV Only filters and the search box on the Vulnerabilities list, which previously had no effect. They now correctly narrow the list (including searching by affected software name), so you can focus on, for example, only the vulnerabilities that already have a fix available.
• Fixed an error that could occur when editing a setting you had just added to a Configuration Policy but had not saved yet. Adding, editing, and saving settings in Configuration Policies now works reliably whether the setting is new or already saved.
• Fixed an intermittent "Invalid or expired sign-in, please try again" error that could appear when signing in with Microsoft or Google, most often on phones and on privacy-focused browsers. Sign-in now completes reliably on the first try.
• The sign-in screen now offers a "Use a different account" option for Microsoft and Google, so you can choose or switch which account to use whenever you need to. Routine sign-in stays seamless: when your session expires, TridentStack Control reconnects you with your existing Microsoft or Google session instead of making you sign in again.
• Configuration Policy settings that accept a list of values, such as antivirus path, process, and file-type exclusions, now apply every value you enter. You can add and remove individual entries, and all of them take effect on your endpoints.
• Duplicating a deployment ring now copies all of its settings, including restart behavior and restart verification, per-window execution limits, and the Linux and macOS restart and service options. Previously some of these sections quietly reverted to their defaults on the copy, so a duplicate did not fully match the original.
• Fixed an issue where a deployment ring running around the clock (with no schedule rules) could permanently stop applying updates to an endpoint once it reached the per-window execution limit. The limit now resets on a rolling 24-hour basis, so endpoints keep receiving approved updates.
• Creating, importing, or duplicating a deployment ring through the API now works the same as it does in the dashboard. Previously these requests could fail when made with an API key.
• Deleting a Configuration Policy now reliably removes its settings from the endpoints it was applied to. Previously, settings from a deleted policy could remain in place on a device; they are now cleaned up automatically on the next check-in.

Fixed

• Editing an already-configured security setting in a configuration policy now shows its current values instead of opening a blank editor. Reopening a configured setting loads exactly what is currently set.
• The same sign-in method no longer appears more than once under Linked Sign-in Methods in user settings. Each linked sign-in method now appears only once.
• A large Windows feature update that has finished preparing and is waiting to be finalized is no longer incorrectly reported as failed shortly after it stages. Prepared feature updates now stay ready to complete as expected.

Improved

• The security settings catalog in Configuration Policies now includes the full set of Windows audit and security policy settings, including the complete Advanced Audit Policy Configuration subcategories (such as Kerberos authentication, process termination, and filtering platform auditing). Settings that were previously unavailable can now be found in search and configured.

Fixed

• Audit policy settings no longer revert to "No Auditing" while you are editing them, and the recommended-baseline indicator now correctly reflects whether audit policy and user rights settings match their recommended values.
• After saving a policy, audit policy and user rights settings now show their configured value (such as Success, Failure, or the assigned accounts) instead of appearing enabled but blank. The values were always saved correctly; this corrects a display issue in the editor.
• Windows 11 feature updates (for example, version 24H2 to 25H2) now apply correctly on a broader range of device configurations. A pre-installation compatibility check was stricter than necessary and could prevent eligible devices from receiving an in-place feature update. This improvement is rolling out to Windows agents now.
• Fixed an error that prevented saving certain restart settings, such as the maximum number of restarts allowed per maintenance window, when editing a policy.
• A scheduled update install that is skipped because another update is already running on the same device is no longer reported as a failure. It is now marked as superseded and retried in the next maintenance window.

Improved

• Security settings in Configuration Policies now show their category directly in the catalog, so settings that share a name (such as the two "Audit directory service access" settings) are easy to tell apart at a glance.
• Many more Windows security settings now include a plain-language description of what the setting controls, shown when you expand a setting in the catalog or open it to configure.

Fixed

• Advanced Audit Policy settings under the DS Access and Object Access folders now appear under those folders in the Configuration Policy editor's settings tree, matching the Windows layout, instead of only being reachable from the top level or from search.

Fixed

• Windows feature updates that finish installing but still need a restart to take effect now show as "Pending Restart" instead of incorrectly reporting as "Failed." The update is already staged and completes automatically the next time the device restarts.

New

• Preview the impact of a configuration policy before you apply it. For Windows configuration policies, you can now run a Preview Impact check against any group of endpoints (selected by tag or individually) and see, endpoint by endpoint, exactly which settings the policy would change and where it would conflict with another policy already in effect. A fleet summary shows how many endpoints would change and how many have conflicts, so you can catch surprises before anything is enforced. Open it from a policy's detail page or from the actions menu on the policy list.

Improved

• More control over how agent updates reach your fleet. Choose a pilot group that receives new agent versions first, and optionally hold updates for a set delay window before rolling out to everyone else. These controls now apply to your own fleet and reflect its real update status.
• Application icons load faster throughout the package catalog, including on large policy and application pages.

Improved

• New update policies now default to targeting every operating system present in your fleet, so a policy can't be created that accidentally covers none of your endpoints.
• Endpoints now show a clear notice when no active policy targets their operating system, making it obvious why an endpoint is not receiving updates.
• Linux endpoints now display their available update counts and policy coverage details in the updates view, matching the Windows experience.

Fixed

• API keys can now be used to create update policies and configurations. These requests previously returned an error.

New

• You can now follow TridentStack Control updates on our public changelog at tridentstack.com/changelog, including an RSS feed for your reader of choice.

Improved

• The dashboard now loads noticeably faster and picks up where you left off instantly while refreshing data in the background.
• Vulnerability lists on agent pages load significantly faster.
• Pages that poll for updates now skip downloading data that has not changed, reducing background data transfer throughout the console.
• The Reporting page loads much faster on first visit.

Fixed

• Raw SQL report queries ending with a semicolon are now accepted instead of being rejected.
• When a report query fails, the error message now remains visible instead of leaving the results area blank.

New

• Import your existing Group Policy configuration: upload a Group Policy backup from the Policy Objects page, preview which settings TridentStack Control recognizes, and import them as policy objects. Imported policies arrive disabled so you can review them before enabling enforcement.

Improved

• Agent 1.1.57 began rolling out with stronger pre-installation checks for application updates, reducing failed installs.
• Windows feature upgrades now verify available disk space before starting, and report clearly when an endpoint does not have enough free space to upgrade.

Fixed

• Fixed an issue where some macOS application updates could fail to download.

New

• Microsoft Entra ID group sync: connect your Entra tenant under Settings, map groups to endpoint tags, and group membership stays in sync automatically every hour. Tag-based policies follow your directory without manual upkeep.
• EPSS exploit-prediction scores on vulnerabilities: both vulnerability views now show each CVE's likelihood of real-world exploitation alongside CVSS severity, with sorting and a minimum-EPSS filter to focus on what is most likely to be attacked.
• A guided setup experience for new tenants walks through enrolling your first endpoint, creating update policies, and organizing endpoints with tags. Replay or turn it off any time from User Settings.

Improved

• Vulnerability scanning is now incremental: endpoints are rescanned when their software actually changes instead of on every cycle, so results appear faster and fleet-wide scans finish sooner.
• The endpoints list refreshes automatically in the background, with a toggle to turn this off.

Fixed

• Notifications for newly detected critical vulnerabilities are now delivered reliably.

Security

• Ongoing security hardening across the platform as part of our regular security review process.

New

• A public status page is available at tridentstack.com/status, covering the application, agent connectivity, documentation, and website with uptime history.

Improved

• Vulnerability remediation status is clearer: when a fix has been installed but the endpoint has not been rescanned yet, the vulnerability now shows "Update installed, refresh on next scan" with a one-click Re-scan now button, instead of an ambiguous state.
• After remediating a vulnerability on an endpoint, a follow-up scan runs automatically so the result reflects the fix without waiting for the next scheduled scan.

Fixed

• Vulnerabilities that only affect the mobile edition of an application are no longer flagged against the desktop edition installed on your endpoints.

New

• macOS endpoints can now enroll in TridentStack Control. Manage Apple devices alongside your Windows and Linux fleet, including software inventory, update visibility, and policy assignment.

Security

• The macOS and Linux agent installers now verify the integrity and authenticity of the installation package before installing, protecting against tampered downloads.

New

• Billing is now live. Your first 200 endpoints remain free forever; beyond that, endpoints are $5 per month each, with an annual option that saves two months.
• Manage your payment method, view invoices, and track license usage directly from the dashboard.
• Licenses are assigned automatically as endpoints enroll, so there is nothing to provision by hand.

New

• Windows hotpatch updates are now identified in the update catalog with a dedicated badge, so you can see at a glance which updates install without requiring a restart. Endpoint detail views show whether each device is hotpatch ready, with a guide for enabling hotpatching in your environment.
• Compliance templates now show a risk summary before you apply them: how many controls could affect connectivity or sign-in behavior, with the highest-risk controls called out for review.

Improved

• Hotpatch releases carry full severity information and link to Microsoft's release documentation from the update detail view.
• Policies created from compliance templates record which framework they came from, so you can trace a setting back to its CIS or DISA STIG source.

New

• TridentStack Control is now generally available and serving production customers. One platform for patch management, third-party application updates, vulnerability detection, compliance tracking, and policy management.
• Native OS update management for Windows and Linux endpoints, with approval workflows, deployment rings for phased rollouts, and supersedence tracking.
• Third-party application updates with version targeting, silent installation, and per-group configuration profiles.
• Automatic vulnerability detection from your software inventory, with CVSS severity prioritization and exception management.
• Compliance framework tracking for CIS Benchmarks, DISA STIGs, Microsoft Security Baselines, and NIST controls, with automated scoring.
• Policy management with a web-based settings catalog that works with or without Active Directory.
• Your first 200 endpoints are free forever, with every feature included.