Skip to content
English
  • There are no suggestions because the search field is empty.

Release Notes - Atomic (pre-release)

Release notes for Edgescan Atomic Testing, it is in pre-release and only available to select customers.

This is a change log for Edgescan Atomic and covers off the testing harness and the Atomic engines that run the autonomous testing. 


v0.5.0 - (1st September 2026)

  • Fixed bug where confirmed findings were dropped before they appear in the platform. There was a gap where some confirmed findings - injection, access-control and business-logic issues - could be dropped after leaving the validation agents team.

  • Added better support for file-disclosure testing.

  • Added checks for path-traversal weaknesses, where a request is manipulated to read files outside the intended area.

  • Live assessment activity. A running assessment now shows a readable, live timeline of what the tester is doing across its work, giving clearer visibility while it's in progress.

v0.4.0 - (26th August 2026)

  • Enhanced workflow for validation. Reworked how the tester decides an issue is real: each potential finding now goes through a separate confirmation step, run independently of the test that first raised it, before it's confirmed as validated. Any vulnerabilities that don't pass this step remain suspected.

  • Add the foundational work for multi-identity authenticated testing. The groundwork for driving several user identities in one assessment is now in place, an assessment can carry multiple sets of credentials as named identities. However more work is needed to enable agent to take multiple out of the vector DB for authenticated testing where 2 sets of valid credentials are mandatory.

  • Added more reliable logged-in sessions. Strengthened how the tester keeps a session authenticated, so it stays logged in through multi-step and session-rotating parts of an application - giving broader coverage of areas that require a login.

  • Added broader injection and access-control detection. Injection results (cross-site scripting, SQL injection and similar) are now more complete and durably recorded, and access-control (IDOR) testing reaches more kinds of links and requests. The tester can also test the same target both as a logged-in and an anonymous user to expose access-control gaps.

  • Enhanced business-logic testing. Continued expanding logic-flaw detection in commerce flows (building on the discount/coupon and quantity-manipulation checks).

  • Enhanced reconnaissance phase. The tester discovers more of an application's real surface, and content-discovery sweeps now flag more of the responses worth investigating.

  • Enhanced results with clearer progress indicator in the platform. Assessments show which phase they're currently running, access-control findings are categorised more accurately, and results are reliably saved even if an assessment ends early.

v0.3.0 - (21st August 2026)

  • Enhanced Business-logic testing. Added detection for manipulating quantities (for example, negative values) to reach an invalid order state.

  • Enhanced discovery phase. The tester now also uses signals such as robots.txt and sitemap entries to find additional areas worth testing.

  • Enhanced reconnaissance intelligence. The information gathered phase where asset information is passed to the agents, and the attack plan is formed is better mapped through in a cleaner, more structured form, improving what you see about the assessed application.

V0.2.0 - (18th August 2026)

  • Added business-logic testing agent team. The testers started looking for logic flaws in commerce flows, the first being abuse of discount and coupon handling, going beyond purely technical vulnerabilities.

  • Enhanced content discovery. Improved discovery wordlists mean the testers finds more of an application's real surface.

  • Enhanced scope handling. Scope matching was tightened so assessments stay precisely within the hosts you've authorised.

V0.1.0 - (10th August 2026)

  • Added wiring so AI security testers could perform assessments that would end up in the Edgescan platform.

  • Added end-to-end automated assessments. The tester builds out the attack plan on it's own and produces findings without a person driving each step.

  • Added better support for application discovery including hidden paths and content

  • Added functionality to allow building an understanding of the site before testing, so coverage reflects the context of the application.

  • Added wiring so Credentials Vault and be passed to the harness for authentication. Logs in and assesses the authenticated parts of an application, supporting the common ways applications handle sign-in.

  • Added Injection modules (such as cross-site scripting and SQL injection)

  • Added broken-access-control (IDOR) modules.

  • Added support for testing that adapts to how the application and any web application firewall respond.

  • Added retesting capability that re-checks previously reported issues and reports whether they now appear fixed or still present.

  • Added better support for de-duplicated and mapping to standard weakness categories for consistent triage.

  • Added assessment stream so you can watch an assessment as it runs

  • Added support for custom request headers.

  • Added support for exporting a completed assessment.

  • Added support for assessments pause and resume safely around maintenance and deployments.

v0.0.1 - (13th July 2026)

  • The AI security testers went live, with a hotfix shortly after to fix assessment proxy setting.