Skip to content
English
  • There are no suggestions because the search field is empty.

Release Notes - Atomic (pre-release)

Release notes for Edgescan Atomic Testing, it is in pre-release and only available to select customers.

This is a change log for Edgescan Atomic and covers off the testing harness and the Atomic engines that run the autonomous testing. 

 

v0.6.0 - (11th September 2026)

  • Enhanced authentication on modern single-page applications.

  • Enhanced headless browser to log in to JavaScript-heavy applications where a plain HTTP login does not work, including apps whose only session artefact is a token returned in the login response.

  • Fixed bug where long assessments caused memory issues in headless browser. 

  • Fixed bug where inventory items such as forms, headers and endpoints are no longer reported as vulnerabilities.

  • Fixed bug where confirmed finding were missing a severity and a weakness category.

  • Fixed bug where access-control findings are no longer buried as unclassified informational rows.

  • Fixed bug where a confirmed IDOR is reported once against the real affected URL rather than twice against a {id} pattern.

  • Enhanced findings details recording. Evidence sections are written in plain English with per-issue attribution.

  • Fixed bug in findings detail where mixed probes from unrelated tests could present in findings details.

  • Fixed bug where session cookies, authorization headers and credentials embedded in URLs quoted as evidence were being included in the report.

  • Enhanced business-logic testing to include workflow skipping where a tester learns a checkout flow's steps, then attempts to call a later step directly without completing its preconditions. We're recording a finding without payment if we reach a confirmed or fulfilled state.

  • Fixed bug where state-changing tests were reading from cached response, they now test the application live, so they observe the effect of their own actions.

  • Enhanced the recon profile to include better technology stack. A dedicated pass identifies the products, versions and ecosystem in use and feeds a lookup for known vulnerabilities (CVEs).

  • Enhanced recon profile to allow header, banner and version weaknesses to now be reported as posture findings with the HTTP evidence attached.

  • Enhanced recon profile so error pages are mined for further clues.

  • Enhanced artefact data passed to agent planner so unconfirmed leads from a previous run are handed to the next assessment of the same target, so the tester can keep trying to confirm them rather than rediscover them.

  • Enhanced assessment failure workflows so failed assessments can be resumed from its last checkpoint where one exists.

  • Fixed bug where the thread count and request delay configured on an asset now bound the AI assessment.

  • Added better compatibility to assessment exports, an exported assessment now carries the full pipeline - findings, candidate leads, evidence, recorded traffic, re-test verdicts and confirmation signals - so an imported assessment shows the same picture as the original.

  • Added the foundations for the chain of evidence feature. The tester now records, for every finding, the full chain of how it was proven: what reconnaissance surfaced, how the lead was selected, what was tried, what the independent confirmation step reproduced, and any re-test result, each step with a plain-English summary and the exact request and response behind it. Presenting it in the platform is a work in progress.

v0.5.0 - (1st September 2026)

  • Fixed bug where confirmed findings were dropped before they appear in the platform. There was a gap where some confirmed findings - injection, access-control and business-logic issues - could be dropped after leaving the validation agents team.

  • Added better support for file-disclosure testing.

  • Added checks for path-traversal weaknesses, where a request is manipulated to read files outside the intended area.

  • Live assessment activity. A running assessment now shows a readable, live timeline of what the tester is doing across its work, giving clearer visibility while it's in progress.

  • Fixed bug where vulnerabilities mapped to CWEs that were not recommended for mapping by MITRE.
  • Fixed bug where risk rating remained minimal. Risk ratings now have more appropriate risk ratings.

v0.4.0 - (26th August 2026)

  • Enhanced workflow for validation. Reworked how the tester decides an issue is real: each potential finding now goes through a separate confirmation step, run independently of the test that first raised it, before it's confirmed as validated. Any vulnerabilities that don't pass this step remain suspected.

  • Add the foundational work for multi-identity authenticated testing. The groundwork for driving several user identities in one assessment is now in place, an assessment can carry multiple sets of credentials as named identities. However more work is needed to enable agent to take multiple out of the vector DB for authenticated testing where 2 sets of valid credentials are mandatory.

  • Added more reliable logged-in sessions. Strengthened how the tester keeps a session authenticated, so it stays logged in through multi-step and session-rotating parts of an application - giving broader coverage of areas that require a login.

  • Added broader injection and access-control detection. Injection results (cross-site scripting, SQL injection and similar) are now more complete and durably recorded, and access-control (IDOR) testing reaches more kinds of links and requests. The tester can also test the same target both as a logged-in and an anonymous user to expose access-control gaps.

  • Enhanced business-logic testing. Continued expanding logic-flaw detection in commerce flows (building on the discount/coupon and quantity-manipulation checks).

  • Enhanced reconnaissance phase. The tester discovers more of an application's real surface, and content-discovery sweeps now flag more of the responses worth investigating.

  • Enhanced results with clearer progress indicator in the platform. Assessments show which phase they're currently running, access-control findings are categorised more accurately, and results are reliably saved even if an assessment ends early.

v0.3.0 - (21st August 2026)

  • Enhanced Business-logic testing. Added detection for manipulating quantities (for example, negative values) to reach an invalid order state.

  • Enhanced discovery phase. The tester now also uses signals such as robots.txt and sitemap entries to find additional areas worth testing.

  • Enhanced reconnaissance intelligence. The information gathered phase where asset information is passed to the agents, and the attack plan is formed is better mapped through in a cleaner, more structured form, improving what you see about the assessed application.

V0.2.0 - (18th August 2026)

  • Added business-logic testing agent team. The testers started looking for logic flaws in commerce flows, the first being abuse of discount and coupon handling, going beyond purely technical vulnerabilities.

  • Enhanced content discovery. Improved discovery wordlists mean the testers finds more of an application's real surface.

  • Enhanced scope handling. Scope matching was tightened so assessments stay precisely within the hosts you've authorised.

V0.1.0 - (10th August 2026)

  • Added wiring so AI security testers could perform assessments that would end up in the Edgescan platform.

  • Added end-to-end automated assessments. The tester builds out the attack plan on it's own and produces findings without a person driving each step.

  • Added better support for application discovery including hidden paths and content

  • Added functionality to allow building an understanding of the site before testing, so coverage reflects the context of the application.

  • Added wiring so Credentials Vault and be passed to the harness for authentication. Logs in and assesses the authenticated parts of an application, supporting the common ways applications handle sign-in.

  • Added Injection modules (such as cross-site scripting and SQL injection)

  • Added broken-access-control (IDOR) modules.

  • Added support for testing that adapts to how the application and any web application firewall respond.

  • Added retesting capability that re-checks previously reported issues and reports whether they now appear fixed or still present.

  • Added better support for de-duplicated and mapping to standard weakness categories for consistent triage.

  • Added assessment stream so you can watch an assessment as it runs

  • Added support for custom request headers.

  • Added support for exporting a completed assessment.

  • Added support for assessments pause and resume safely around maintenance and deployments.

v0.0.1 - (13th July 2026)

  • The AI security testers went live, with a hotfix shortly after to fix assessment proxy setting.