> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## General | FEATURE | DESCRIPTION | | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Consolidated CaaS resource visibility | Improve security oversight and simplify asset management by viewing CaaS (Containers as a Service) resources within a dedicated section of the Asset Inventory. This update organizes resources from Amazon ECS, Google Cloud Run, and Azure Container Instances into a single, purpose-built view under Compute assets, making it easier to locate, monitor, and assess the security posture of your cross-cloud CaaS deployments. | | Enhanced notification forwarding | To help you prioritize and resolve security issues more effectively, issue notifications sent to Amazon S3, Amazon SQS, Webhook, Splunk, and email now provide additional asset and remediation information. Notification fields have been expanded to include the asset name, cloud resource name, asset tags, account name, region, and evidence. | | Administrator control for saved views and filters | Keep your workspace clean and relevant. Administrators can now remove unused or outdated saved views and filters, including those created by other users. | | Autodetect AWS Web Application Firewall | Gain deeper visibility and insights into your internet-exposed cloud assets with new automatic detection of AWS Web Application Firewall (AWS WAF) instances. | | Associate cloud security rules with custom controls | You can now associate out-of-the-box config, identity, and AI cloud security rules with custom compliance controls. | | Event-based Asset Ingestion (EAI) parity with Prisma Cloud | Monitor your cloud environment in real-time with improved data processing speeds. Cortex Cloud now has Event-Assisted Ingestion parity with Prisma Cloud. | ## Access Management | FEATURE | DESCRIPTION | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Granular per-object access | Strengthen least-privilege access with granular permissions for user groups across report templates, playbooks, scripts, and saved queries. | | Expanding SBAC with Account Name | Scope-Based Access Control (SBAC) has been enhanced to provide more granular control over your access policies. You can now define Asset Groups that include the **Account Name** attribute for scope-based access control. Continue to use the existing **Realm** attribute whenever you need to scope based on the Account ID. | ## AI Security | FEATURE | DESCRIPTION | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Expanded AI package inventory | Identify vulnerable AI packages across your entire infrastructure. You can now track AI software packages discovered on compute assets alongside those in your code repositories. We added a "source" attribute to the inventory to help you quickly distinguish between packages found in code or deployed on compute assets. | | Locate AI workloads instantly | Locate AI-related workloads instantly. You can now identify compute assets that deploy AI models or contain AI software in their software bill of materials (SBOM). We introduced the "AI associated" insight to help you filter and manage these assets across your environment. | | Vertex "Model Garden" discovery | Gain full visibility into your AI model usage. You can now track and manage GCP Vertex AI "Model Garden" models as assets, even when they are used without a specific model endpoint. We enriched these assets with activity data, including usage frequency and last-used dates, so you can optimize your resources and easily identify inactive models. | | Enhanced open-source model detection | All types of models from "Hugging Face" when found on virtual machines are now identified as self-managed and open-source models, helping you get a full AI-BOM of your environment. | ## API | FEATURE | DESCRIPTION | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Billing Contributors API | A new public API endpoint is introduced to retrieve a list of unique active contributors factored into your billing. This allows you to gain full transparency into your billable seats. | ## Application Security, Cloud Workflow Protection, API Security | FEATURE | DESCRIPTION | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhanced CLI experience |

Reduce onboarding friction, standardize scan controls, and deliver structured results across code and image scans.

| ## ASPM | FEATURE | DESCRIPTION | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhanced Urgency scoring coverage |

Prioritize remediation and eliminate developer noise with context-aware Urgency scoring across a broader set of runtime environments and risk signals.

| | ASPM Command Center |

Accelerate cases and issues triage and remediation delegation by drilling down from posture metrics directly into the relevant views.

| ## Asset Inventory | FEATURE | DESCRIPTION | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Drift detection highlight in Container Instances | Container Instances asset cards in Asset Inventory now include a Security Drift Detected highlight and a dedicated Security Drift tab, making it easy to identify containers that have deviated from their base image. These drifts expose vulnerabilities, misconfigurations, compliance violations, and other security risks introduced at runtime that were not part of the base image. | | Base Image Visibility for Container Images | You can now identify the base image for any Build, Registry, or Runtime container image directly from its asset details page. With the **new has base reference** and **is base reference for** relationships in Security Graph, you can trace image lineage and assess vulnerability impact in a single query. Define custom Base Image Rules to mark foundational Registry Images, create targeted asset groups and policies, and quickly determine whether vulnerabilities originate from a base image layer. This streamlines your security investigations and accelerates incident response. | ## Attack Surface Management | FEATURE | DESCRIPTION | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Website data in CloudASM | Continuously discover and monitor your website inventory and web technologies, identify your insecure and misconfigured websites, and identify sites failing security best practices and putting users at risk. | ## Automation | FEATURE | DESCRIPTION | | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Performance improvements for scripts and playbooks | Enhance the user experience when managing security workflows with modernized interface improvements and optimized memory usage across the Scripts and Playbooks pages to maintain a seamless and cohesive user experience. | ## Broker VM **Version 31.0.57 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Legacy server connectivity | You can now easily configure OpenSSL compatibility settings directly from the Broker VM web interface to ensure uninterrupted communication with legacy servers. We added **Advanced Settings** options to allow legacy SSL renegotiation and accept certificates without an Authority Key Identifier (AKID). | | Import Configuration tool enhancements |

The Import Configuration tool has been enhanced to streamline the Broker VM migration process to the new Broker VM image. You can now migrate your current Broker VMs to the new Debian 13 based image.

Both source and target brokers should be running the latest Broker VM 31.x version.

| ## Compliance | FEATURE | DESCRIPTION | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Compliance Overview Dashboard | The Compliance Overview Dashboard presents a centralized view of your organization's compliance performance against industry standards and your own internal security frameworks. | | Updated compliance score calculation | We updated the compliance score calculation to ensure it reflects the status of all assessed controls for all assessed assets. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Chat with the Agentic Assistant directly in Slack | Access Agentic Assistant more easily across your daily applications. You can now trigger the Agentic Assistant from your Slack, give it tasks, interact with it and get the results on your existing workspace. | | Natural language visualizations | Turn questions into charts in seconds, identify security trends, and build custom widgets without writing a line of code using the Cortex Agentic Assistant. | | Enhanced AI product support | The upgraded Help Center agent delivers instant how-to support and helps you navigate in-product support cases. It stays aware of your support issues to provide more relevant guidance in context. | ## CSP Onboarding | FEATURE | DESCRIPTION | | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Alibaba Cloud support | Secure your Alibaba Cloud environments directly from Cortex Cloud. You can now onboard your Alibaba Cloud accounts and gain unified security visibility alongside your AWS, Azure, GCP, and OCI environments. Cortex Cloud automatically discovers your Alibaba Cloud assets and evaluates your security posture with out-of-the-box policies. | | Onboard Microsoft Entra ID only | Connect Microsoft Entra ID independently of tenant-level onboarding to unlock identity-based capabilities, including CIEM, identity posture, and Entra ID sign-in logs. When onboarding Azure subscriptions or Management Groups, you can now enable Entra ID to achieve full identity visibility without requiring tenant-level scope. | | OCI audit log normalization | Query Oracle Cloud Infrastructure (OCI) audit logs alongside AWS, Azure, and GCP activity using a unified schema. OCI audit logs collected through the cloud onboarding flow are now normalized into the cloud\_audit\_logs dataset, enabling consistent cross-cloud investigation and alerting through XQL. | | Cloud onboarding least-privilege access | Reduce your exposure to cloud threats with least-privilege access. We now provide least-privilege access across all supported cloud providers, helping you minimize unnecessary permissions and tighten your security. | | Bring your own Azure EventHub | Reduce cloud audit log collection costs and improve operational efficiency by routing cloud data through your own Azure EventHub. You can now connect your own Azure EventHub for cloud audit log collection, eliminating redundant data transfer overhead and giving you direct control over your data pipeline. | | Manual AWS onboarding | Gain full control over AWS onboarding with a manual setup flow. Provision the required resources and IAM permissions yourself, allowing you to meet strict security, compliance, and infrastructure requirements without dependency on vendor templates. | | Manual GCP project onboarding | Maintain compliance with your organization's deployment standards when connecting GCP projects. We added a manual onboarding option that lets you use your own Terraform templates to configure service accounts and permissions, so your cloud setup stays aligned with internal governance requirements. | ## CWP Compliance | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhanced evidence for findings | Improve remediation efficiency with detailed evidence for every security finding. The update includes visibility into the exact configuration values, such as bind address or file size parameters, that triggered the issue, providing the necessary context to resolve misconfigurations effectively. | ## Data Classification | FEATURE | DESCRIPTION | | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Improved classification accuracy for semi-structured data | We have refined our engine’s ability to parse the internal hierarchy and element relationships within JSON and similar formats. By more accurately distinguishing between keys, values, and nested structures, the engine now delivers higher detection precision across complex, modern data formats. | ## Data Security | FEATURE | DESCRIPTION | | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Expanded DSPM support for on-premise databases | Expanded DSPM support for on-premise databases enhances visibility into sensitive data stored in enterprise databases, outside of the cloud. Organizations with hybrid infrastructure can now identify data exposure risks and extend DSPM governance across both on-prem and cloud environments. | | OCI object storage | Scale your data security as your cloud environment grows. You now have full visibility into OCI Object Storage with automated discovery and classification to prevent data leaks. This update expands our support for Oracle Cloud Infrastructure (OCI) to ensure your storage is always protected. | | Expanded DSPM support for Government Cloud environments | Expanded DSPM support for Government Cloud environments enables sensitive data discovery across AWS GovCloud and GCP Government Cloud, allowing federal and state organizations to apply DSPM capabilities across the majority of supported cloud services while maintaining compliance with government cloud requirements. | ## Data Security Platform | FEATURE | DESCRIPTION | | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data Security Command Center (Beta) | Monitor your data security from a centralized command center. We introduced the Data Security Command Center, providing a unified dashboard for monitoring data discovery, classification status, and all security aspects across connected data stores. | ## Endpoint Security | FEATURE | DESCRIPTION | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Advanced prevention for macOS | New macOS Kernel behavioural monitoring identifies and neutralizes privilege escalation attempts in near-real-time. | | Shared objects file examination | Secure your Linux environment against hidden threats. You can now automatically block malicious code from executing through non-standard loading methods. We updated the Cortex XDR agent to examine and stop harmful shared object files before they impact your system. | | On-write malicious file detection | Stop cross-platform threats from entering your network. You can now detect malicious mach-o files and non-native macOS binaries (such as Windows PEs and Linux ELFs) the moment they are saved to your system. We updated the Cortex XDR agent to provide comprehensive on-write detection for these binary types. | | Advanced Java malware protection | Prevent cyberattacks from compromising your applications. You can now automatically detect and block malicious Java-based threats the moment they appear or are saved to your system. We added real-time on-write protection for all Java files. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | New Cloud NGFW data source | Gain complete visibility into your cloud-native network security with the new **CNGFW** (Cloud NGFW) data source. You can now stream traffic and application logs directly to Cortex Cloud with support to cross-region and cross-account connections. We introduced this distinct connector to handle unique cloud-native identifiers, ensuring seamless log ingestion and analysis for your managed security services. | ## Graph Search | FEATURE | DESCRIPTION | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SBAC enforcement in Graph Search | Safely explore your environment in Graph Search with precise permission management. We introduced Scope-Based Access Control (SBAC) to give you granular control over user scope. You can now assign users to **User Groups** and **Asset Groups**, ensuring they only see authorized graph nodes and relationships. | ## Identity Security | FEATURE | DESCRIPTION | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unified human identities | Unified Human Identities help teams understand true access relationships, prioritize identity risk, and detect excessive or risky privileges at the human level by creating a single virtual identity that links a person's accounts across directories, cloud IdPs, and SaaS applications. | | OCI effective permissions | Strengthen your Oracle Cloud identity security with expanded permission analysis. We enhanced OCI effective permission calculations, adding Identity Domain support, additional dynamic group sources, and pseudo-resource handling for comprehensive OCI identity governance. | | Identity Security navigation and inventories | Navigate identity security faster with a redesigned menu and improved inventories. We reshaped the Identity Security navigation and inventory views, providing a more intuitive layout that aligns with how security teams investigate and manage cloud identities. | | GCP inactive identity detection | Identify dormant GCP identities that increase your attack surface. We added inactive identity detection for Google Cloud Platform users, so security teams can revoke unnecessary access and reduce risk. | ## Investigation and Response | FEATURE | DESCRIPTION | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Case Timeline view | Streamline the entire investigation lifecycle with an automatically generated, end-to-end case timeline that captures every action, artifact, and piece of evidence in one place, saving time and eliminating manual work. | | Centralized issue resolution | Simplified issue-level remediation by centralizing all remediation actions in one place. From the Resolution tab, you can access recommended and pending actions, run playbooks, and complete manual playbook tasks, with seamless sync to the case's Resolution Center. | | Integrated asset context for investigations | Provides richer investigation context by connecting asset data directly to cases and issues. | | Service Level Agreements (SLAs) for issue resolution | Reduce security risk and ensure accountability with SLAs for issue resolution. These SLAs ensure teams resolve critical issues within a consistent, predictable timeframe. | | Issue exceptions | Formalize risk deferrals and align security alerts with operational constraints using issue exceptions. This feature allows you to "snooze" or exempt specific issues while maintaining oversight through documented justifications and an approval workflow. | ## Kubernetes Security | FEATURE | DESCRIPTION | | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unified Kubernetes cluster management | Manage your infrastructure from a single, streamlined interface. You can now access all controls directly from the Kubernetes Clusters page instead of navigating legacy connectivity screens. We consolidated these tools into a unified view to simplify your workflow and remove unnecessary navigation steps. | | Enhanced security and deployment for Kubernetes Connectors |

Minimize your attack surface by applying stricter security controls to your Kubernetes connectors.
Recent updates include:

| | Tag Kubernetes endpoints instantly | Automate your security deployment. Our new tag support for Kubernetes lets you seamlessly associate XDR security profiles with specific connectors during configuration. | | Enhanced KSPM Graph | We've introduced several design improvements to the KSPM Graph focused on streamlining your user experience. You can now more intuitively explore the relationships between your workloads, nodes, and cloud resources to seamlessly map and manage your cluster topology and security posture. | | Maintain system availability | Maintain system availability during unexpected disruptions. You can now choose whether to allow or block requests if the admission controller is unreachable. We added a Failure Policy setting to give you full control over your environment's stability. | | On-demand Kubernetes cluster scans | Secure your environment instantly. You no longer have to wait for scheduled cycles to evaluate newly deployed resources, including your inventory, containers, and nodes. We added a Request Scan button and API support so you can trigger on-demand cluster scans and see results in minutes. | | Optimized resource usage | Optimize system performance by eliminating redundant security scans. Your devices run more efficiently because the XDR agent automatically disables Adaptive Vulnerability Assessment (AVA) when a KSPM connector is deployed. The KSPM posture module now handles the AVA scan directly to save local resources. | ## XDR Collectors **XDR Collectors 1.5.2:** Windows 1.5.2.2326 and Linux 1.5.2.2173 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------- | | XDR Collectors 1.5.2 and 1.4.3 | This release includes performance improvements and bug fixes. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.