Release Highlights

The following are the key highlights for this release.

FEATURE	DESCRIPTION
Expanded AI Visibility and Governance	Enables teams to easily identify AI applications running in cloud workloads and detect vulnerabilities that may expose AI pipelines or environments. Newly added support for GCP Vertex Model Garden helps teams control model proliferation, track usage patterns, and maintain a complete AI Bill of Materials (AI-BOM).
Unified human identities	Help teams understand true access relationships, prioritize identity risk, and detect excessive or risky privileges at the human level by creating a single virtual identity that links a person's accounts across directories, cloud IdPs, and SaaS applications.
Expanded DSPM support for on-premise databases	Enhances visibility into sensitive data stored in enterprise databases, outside of the cloud. Organizations with hybrid infrastructure can now identify data exposure risks and extend DSPM governance across both on-prem and cloud environments.
New CSPM playbooks and quick actions	Expand automation coverage to help teams remediate internet exposed compute instances and cloud misconfigurations—across AWS, Azure, and GCP—using simple automated workflows and easy one-click actions.
Container as a Service (CaaS) support for AWS ECS Fargate	Embed the Cortex XDR agent within the container image for CaaS workloads and get real-time monitoring and protection against active threats.
Audit ready compliance reporting	Ensures teams remain prepared for SOC 2, PCI-DSS, and HIPAA audits with a new unified evidence framework that automates data collection across the XDR agent, agentless scanning, and Kubernetes connector.
Expanded Agentless Kubernetes Security	Helps eliminate security blind spots and reduces deployment friction by delivering visibility into inventory, compliance, and runtime images across AWS Kubernetes and containers.
Identity and privilege based SOC response for Windows, Windows Server, and Linux instances	Instantly disrupt the kill chain with minimal user impact by validating identity and dynamically limiting privileges via CyberArk Endpoint Privilege Manager. Available via Cortex Marketplace. Requires a CyberArk EPM license.
Native Snyk integration	Snyk integration - seamlessly ingests their SAST and SCA findings into Cortex Cloud to centralize visibility and improve prioritization and prevention without disrupting existing development processes
Pre-runtime unified policy	Simplify policy management with our new Unified AppSec policy engine. By consolidating build and registry image security into our existing code, drift, and supply chain framework, you can now manage detection and enforcement in one centralized place. This ensures a consistent security posture across every pre-deployment stage of the SDLC, protecting your artifacts from the first line of code to the final container image. Corresponding API updates (/public_api/appsec/v1/policies): - Unified finding types: Select multiple finding types at the same time to create a single policy for code, build and deploy - New scan triggers: Trigger scans for CI build Image and registry images - Pipeline blocking: Automatically prevent CI builds when image findings violate policies - SBAC: Apply scoped access controls during policy creation