Release 2.13 (May 2026)

The table below describes the features and enhancements introduced in the Cortex Xpanse Expander 2.13 (May 2026) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

Attack Surface Management

FEATURE	DESCRIPTION
Alerts for positive Attack Surface Testing (AST) results	Move faster from validation to response. You can now generate alerts from AST results, helping teams operationalize confirmed findings and drive faster follow-up.
Asset management enhancements	Improve asset management efficiency. New asset upload enhancements make it easier to review, manage, and take action on assets across your attack surface.
Expanded AI Infrastructure Coverage	Gain visibility into a broader set of AI-related exposures. We’ve added new AI Attack Surface Rules for technologies including OpenClaw, Hugging Face, and more.
Lookup Datasets	You can now create and manage lookup datasets in XQL to correlate your own data sources with environment events. Lookup tables are stored as name-value pairs and are cached for optimal query performance and low latency. Lookup tables support up to 1,200 modifications per day. Updates are implemented automatically whenever a lookup dataset is edited.
External Services Dataset Enhancements	Cortex Xpanse has expanded the external_services dataset to include additional CVE and service classification details. These new fields provide deeper vulnerability context and more granular service identification when querying via XQL. Use these enhancements to build more targeted custom alerting and detailed dashboards.