Feature Enhancements

These enhancements provide new and improved capabilities.

The following table describes the Cortex XDR agent 9.1-CE release. The release will be divided into two deployments, June 15 2026 and June 22 2026.

General

FEATURE	DESCRIPTION
Amazon ECS EC2 agent installer	Expanded runtime protection for AWS ECS EC2 workloads improves real-time defense against malware, exploits, and behavioral threats using the XDR agent to help teams stop attackers.
Endpoint Data Loss Prevention (DLP)	Protect web and endpoint activity from data leakage, even when devices are offline. Endpoint DLP delivers unified, proactive protection to stop data loss and keep critical information secure. Requires an additional license.

Linux

FEATURE	DESCRIPTION
Linux protection updates	Neutralize multi-vector threats the moment they touch your Linux systems. New on-write protection automatically scans ELF, PE, and Mach-O files blocking malicious binaries from being stored in your environment. Identify stealthy "Command and Control" behavior by spotting unusual network connections. This new detection suite profiles network baselines for Linux to identify abnormal communication patterns.
Secure Linux workloads with broader protection coverage	Prevent malicious activity on more Linux systems without requiring kernel-level access. We expanded Child Process Protection to support User Mode, ensuring your workloads stay secure even when kernel modules aren't available. This update provides broader coverage and simpler deployment for diverse Linux environments.
Linux distribution support	Support added for Alibaba Cloud Linux Release 3

macOS

FEATURE	DESCRIPTION
macOS protection updates	Identify stealthy "Command and Control" behavior by spotting unusual network connections. This new detection suite profiles network baselines for macOS to identify abnormal communication patterns. Block malicious USB device attacks on macOS. Protect your macOS systems from unauthorized hardware attacks and malicious USB devices. The Malicious Device Prevention module identifies and blocks tools like the "USB Rubber Ducky" that exploit device trust to execute attack techniques from a USB device.
MDM installation settings	Deploy agents effortlessly across your organization using your preferred mobile device management (MDM) tool. You can now configure installation settings directly through your MDM provider. We integrated support for managed app configurations to ensure seamless, single-package deployments.