· Changelog

What shipped, when.

Every customer-facing change, newest first. Opt-in modules are marked as such; nothing listed as opt-in is enabled on your tenant unless you turn it on. Longer-form thinking is on the blog.

NewImprovedFixedSecurity

  1. Attack-surface scanning per workspace, blog and changelog

    The external scanner can now be switched on by a workspace admin, and this page exists.

    • NewAttack Surface scanning is available as a per-workspace opt-in under Settings. Enabling it requires accepting authorised-use terms (recorded in the audit log); each target still needs its own written attestation and private address space is refused. It checks open ports, web technologies, WAF presence, missing security headers and known CVEs with CVSS severity.
    • NewBlog and changelog pages, linked from the header and footer, with an RSS feed for the blog.
    • FixedThe public demo now runs on one canonical sample fleet: every count (endpoints, compliant/non-compliant, findings by rule and severity, per-device status and risk grade, software flags, framework coverage) is derived from the same device list with the product's own rules. The Findings view lists every finding with filters, search and paging; OS end-of-life, missing patches (CVE) and active-threat findings appear alongside the rest; a device with any active finding is never shown as Compliant.
    • FixedStatus page probes www.cybroak.com, app.cybroak.com and the API separately from your browser and reports each one's real state.
    • ImprovedFramework scoring is now device coverage: each assessed control reports the share of devices that satisfy it, and the framework score is the mean across assessed controls, with the strict pass ratio shown alongside. One stale laptop in a 500-device fleet no longer reads as 0%. Control status itself stays strict (any active finding fails the control), and controls evidenced by modules you haven't enabled are reported as not assessed and excluded from the score instead of counted as passing. Applies to the app, the PDF evidence pack, the trust badge and the public demo.

  2. Launch readiness: plan-aware signup, trust pages, faster first paint

    The last pass before opening the doors: choosing a plan now actually means something, every trust question has a page, and the homepage is readable on first paint.

    • NewPlan-aware signup at /signup. Pick Free, Starter, Growth or Business, see the price, device limit and trial terms, then continue with Microsoft. Paid plans start a 14-day card-free trial the moment you sign in.
    • NewSecurity, About, Contact and Status pages, all linked from the footer. The status page checks the live API from your browser rather than showing a hard-coded green light.
    • NewRequest a demo: a real form that reaches us directly, with a calendar embed ready to switch on.
    • ImprovedOne consistent sample fleet (Contoso Ltd, 248 endpoints) across the homepage, the live demo and the verified-evidence example.
    • ImprovedHomepage hero renders immediately with final numbers; no fade-in, no count-up, self-hosted fonts.
    • ImprovedPricing footnote clarifies what Growth and Business include, plus an MSP pricing note.
    • FixedInvalid or missing plan links redirect to Free with a clear message; each signup page has its own browser title; both signup steps are shown up front.
    • FixedMobile layout: no horizontal overflow on the homepage, pricing, signup or demo; tappable full-width buttons.

  3. Design-system pass and clearer Intune permission errors

    A sharper dashboard and much better guidance when Intune says no.

    • ImprovedDashboard hero now shows one fleet score with grade and 7-day delta next to a ranked "Fix next" list.
    • ImprovedCompliance and Findings pages redesigned: per-control pass/fail rows with one-click fix chips, consistent page headers, sparklines on stat cards.
    • FixedA 403 from Intune during sync now explains that the signed-in user needs an Intune role, with a direct "sign in as an Intune admin" action, instead of a cryptic error.
    • ImprovedServer-rendered landing page with SEO metadata, Open Graph image, error boundaries and keyboard-visible focus states.

  4. MSP fleet overview, identity and email posture, attack-surface recon

    Three opt-in modules for teams that want more than device posture, plus a cross-client view for MSPs.

    • NewMSP fleet overview: severity distribution, top findings and at-risk clients across every managed tenant.
    • NewIdentity posture (opt-in, read-only): Conditional Access, MFA registration and privileged-role findings mapped to the same frameworks.
    • NewEmail and domain posture (opt-in, DNS-only): SPF, DKIM and DMARC checks for each sending domain.
    • NewExternal attack-surface recon (opt-in, authorised targets only): open ports, web technologies, WAF detection, known CVEs, optional screenshots and Shodan enrichment, with a geographic exposure map.
    • ImprovedLanding page product mockup, numbered workflow cards and tighter spacing.

  5. Security headers and deploy hardening

    Defence in depth for the web tier.

    • SecurityContent-Security-Policy, HSTS, X-Frame-Options, nosniff and Referrer-Policy headers on every response.
    • FixedTransactional email tolerates a mistyped From address instead of silently failing every send.

  6. Connect client tenants, policy registry, polish

    Safer MSP onboarding and a better first-run experience.

    • NewConnect a client tenant: MSPs share a signed, expiring invite link; the client's own Global Administrator completes Microsoft consent and the tenant is linked. No consent is ever bypassed.
    • NewPolicies page: a registry of every Intune policy CybrOak has created, with status.
    • ImprovedFriendly re-consent prompt when a remediation needs permissions that haven't been granted yet.
    • ImprovedSkeleton loading states, proper empty states on Devices, and a highlighted next step in the onboarding checklist.

  7. Verifiable evidence packs, continuous controls, trust badge

    The release that made CybrOak evidence something an auditor can check without trusting us.

    • NewTamper-evident evidence packs: every pack is registered with a unique Evidence ID and SHA-256 fingerprint and can be verified publicly at /verify/<id>.
    • NewContinuous control evidence: show a control held every day across the audit period, the way SOC 2 Type II expects.
    • NewEmbeddable live trust badge that always shows the current score and links back to the verification page.
    • NewPath to Compliance: a prioritised remediation roadmap per framework.
    • NewSolution pages for MSPs, security teams, enterprise and software inventory; a Support hub with searchable topics.
    • NewGuides hub with the first article: turning Intune into a SOC 2 and CIS compliance report.

  8. Audit-ready PDF evidence packs, CVE exposure, Business tier

    From a findings dashboard to compliance evidence.

    • NewAudit-ready PDF evidence pack mapping the fleet to CIS Controls v8, SOC 2 and ISO 27001, with CSV export.
    • NewMissing-security-patch detection with CVE exposure, from a curated patch-level snapshot.
    • NewBusiness plan (up to 1,500 devices) and Azure Marketplace SaaS fulfilment.

  9. Billing, remediation, MSP console, onboarding

    The foundations: pay for it, fix things with it, run it for clients.

    • NewStripe billing with plans, 14-day trials and device-cap enforcement; welcome, subscription and trial-ending emails.
    • NewReal Intune remediation: Force Device Sync and automated BitLocker, Defender and Firewall policy enforcement, each behind an explicit, separately consented switch.
    • NewMSP console to manage multiple client tenants from one view.
    • NewOne-click demo data so the product can be explored without a live Intune connection, and a getting-started checklist.
    • NewPublic interactive demo at /demo with a sample fleet.

Earlier work laid the foundations and is not itemised here. Questions about a change? Contact us.