October 2026
Application Features
New Feature: EPSS, Know What Attackers Are Likely to Exploit Next
Not every critical vulnerability gets exploited, and not every ‘medium’ is safe. This release adds the Exploit Prediction Scoring System (EPSS) to the platform, giving every vulnerability a daily, data-driven estimate of how likely it is to be exploited in the wild within the next 30 days. Combined with severity, exploit intelligence and your asset context, EPSS helps your team put effort where it will reduce the most real-world risk.What’s New?
Daily EPSS enrichment. The platform retrieves EPSS data every day and matches it to the CVEs in the vulnerability database, storing both the EPSS score and percentile. A daily history is kept for every CVE, which powers the trend view described below.EPSS where you work. EPSS appears as a colour-coded percentile badge in the Issues table, the Phase Issues table, the individual Issue view and the Affected Instances table. Where an issue has multiple CVEs, the platform shows the highest EPSS-rated CVE, so you always see the worst case.
Fully configurable. The EPSS column is on by default in the tables above. You can sort by it, export it, and show or hide it using the column configuration controls.
EPSS data in the API. EPSS score, percentile, last-updated timestamp and the CVE that drove the rating are returned through the Issue and Affected Instance APIs and API exports, so your reporting tools and integrations can use them too. Values are returned as null where no EPSS data exists, so existing integrations are unaffected.
Key Benefits
Smarter prioritisation: focus on the vulnerabilities attackers are most likely to go after, not just the ones with the highest CVSS.
Fewer wasted cycles: safely de-prioritise high-severity findings with a very low likelihood of exploitation.
A defensible story: give auditors, executives and clients a clear, industry-standard reason for why a finding was escalated.
Works with your workflow: sort, filter and export on EPSS just like any other column.
Platform Improvements
Improvement: Set Confirmed At and Published At Dates During Quick Import
Importing historic data shouldn’t mean exporting, editing a JSON file and re-importing just to get your SLA dates right. Quick Import now lets you set the dates yourself.
What’s New?
Confirmed At is now a clear date/time picker (replacing the old ‘Select’ control), so you can record when the issue was actually identified by the tester.
Published At is a new, optional date/time picker that controls when SLA tracking begins for the imported issues. Leave it blank and the platform uses the standard publish timestamp as before.
Helpful tooltips beside both fields explain what each one controls.
A refreshed Quick Import layout with clearer steps, better grouping of import settings and improved readability.
Key Benefits
Accurate SLAs from day one. Imported issues start their SLA clock from the date you intend, not the date you uploaded.
Trustworthy trending. Historic imports feed remediation trend graphs and dashboard metrics from the right point in time.
Ideal for migrations. Bring in reports from previous weeks, months, or another platform without distorting your reporting.
Less manual effort for teams who receive vendor reports after the test was completed.
Where to find it: the Quick Import workflow when importing scan results into a project.
Improvement: Filter by Null Values
Housekeeping just got a lot easier. You can now filter for items where a value is empty, so finding unassigned or untagged work is a one-step job.
Where to Find It
Results > Issues: Tags = Null, User Assigned = Null
Results > Assets: Tags = Null, System Owner = Null, Technical Owner = Null
Key Benefits
Quickly find all unassigned issues and assign them in bulk.
Spot assets with no tags or no owner and close governance gaps.
No more sorting columns to push blanks to the top before exporting to Excel.
Improvement: Faster Phase-Level Host Lists
Phases containing thousands of hosts, such as large Microsoft Defender imports, now load and sort much faster. Host pages are designed to load in under a second even with more than 1,000 hosts, with issue counts retrieved separately so ordering stays responsive.
Where to find it: Projects > Phase > Hosts.
Improvement: Export Issues Includes More Data
The asset issue export, now named Export Issues, includes every available column plus additional detail: Status, First Seen, Reference, Vulnerability, Summary, Technical Details, Recommendations, CVE, References, Project, Assigned, Hostname, IP Address, Port, Service, Tags, Last Seen, Remediation Deadline and SLA.
Operational Features
New Feature (Beta): Rootshell MCP Server, Talk to Your Vulnerability Data
What if you could simply ask your vulnerability data a question? The new Rootshell MCP Server, now available in beta, lets you connect any AI assistant or tool with an MCP client to the platform using the Model Context Protocol (MCP), an open standard for connecting AI tools to data sources. We’ve tested it with ChatGPT, Microsoft Copilot, Claude and Gemini. Ask in plain English and get answers drawn from your own Rootshell data, with read-only access.
What’s New?
Natural-language access. Investigate exposures, affected assets and remediation priorities conversationally, without navigating multiple pages and filters or building API requests.
Bring your own assistant. If it has an MCP client, it can connect to the Rootshell MCP Server. ChatGPT, Microsoft Copilot, Claude and Gemini have all been tested, and Microsoft Copilot Studio agents can be shared with your team through channels such as Microsoft Teams and Microsoft 365 Copilot.
Read-only by design. The MCP server is built on the platform’s read (GET) API endpoints. Assistants can retrieve and analyse your data, but cannot modify it, change issues or take remediation actions.
Secure and permission-aware. Connections are authorised through an OAuth 2.0 sign-in. An assistant can only access the tenant and the data your own user is already permitted to see, and connecting one never grants additional permissions.
Tenant-specific. Each tenant has its own MCP server address, so you stay in control of which environment an assistant can reach.
Example Prompts
Show me all currently open critical issues.
Which open issues have an active exploit?
Which assets have the highest number of critical and high-severity issues?
What should I prioritise for remediation?
Key Benefits
Faster answers: ask a follow-up question instead of rebuilding a search or filter.
Vulnerability data for everyone: colleagues who don’t live in the platform can still get clear answers about exposure and priorities.
Safe to adopt: read-only access that respects your existing roles and permissions.
Fits your AI strategy: bring trusted vulnerability data into the AI tools your organisation is already using.
Availability: the Rootshell MCP Server is currently in beta and is enabled per tenant for participating clients. Contact your Rootshell representative to request access. Setup guides for Claude, ChatGPT and Microsoft Copilot Studio are available in the knowledgebase.
New Feature: Vulnerability Categorisation Engine (Stage 1)
Stage one of the Vulnerability Categorisation Engine is now underway. Working quietly in the background, every vulnerability entering the Vulnerability Database is automatically assigned a primary category during ingestion, consistently across all supported sources.
Vulnerabilities are grouped into broad, easy-to-understand categories. For example, a Windows security update would be grouped with operating system patching, while a cross-site scripting finding would be grouped with web application vulnerabilities.
Deterministic, configurable rules evaluate titles, descriptions, remediation text, CVEs, vendor and product details, scanner metadata, ports, services and protocols. When several rules match, a fixed priority order decides which category applies.
Each vulnerability stores its category, confidence score, classification source, matched rule and keyword, rule version and timestamp, all exposed through the platform APIs.
What’s next: this stage is all about building the foundation. There’s nothing to configure and no change to how you work today. The front-end experience is coming soon, putting categories to work in dashboards and reports and enabling category-driven remediation guidance (for example, rolling many ‘Apache version’ findings into one action: upgrade Apache).
Platform Improvements
Partner Insights Dashboards, Accuracy and Refinements
The Partner Insights Dashboards are being refined ahead of their wider release. This update tightens up the numbers and behaviour based on early feedback from partners.
Asset prioritisation percentages are now calculated correctly and no longer exceed 100%.
Percentage-change values display accurately.
Dashboard data refreshes are now handled per instance, so each instance’s figures stay correct.
Line graphs show the right instance data.
Last login information is more accurate.
Where to find it: Tenant Overview > Partner Insights.
