Incident timelines, patch waves, and workflow versions
v2.5.0 released 2026-06-13. Operators get more control over the operational loop. Incidents now read like a single chronological story, patching can be staged through named rollout waves, and Constellation keeps restorable versions of every workflow save.
- Added: Incident timelines: every incident drawer now includes a chronological timeline across alerts, Nightwatch findings, approvals, Auto-heal activity, failed workflows, tickets, remote terminal commands, self-service activity, and recent agent actions.
- Added: Patch waves: Devices, Patching now has named rollout plans with pilot and broad rings, maintenance windows, reboot rules, failure thresholds, status controls, and a preview of affected endpoints and pending KBs before a wave is activated.
- Added: Constellation version history: every workflow create, save, status change, and rollback records a versioned snapshot with author, timestamp, note, node count, and edge count.
- Improved: Workflow editors can restore an older Constellation version from the canvas. A rollback creates a new version instead of overwriting history, so teams can recover safely and still audit what happened.
- Security: Patch waves and workflow rollback are org-scoped, role-gated, and audited. Saved rollout plans validate endpoint groups server-side before they can be activated.
Devices command center, fleet patching, and governed shell
v2.4.0 released 2026-06-12. The fleet workspace grows up. Devices now brings endpoint inventory, groups, patching, software deployment, reporting, and a gated terminal into one place. The release also adds design-partner onboarding, durable incident lifecycle controls, live patch and software telemetry, and stronger guardrails around anything that changes a machine.
- Added: Devices workspace: endpoint inventory, groups, patching, software, reporting, and per-endpoint details now sit under one tabbed surface. Operators can move from fleet posture to a single host without changing modules.
- Added: Fleet patching: pending Windows updates now come from live endpoint telemetry, roll up by host and KB, and support one-click, approval-gated KB installs with reboot deferred by default.
- Added: Software allow-list and deployments: tenant admins can approve package keys with Windows and Linux IDs, then deploy installs or uninstalls to endpoint groups. Apollo, Constellation, and Fleet reject anything outside the allow-list.
- Added: Audited remote terminal: approver roles can open a terminal on an endpoint, run one-shot PowerShell or bash commands through the existing agent channel, and keep the transcript after command rows expire. Sessions idle out and every command is logged.
- Added: Design partner onboarding: the public site now accepts design partner applications, de-duplicates pending requests, and gives platform admins an approve or decline queue that provisions a workspace and sends the setup invite.
- Added: Constellation can now start workflows when a Nightwatch finding or a new incident opens, collect patch or service evidence bundles, create tickets from context, and run allow-listed software installs or uninstalls.
- Improved: Incidents now have a durable lifecycle: acknowledge, resolve, or reopen a host incident, then inspect the related alerts, Nightwatch findings, pending approvals, Auto-heal activity, failed automations, and linked ticket in one drawer.
- Improved: Fleet trends and forecasts now use hourly metric rollups instead of the short raw sample window, giving anomaly baselines and disk-exhaustion forecasts real history to work from.
- Security: HTTPS is forced in production, self-service users are locked out of staff routes and the raw Apollo relay, MSP client scope is re-validated on every request, software deployment is allow-list enforced server-side, and remote shell is approver-only, rate-limited, and audited.
The closed loop: incidents, Autopilot, and auto-escalation
v2.3.0 released 2026-06-07. The loop tightens. Real-time alerts and scheduled findings converge into one incident view, recurring fixes become self-healing rules in one click, and critical findings open their own tickets. Deeper security posture detection and new remediation building blocks round out the release.
- Added: Incidents: one ranked view that correlates real-time Apollo alerts with scheduled Nightwatch findings per host, so you triage by machine instead of by noise. Ask Apollo "what is broken" or open any host to see the full signal timeline.
- Added: Apollo Autopilot: after diagnosing a recurring issue, ask Apollo to turn the fix into a standing auto-remediation rule. One click creates it, with the blast radius and risk cap spelled out. New rules start disabled for review.
- Added: Auto-escalation to tickets: Nightwatch can open a ticket automatically for each new critical finding, deduplicated per finding and linked to the endpoint. Off by default, with a single switch in Nightwatch settings.
- Added: New Constellation remediation building blocks: restart an endpoint, clean up disk space, set a registry value, and disable or run a scheduled task. Each is approval-friendly and fully logged.
- Added: Apollo can now read installed certificates on an endpoint and flag anything nearing or past expiry.
- Added: New Nightwatch detectors for low space on secondary volumes and runaway processes that pin CPU or memory.
- Improved: Microsoft Defender findings now carry a one-click, approval-gated fix to re-enable real-time protection or refresh signatures.
- Security: New security posture detectors across the fleet: expiring certificates, unmanaged devices with no Entra ID, Intune, or domain join, exposed network services, and BitLocker encryption drift.
Multi-tenant for MSPs, employee self-service, and live forensics
v2.2.0 released 2026-06-06. Vertex now runs at MSP scale: manage many isolated client tenants from one partner console. Employees can safely resolve their own device issues through Apollo without opening a ticket. Apollo also gains live forensic tools, Nightwatch gains new detectors, and Constellation gains new building blocks that turn detection into governed response.
- Added: Multi-tenant for MSPs: manage many client organizations from one partner console, with a live roll-up of endpoints and alerts across clients. Step into any client to work inside it, then step back out. Each client stays a fully isolated tenant, and partner access is bounded to the clients you manage and re-checked on every request.
- Added: Apollo Self-Service: give employees a safe slice of Apollo for their own assigned device, with read-only health, a short list of IT-approved one-click fixes, and a clean escalation to a ticket for anything else. Employees cannot run free-form commands and only ever see their own machine. Tenant admins choose which fixes are allowed, set per-user limits, and see exactly who used it, with every conversation and action logged.
- Added: New live, read-only Apollo forensic tools: pull a one-shot endpoint evidence bundle, check pending-reboot state, review Windows Update history, and run service forensics (recent failures and crashes for a named service).
- Added: New scheduled Nightwatch detectors for patch debt (endpoints falling behind on updates), service flapping (a service that keeps restarting), and security posture drift (protection turned off or weakened).
- Added: New Constellation building blocks: start a workflow from a Nightwatch finding, collect a diagnostic evidence bundle as a step, and open a ticket as an action, so detection flows straight into a governed, logged response.
- Security: The new multi-tenant and self-service surfaces were penetration-tested before release. Cross-tenant isolation, bounded partner access, per-user device scoping, and the fixed safe-action allow-list were verified and hardened.
Endpoint diagnostics, log triggers, and platform hardening
v2.1.0 released 2026-06-05. Microsoft diagnostic tools come to the whole platform: see why a Windows upgrade failed, surface unsigned autostarts, and scan for unsigned binaries from Apollo, Constellation, and Nightwatch. The day also brings log-file automation triggers, per-trigger cooldowns, and a leaner edge runtime.
- Added: Endpoint diagnostics powered by Microsoft SetupDiag and Sysinternals. Find out why a Windows feature update or upgrade failed, enumerate everything that auto-starts and flag the unsigned entries, and scan a folder for unsigned executables. Each tool is downloaded on demand and signature-verified before it runs.
- Added: Run diagnostics wherever you work: ask Apollo in plain language, drop a diagnostic step into a Constellation workflow, or let Nightwatch run them on a schedule and open findings for you.
- Added: New Nightwatch detectors for unsigned autostart entries (a common persistence technique) and failed Windows upgrades.
- Added: Log file match trigger: watch a file or glob (e.g. C:\ProgramData\App\logs\*.log) for a string and fire when a matching line is written. Contains, exact, or regex matching, case sensitivity, tail-new vs scan-existing, and surrounding context lines in the event.
- Added: Per-trigger cooldowns on every agent trigger: throttle a repeating condition (the same error line, a flapping service) to at most one workflow run per window.
- Changed: The visual automation builder is now Constellation.
- Added: A public, versioned changelog (this page).
- Improved: Re-architected the Cloudflare edge worker from a single oversized module into focused, independently-testable modules. Cold starts stay in the low single-digit milliseconds.
- Security: Centralized request-identity resolution and re-verified cross-tenant isolation across every route during the re-architecture.
Multi-OS, autonomous operations, and a security audit
v2.0.0 released 2026-06-04. Linux endpoints join Windows as first-class citizens, two operational features arrive (the Nightwatch scheduled scanner and opt-in Auto-heal), and the platform completes a white-box penetration test with a published security whitepaper.
- Added: Linux endpoint support: a cross-compiled agent with a systemd service and a one-line installer (curl | sudo bash). Constellation triggers and remediation run on Linux too.
- Added: Nightwatch: per-org scheduled fleet scans across a suite of detectors (resource saturation, disk-fill forecasting, SMART failures, slow boot, failing or suspicious scheduled tasks, stale policy, crash loops, stale agents, and more).
- Added: Fingerprint de-duplication with an open, then continuing, then auto-resolved finding lifecycle, plus per-host incident correlation.
- Added: Nightwatch portal tab with findings triage. Off by default, with per-org configurable cadence and sensitivity.
- Added: Auto-heal policy engine: pre-authorized, risk-capped, blast-radius-budgeted fixes apply automatically. High-risk actions never auto-apply, and everything is audited.
- Added: Auto-heal settings with a dry-run simulator so you can see exactly what a policy would do before enabling it.
- Added: Nightwatch findings can hand off directly to Auto-heal for closed-loop remediation (for example, OS-aware disk cleanup before a drive fills).
- Added: Public knowledge base and an enterprise security whitepaper, readable without signing in.
- Security: White-box penetration test and hardening: tenant isolation, gated RBAC-controlled approvals (the requester is never the approver), SSRF protection on outbound webhooks, signed inbound webhooks, privileged-write path guards, and full security headers (HSTS, CSP, nosniff).
Self-serve onboarding & billing
v1.5.0 released 2026-05-21. Sign up, pick a plan, pay, and get a workspace provisioned automatically, then a guided wizard walks you through installing your first agent.
- Added: Self-serve signup with Stripe Checkout, a plan catalog, and automatic org + admin provisioning.
- Added: Guided onboarding wizard: generate an enrollment key, copy the install one-liner, and watch your first endpoint come online.
- Added: Billing & usage settings: plan, status, usage meters against entitlements, and invoices.
Constellation: visual automation builder
v1.4.0 released 2026-05-07. Build trigger → action workflows visually on a canvas, or just describe what you want and let Ask-AI assemble it for you.
- Added: Constellation: a drag-and-drop canvas to wire triggers to actions, with endpoint-group fan-out via reusable profiles.
- Added: Ask-AI: describe a workflow in plain language and Constellation builds a valid, ready-to-run graph.
- Added: 15 agent triggers spanning app/service state, resource thresholds, the Windows Event Log, files, network ranges, port health, certificates, and desired-state config drift.
Richer telemetry & policy insight
v1.3.0 released 2026-04-23. Deeper hardware and policy signal from every endpoint, and new Apollo diagnostics built on top of it.
- Added: SMART disk health, boot timeline, problem-driver detection, and GPO/RSOP + scheduled-task visibility in the telemetry bundle.
- Added: Apollo diagnostics for failing disks, slow boots, and persistence-risk scheduled tasks.
Fleet operations & durable approvals
v1.2.0 released 2026-04-09. Take action across the whole fleet at once, with durable role-based approvals and a full audit trail.
- Added: Fleet-wide gated actions and durable, RBAC-controlled approvals with an audit timeline (survives refreshes; works as a team queue).
- Added: Trends and ≥2σ anomaly detection, plus ticket and CVE cross-referencing over real installed-software inventory.
- Improved: Apollo evaluation harness and tool-call observability (success rate, p50/p95, token usage).
Apollo on real telemetry
v1.1.0 released 2026-03-19. An agentic Apollo that diagnoses real endpoints, proposes gated fixes, and surfaces proactive alerts.
- Added: Apollo: agentic diagnose → evidence → plan → verify over live endpoint telemetry, with deterministic tools so it can never invent data.
- Added: Gated on-demand collection, a proactive alert inbox, and one-click (approval-gated) remediation through the agent.
Vertex Systems: general availability
v1.0.0 released 2026-02-27. The first public release: a modern RMM portal backed by a lightweight Windows agent streaming real telemetry.
- Added: Portal: dashboard, tickets, devices, fleet, and endpoint groups.
- Added: Windows RMM agent with live metrics, software inventory, and a secure outbound-only command channel.