Durable investigations and causal evidence history
v2.7.0 released 2026-08-27. Apollo can now preserve a diagnosis as a case, reason over time-ordered evidence, and refresh that case without erasing what earlier analysis concluded.
- Added: Durable Apollo investigations: start a root-cause case for one endpoint, keep its symptom and onset window, reopen it later, and resolve or cancel it with a permanent case timeline.
- Added: Temporal and causal evidence modeling: Apollo correlates metrics, processes, services, events, reliability, drift, alerts, Nightwatch findings, actions, boot, disk, and driver evidence while preserving observation time, freshness, source, and quality.
- Added: Versioned analysis runs: Refresh evidence creates an immutable run, compares it with the latest successful run, and classifies observations as added, changed, unchanged, resolved, or missing.
- Added: Hypothesis history: each case shows how candidate cause rank and confidence changed across runs, alongside supporting, contradicting, contextual, and missing evidence.
- Improved: Apollo now reports evidence coverage and weak, moderate, or strong confidence bands, and abstains when the available evidence cannot support a reliable root-cause conclusion.
- Improved: Operators can create, list, open, and refresh investigations from chat or the investigation panel, including symptom-onset prompts such as "issue started on HOST on YYYY-MM-DD".
- Security: Investigation records, runs, evidence, and lifecycle events are tenant-scoped; mutations follow the existing authenticated write and audit boundaries.
Security boundary hardening
v2.6.0 released 2026-08-16. This release closes alternate privilege paths across workflows, agents, billing, API tokens, MFA, webhooks, AI tools, and the agent distribution pipeline.
- Security: Constellation authoring and execution now require an administrator or engineer. The platform re-checks the recorded author at trigger time and validates every agent command again at the final dispatch boundary.
- Security: Agent enrollment is always strict: every new device needs a tenant-bound, expiring enrollment token. Endpoint bindings are unique, and task results are accepted only from the agent that owns the command.
- Security: Bearer keys now carry their own tenant, role, scopes, and expiry, never inherit platform-admin authority, and are revoked when an account is disabled. Existing keys migrate to read-only.
- Security: Stripe checkout and webhooks fail closed when production configuration is incomplete. Webhooks always verify signatures, enforce timestamp tolerance, and use retry-safe processing state.
- Security: MFA changes require password and current-factor step-up. Replacement factors remain pending until confirmed, TOTP secrets are AES-GCM encrypted, other sessions are revoked, and the account receives a security notification.
- Security: Inbound workflow webhooks now require timestamped HMAC signatures and unique nonces. Request bodies and agent result output are bounded, rate-limit storage fails closed, and cookie mutations enforce same-origin requests.
- Security: Apollo applies a server-owned anti-injection policy, accepts only allowlisted tools, and caps message, schema, and output sizes. Live diagnostic collection is approver-only with network, registry, and process-dump guardrails.
- Security: Agent installers verify release-manifest SHA-256 hashes before execution. The build publishes only an explicit artifact allowlist and fails when an agent or CA checksum does not match.
- Improved: Security regression tests and a least-privilege CI workflow now gate builds, type checking, dependency audit, release integrity, and Worker deployment dry-runs.
Incident timelines, patch waves, and workflow versions
v2.5.0 released 2026-06-13. This build connects three records operators had been managing separately: incident activity, staged patch rollout, and workflow revision history.
- Added: Incident timelines: every incident drawer now includes a chronological timeline across alerts, Nightwatch findings, approvals, Auto-heal activity, failed workflows, tickets, remote terminal commands, self-service activity, and recent agent actions.
- Added: Patch waves: Devices, Patching now has named rollout plans with pilot and broad rings, maintenance windows, reboot rules, failure thresholds, status controls, and a preview of affected endpoints and pending KBs before a wave is activated.
- Added: Constellation version history: every workflow create, save, status change, and rollback records a versioned snapshot with author, timestamp, note, node count, and edge count.
- Improved: Workflow editors can restore an older Constellation version from the canvas. A rollback creates a new version instead of overwriting history, so teams can recover safely and still audit what happened.
- Security: Patch waves and workflow rollback are org-scoped, role-gated, and audited. Saved rollout plans validate endpoint groups server-side before they can be activated.
The devices command center
v2.4.0 released 2026-05-14. Inventory, patching, software work, reports, and endpoint history now share one workspace. Remote commands and package deployment use the same approval and audit path as the rest of Vertex.
- Added: Devices workspace: endpoint inventory, groups, patching, software, reporting, and per-endpoint details now sit under one tabbed surface. Operators can move from fleet posture to a single host without changing modules.
- Added: Fleet patching: pending Windows updates now come from live endpoint telemetry, roll up by host and KB, and support one-click, approval-gated KB installs with reboot deferred by default.
- Added: Software allow-list and deployments: tenant admins can approve package keys with Windows and Linux IDs, then deploy installs or uninstalls to endpoint groups. Apollo, Constellation, and Fleet reject anything outside the allow-list.
- Added: Audited remote terminal: approver roles can open a terminal on an endpoint, run one-shot PowerShell or bash commands through the existing agent channel, and keep the transcript after command rows expire. Sessions idle out and every command is logged.
- Added: Design partner onboarding: the public site now accepts design partner applications, de-duplicates pending requests, and gives platform admins an approve or decline queue that provisions a workspace and sends the setup invite.
- Added: Constellation can now start workflows when a Nightwatch finding or a new incident opens, collect patch or service evidence bundles, create tickets from context, and run allow-listed software installs or uninstalls.
- Improved: Incidents now have a durable lifecycle: acknowledge, resolve, or reopen a host incident, then inspect the related alerts, Nightwatch findings, pending approvals, Auto-heal activity, failed automations, and linked ticket in one drawer.
- Improved: Fleet trends and forecasts now use hourly metric rollups instead of the short raw sample window, giving anomaly baselines and disk-exhaustion forecasts real history to work from.
- Security: HTTPS is forced in production, self-service users are locked out of staff routes and the raw Apollo relay, MSP client scope is re-validated on every request, software deployment is allow-list enforced server-side, and remote shell is approver-only, rate-limited, and audited.
Incidents become the shared operating queue
v2.3.0 released 2026-04-16. Real-time alerts and scheduled findings now meet in one host record. Recurring work can be reviewed as an Auto-heal rule, and critical findings can open a linked ticket.
- Added: Incidents: one ranked view that correlates real-time Apollo alerts with scheduled Nightwatch findings per host, so you triage by machine instead of by noise. Ask Apollo "what is broken" or open any host to see the full signal timeline.
- Added: Apollo Autopilot: after diagnosing a recurring issue, ask Apollo to turn the fix into a standing auto-remediation rule. One click creates it, with the blast radius and risk cap spelled out. New rules start disabled for review.
- Added: Auto-escalation to tickets: Nightwatch can open a ticket automatically for each new critical finding, deduplicated per finding and linked to the endpoint. Off by default, with a single switch in Nightwatch settings.
- Added: New Constellation remediation building blocks: restart an endpoint, clean up disk space, set a registry value, and disable or run a scheduled task. Each is approval-friendly and fully logged.
- Added: Apollo can now read installed certificates on an endpoint and flag anything nearing or past expiry.
- Added: New Nightwatch detectors for low space on secondary volumes and runaway processes that pin CPU or memory.
- Improved: Microsoft Defender findings now carry a one-click, approval-gated fix to re-enable real-time protection or refresh signatures.
- Security: New security posture detectors across the fleet: expiring certificates, unmanaged devices with no Entra ID, Intune, or domain join, exposed network services, and BitLocker encryption drift.
MSP workspaces and employee self-service
v2.2.0 released 2026-03-19. Partner teams can move between isolated client workspaces, while employees get a limited view of their own assigned device and IT-approved fixes.
- Added: Multi-tenant for MSPs: manage many client organizations from one partner console, with a live roll-up of endpoints and alerts across clients. Step into any client to work inside it, then step back out. Each client stays a fully isolated tenant, and partner access is bounded to the clients you manage and re-checked on every request.
- Added: Apollo Self-Service: give employees a safe slice of Apollo for their own assigned device, with read-only health, a short list of IT-approved one-click fixes, and a clean escalation to a ticket for anything else. Employees cannot run free-form commands and only ever see their own machine. Tenant admins choose which fixes are allowed, set per-user limits, and see exactly who used it, with every conversation and action logged.
- Added: New live, read-only Apollo forensic tools: pull a one-shot endpoint evidence bundle, check pending-reboot state, review Windows Update history, and run service forensics (recent failures and crashes for a named service).
- Added: New scheduled Nightwatch detectors for patch debt (endpoints falling behind on updates), service flapping (a service that keeps restarting), and security posture drift (protection turned off or weakened).
- Added: New Constellation building blocks: start a workflow from a Nightwatch finding, collect a diagnostic evidence bundle as a step, and open a ticket as an action, so detection flows straight into a governed, logged response.
- Security: The new multi-tenant and self-service surfaces were penetration-tested before release. Cross-tenant isolation, bounded partner access, per-user device scoping, and the fixed safe-action allow-list were verified and hardened.
Diagnostics where operators already work
v2.1.0 released 2026-02-20. SetupDiag and Sysinternals checks can be run from an investigation, a workflow, or a scheduled inspection. Log-file triggers and cooldowns make those checks easier to operationalize.
- Added: Endpoint diagnostics powered by Microsoft SetupDiag and Sysinternals. Find out why a Windows feature update or upgrade failed, enumerate everything that auto-starts and flag the unsigned entries, and scan a folder for unsigned executables. Each tool is downloaded on demand and signature-verified before it runs.
- Added: Run diagnostics wherever you work: ask Apollo in plain language, drop a diagnostic step into a Constellation workflow, or let Nightwatch run them on a schedule and open findings for you.
- Added: New Nightwatch detectors for unsigned autostart entries (a common persistence technique) and failed Windows upgrades.
- Added: Log file match trigger: watch a file or glob (e.g. C:\ProgramData\App\logs\*.log) for a string and fire when a matching line is written. Contains, exact, or regex matching, case sensitivity, tail-new vs scan-existing, and surrounding context lines in the event.
- Added: Per-trigger cooldowns on every agent trigger: throttle a repeating condition (the same error line, a flapping service) to at most one workflow run per window.
- Changed: The visual automation builder is now named Constellation.
- Added: A public, versioned changelog (this page).
- Improved: Re-architected the Cloudflare edge worker from a single oversized module into focused, independently-testable modules. Cold starts stay in the low single-digit milliseconds.
- Security: Centralized request-identity resolution and re-verified cross-tenant isolation across every route during the re-architecture.
Linux support and scheduled fleet inspection
v2.0.0 released 2026-01-22. Linux endpoints join Windows in the same inventory and workflow model. Nightwatch adds scheduled inspection, with opt-in remediation policies reviewed through a simulator before activation.
- Added: Linux endpoint support: a cross-compiled agent with a systemd service and a one-line installer (curl | sudo bash). Constellation triggers and remediation run on Linux too.
- Added: Nightwatch: per-org scheduled fleet scans across a suite of detectors (resource saturation, disk-fill forecasting, SMART failures, slow boot, failing or suspicious scheduled tasks, stale policy, crash loops, stale agents, and more).
- Added: Fingerprint de-duplication with an open, then continuing, then auto-resolved finding lifecycle, plus per-host incident correlation.
- Added: Nightwatch portal tab with findings triage. Off by default, with per-org configurable cadence and sensitivity.
- Added: Auto-heal policy engine: pre-authorized, risk-capped, blast-radius-budgeted fixes apply automatically. High-risk actions never auto-apply, and everything is audited.
- Added: Auto-heal settings with a dry-run simulator so you can see exactly what a policy would do before enabling it.
- Added: Nightwatch findings can hand off directly to Auto-heal for closed-loop remediation (for example, OS-aware disk cleanup before a drive fills).
- Added: Public knowledge base and an enterprise security whitepaper, readable without signing in.
- Security: White-box penetration test and hardening: tenant isolation, gated RBAC-controlled approvals (the requester is never the approver), SSRF protection on outbound webhooks, signed inbound webhooks, privileged-write path guards, and full security headers (HSTS, CSP, nosniff).
Account setup and first-agent onboarding
v1.5.0 released 2025-12-11. Workspace provisioning, billing, and the first agent install now follow one guided setup path.
- Added: Self-serve signup with Stripe Checkout, a plan catalog, and automatic org + admin provisioning.
- Added: Guided onboarding wizard: generate an enrollment key, copy the install one-liner, and watch your first endpoint come online.
- Added: Billing & usage settings: plan, status, usage meters against entitlements, and invoices.
Constellation workflow canvas
v1.4.0 released 2025-11-13. The first visual workflow canvas connects endpoint triggers to actions and reusable endpoint-group profiles.
- Added: A drag-and-drop canvas wires triggers to actions, with endpoint-group fan-out through reusable profiles.
- Added: Apollo can translate a plain-language workflow request into a graph that still passes the same deterministic validation as a hand-built workflow.
- Added: 15 agent triggers spanning app/service state, resource thresholds, the Windows Event Log, files, network ranges, port health, certificates, and desired-state config drift.
Hardware, boot, and policy evidence
v1.3.0 released 2025-10-16. The agent adds disk health, boot timing, driver, policy, and scheduled-task evidence to each endpoint record.
- Added: SMART disk health, boot timeline, problem-driver detection, and GPO/RSOP + scheduled-task visibility in the telemetry bundle.
- Added: Apollo diagnostics for failing disks, slow boots, and persistence-risk scheduled tasks.
Fleet actions, approvals, and audit history
v1.2.0 released 2025-09-25. Multi-endpoint work now waits in a durable role-based approval queue and writes each decision to an audit timeline.
- Added: Fleet-wide gated actions and durable, RBAC-controlled approvals with an audit timeline (survives refreshes; works as a team queue).
- Added: Trend analysis and anomaly detection, plus ticket and CVE cross-referencing over installed-software inventory.
- Improved: Apollo evaluation harness and tool-call observability (success rate, p50/p95, token usage).
Apollo connects to live endpoint data
v1.1.0 released 2025-09-04. Apollo can read current endpoint evidence, propose a bounded next step, and attach that proposal to an approval request.
- Added: Apollo follows a diagnose, evidence, plan, and verify path over live telemetry, using deterministic tools for every data lookup and action.
- Added: Gated on-demand collection, a proactive alert inbox, and one-click (approval-gated) remediation through the agent.
The first working agent and portal
v1.0.0 released 2025-08-14. The first working build pairs a lightweight Windows agent with endpoint inventory, tickets, and a live portal.
- Added: Portal: dashboard, tickets, devices, fleet, and endpoint groups.
- Added: Windows RMM agent with live metrics, software inventory, and a secure outbound-only command channel.