New Features & Enhancements
Agentic SOC Investigation for XOps Stories: XOps provides an AI analyst that investigates security stories on demand. Within minutes of a story being created, the AI analyst can offer a suggested verdict and remediation plan in the Stories Workbench. (Show me the Stories Workbench)
XOps license required
Cato Mobile CMA: Monitor trends and issues requiring attention from a read-only mobile app experience. An Overview dashboard shows tiles such as Account Risk Score, Posture Score, Threats Over Time, and Top Security Stories.
Available on iOS and Android
Includes Ask AI, optimized for mobile with concise, insight-focused responses
Windows Client v6.18: During the week of Oct. 18, we will begin rolling out Windows Client version 6.18. This version includes bug fixes, stability improvements, and security enhancements.
Create Custom Alerts with the Alert Policy: Define threshold-based rules for when an alert is generated for Network, Security, DEM, or other issues in your account. For example, generate an alert when concurrent flows from a specific site exceed your defined threshold. Each alert can generate an event, notification, or both.
Previously, events and notifications were limited to predefined system occurrences or connectivity health rules
Alert Policies are also supported by the API
Enhanced X1600 Wi-Fi Capabilities: Manage X1600 Wi-Fi deployments with expanded authentication, configuration, and monitoring options.
Secure SSIDs with enterprise-grade RADIUS authentication
Internet-only mode, network analytics over time, advanced radio settings, and Socket LED indications
Supported from Socket v27 and higher
Navigation Changes for AI Security: The AI Security navigation menu in the CMA is changing to make monitoring and configuration workflows easier to find.
Monitoring groups overview pages, interactions, findings, and inventory pages for users, applications, agents, tools, MCP servers, and skills
Related session pages are consolidated under Interactions with tabs for user, coding agent, and homegrown agent sessions
Configuration groups engine settings, policies, integrations, data sovereignty, Browser Plugin, Scout, Guards, and Outposts
Enhanced Posture Analysis and Investigation: Trace your posture score and drill down to the findings behind each failed check, and see how each check maps to your compliance frameworks.
Filter by status, area, category, severity, or compliance framework, and save views to reuse
See which frameworks each check supports
Overview widgets show compliance score, adoption, and your top 10 failed checks
Manual Socket Version Rollback: Manually roll back physical Sockets and vSockets to the previous software version directly from the CMA, helping admins quickly restore stability after an upgrade issue.
Rollback individual or multiple sites (show me the Sites page)
Sockets for HA sites are rolled back sequentially
Create Tickets for Failed Posture Checks: Send failed Posture check details to your ticketing platform using a webhook integration. This streamlines communication between teams using the CMA and ticketing platforms.
Supported templates for Jira and ServiceNow, additional platforms supported without a template
Dynamic IP Allocation Policy Supports Device Posture Profiles: Use Device Posture Profiles as a condition in the Dynamic IP Allocation Policy. This ensures each device gets a predictable IP address, even when one user connects from multiple devices.
ID Entrance Supported as an SSO Identity Provider: Configure ID Entrance as an identity provider for remote users, so users sign in with their existing CITS credentials.
Data Export Connectors for SIEM and Security Analytics Platforms: Forward events and network flows directly to leading SIEM and security analytics platforms using turnkey integrations configured in the CMA. This brings network and security data into existing SOC workflows without custom scripts or connectors.
Exabeam
Google SecOps
Stellar Cyber
TrendAI
Public API for Remote Access: Configure and revoke remote access through the Cato public API, bringing it into automated and infrastructure-as-code workflows alongside your other account configurations.
Public API for Roles and Permissions: Role configuration is available through the Cato public API, with the addRole and updateRole mutations and the accountRoles query mirroring the Roles & Permissions page in the CMA.
vSocket Deployment on KVM: Customers can deploy vSockets in KVM-based virtualization environments, providing greater flexibility for virtual site connectivity beyond VMware-based deployments.
HA configuration supported
Supported for both sites and App Connectors from Socket v27 and higher
Enhanced File Scanning for AI Security for Users: Cato AI Security can now read and analyze text in image files shared with AI applications, helping you identify sensitive or non-compliant content.
Supports
png,jpg,jpeg,jfif, andwebpfilesAI Security for Users license required
XOps Site Operations Stories Include Site Connection Type: To accelerate root cause analysis and reduce alert fatigue, Site Operations story and indication names include the site connection type. (Show me the Stories Workbench).
Includes all site connection types
Over the next few weeks, existing Mute Stories and Response Policy rules will be automatically migrated to the new indications
XOps license required
GCP Cloud Router BGP Peering for HA vSockets: Connect GCP HA vSocket sites to GCP Cloud Router using BGP peering from each Socket’s LAN interface IP. This provides better support for GCP environments that require separate BGP sessions for each HA Socket.
Supports GCP NCC Router Appliance deployments
Socket v27 or higher required
Register for Oct. 29 AI Security Webinar: Join us for the second webinar in our series to explore how to secure the AI agents you build and deploy. We’ll introduce Cato’s framework for Agent Security, explore Cato’s unique approach to stopping AI threats, and show it in action with a live demo of securing AI agents and apps. Register here.
PoP Announcements
New ranges for the following PoP locations are now available:
Marseille, FR: 159.117.251.0/24
Miami, US: 199.27.59.0/24