New Features & Enhancements
Dynamic User Groups: Expand adaptive access with dynamic user groups that are automatically created and updated based on supported user attributes.
Initial support for the Department attribute
Also supported with the Cato GraphQL API
Linux Client v5.8: During the week of Sept. 6, 2026, we will begin rolling out the Linux Client version 5.8, which includes:
Support for ARM64 architecture, expanding compatibility to ARM-based Linux devices and servers
Stability improvements, security updates, and bug fixes
Review the latest information about End of Support Client versions here
XOps Stories for Defender for Cloud Apps: Integrate alert data from Microsoft Defender for Cloud Apps to generate XOps stories. The stories are enriched with Cato identity, network, and endpoint context.
Stories are generated by the Microsoft Defender for Cloud Apps producer
XOps license and the Microsoft Defender for Cloud Apps connector required
Local Agent AI SPM - Agent Findings: Identify risky configurations on local AI agents and review agent posture and prioritize remediation from the Local Agents page.
Drill down into an agent to view finding details, including risk category and settings file
AI Sec for Users license required
Update to Agentic Threat Prevention Events: We have updated the Sub-Type and Action of events created by Agentic Threat Prevention:
Event Sub-Type: Changed from Dynamic Prevention to Agentic Threat Prevention
Action: Changed from Dynamic Control Applied to Control Applied
Export Audit Trail Events via SIEM Integrations and Event Streams: Audit Trail events are included in the events stream, combining admin configuration changes with network and security events in a single stream.
Audit events are automatically included in existing event integrations to cloud storage and SIEMs, with no configuration changes required
Query audit events through the
eventsFeedAPI using existing search and filtering capabilities
Enterprise Browser v1.2.0.61 and Browser Extension v1.9: During the week of Sept. 6, 2026, Enterprise Browser version 1.2.0.61 and Browser Extension version 1.9 will be available. These versions contain bug fixes, stability improvements, and security enhancements.
Data Export Integration for Logs and Data Flows with Datadog: Automatically forward events and network flows to Datadog using the Cato Management Application (CMA) turnkey Datadog integration for unified monitoring and analysis.
Brings Cato network and security data into existing Datadog SOC and NOC workflows
Uses the Cato events schema and eliminates the need for custom scripts or connectors
AI Security Includes Gemini Enterprise Agent Platform: Protect AI workloads running in Google Cloud with a streamlined integration that lets you monitor discovered Gemini agents from a single inventory.
Deploy the integration with Google Cloud setup
Automatically discover Gemini agents across Google Cloud projects
Expanded Socket Metrics in Network Analytics: Monitor Socket performance with additional hardware, port, and flow metrics in Network Analytics.
Metrics include memory usage, flow counts and rates, per-port packet rates, and Socket uptime
Supported from Socket v27 and higher
RPF Rules Support Geolocation and Protocols: To apply more granular control over Remote Port Forwarding (RPF), specify the source geolocation and protocols that each rule matches.
Third-Party Source for User Risk Score: Integrate the user risk score from a third-party platform to be used in your policies instead of the Cato user risk score.
Microsoft Entra ID supported
View Policies Applied to a User or Group: The Applied Policy page displays all policies applied to a user or group. This provides a clear, centralized view of policy coverage, helping admins analyze and audit access.
Traceroute-Based Path Analysis for Client Connections in Experience Monitoring: Gain hop-by-hop visibility into network paths with continuous traceroute data to quickly identify where latency or packet loss occurs between the Cato Client, connected PoP, and applications.
Available in Remote User drill-down pages
Supported for Windows Client v6.12 and higher, and macOS Client v6.0.1 and higher
DEM license required
CMA Enhancements:
AI Prompts in the Internet Firewall: Clicking on an entity in the Internet Firewall displays AI prompts to explain more about the entity, find other rules that contain it, and more
App Catalog Contains Additional Insights: The App Catalog includes IP ranges and ASNs associated with an app
PoP Announcements
Tel Aviv, IL: A new range (159.117.246.0/24) is now available for the Tel Aviv PoP location.
London, UK: A new range (159.117.250.0/24) will soon be added to the London PoP location.
New Localized IP Range for Azerbaijan: The following localized IP range for Azerbaijan (serviced through the Frankfurt PoP location) is now available:
AZ: 209.206.29.128/27