Release Notes
What changed in AutoCISO, newest first.
October 2026
- Dashboard Shows Only Verified Data, and Help Opens on RequestThe Executive tab no longer shows an overall score without evidence, unverified assets are no longer counted as healthy, tip pop-ups are gone, and the Compliance menu shows a badge.
- Read Endpoints for Platform Data in the Public APIAPI tokens can now read assets, risks, suppliers, ISO projects, compliance posture, evidence, the access inventory, employees and the Audit Trail with nine read-only scopes.
- Look up employees by e-mail over MCPThe new employee_lookup MCP tool maps e-mail addresses to employee IDs, up to 50 per call, with results by input position and no names or addresses in the response.
- Build Supplier Questionnaires From ScratchCreate a blank supplier questionnaire, add and remove sections, questions and answer options, and see what changes for existing API clients.
- Evidence Files on Manual Access and a Fix for Blank Pages After UpdatesAttach a proof file to a manual access record and download it later, and the console no longer shows a blank page after we release an update.
- Audit Trail Verify in the Public API and Generated Reference PagesAPI tokens with the new audit_log:verify scope can run the Audit Trail integrity check, and the hand-written REST pages are replaced by generated reference pages.
- Audit Trail Chain Fix and Accepted Link BreaksEntries written at the same moment no longer break the Audit Trail hash chain, the verify API reports every break, and approved historic breaks show as Accepted.
- Audit Trail Actions Are Past-Tense VerbsEvery Audit Trail entry now shows one past-tense verb as its action, with the record type in the Subject column, and filtering by a verb also finds older entries.
- Access Profiles and On-boarding CasesDescribe the access each role needs once, start a joiner case with an automatic To-Do list, and read joiner cases over a read-only jml:read API.
September 2026
- Leaver Reconciliation in the Console and Over RESTSee which leaver access is really revoked, still outstanding, or marked done while still detected — in the Leaver tab and through a new read-only jml:read API.
- Role focus, personal home screens, and a vCISO Workspace in the menuChoose a role — CTO, Security lead, CEO, Operations, Compliance, CIO or DPO — for a tailored home, menu order and guided tour that never change what you're allowed to see or do. Plus a new vCISO Workspace menu item, and two role-based AI tightenings.
- The full access inventory over MCPA new read-only tool, access_inventory_list, pages every employee × asset grant in your organisation — role, privileged flag, status, first and last observed, last used, last verified and dormancy — as ID-only rows for any mcp:read token, on every plan.
- Three access reports return identities as IDs onlyuar_status, access_normalization_health and access_anomaly_discovery no longer carry the reviewed account's name, the reviewer's name or a free-text description over MCP — each item carries employee, user and task IDs instead.
- MCP covers every Growth and Scale featureThe MCP server grows from 30 to 64 tools — compliance, monitoring, privacy, supply chain, evidence jobs, certification and an audit rehearsal tool — and every tool now follows your organisation's plan. The Tool Catalog gains a Requires plan column.
- Employee identity over MCP (pii:read)A new Owner-granted API-token scope, pii:read, unlocks the employee_resolve MCP tool — real names and emails for explicit employee IDs, audited on every call. Every token creation and revocation is now in the audit trail too.
- Supplier Questionnaire AuthoringClone the built-in supplier questionnaire and customise your own — with a submit/approve workflow, immutable published versions, and frozen assessment snapshots.