Release Notes - v2.7 - October 2026

Reports, Metrics and Segregation of Duties

Reports can now filter on Actions, pull in data from related entities, and trigger webhooks, along with a number of usability and reliability fixes.

Actions as a Report Condition - Report queries can now filter on Gathid Actions, so you can report on remediation status alongside access.
Read Properties From Related Entities - Reports can pull a property from a related entity without changing the entity each row is based on.
Webhooks for Actions and Report Segments - Actions and report segments can now call a webhook as well as send email, so you can trigger work in your ticketing, SIEM or automation tools.
Report Info Opens in Edit Mode - The separate Edit button has been removed. Report Info now opens ready to edit.
Improved Bulk Selection - Bulk selection now shows only the actions available for that report, shows your selections straight away, shows progress while an action runs, and closes once you make a selection.
Sorting and Columns - Alphabetical sorting now goes A-Z first, sorting keeps working after you add or change a column, and an unnecessary column picker warning has been removed.
Report Update Fixes - Fixed reports that could not be updated when used in an audit, renamed reports not updating on dashboards, and "Save & Run" not showing the latest results after a segmentation change.
Up-to-Date Results - Reports no longer show out-of-date results, segment settings are disabled while the table loads, and reports used in audits (and their stacks) are excluded from archive schedules.
Report Performance - Fixed reports that loaded slowly or failed to load in large environments, and fixed a query error affecting segmented reports.
Coming Soon: Segregation of Duties Rules - You will be able to set up SoD rules directly in the report editor, without needing an "Entity in Path" filter, so toxic access combinations are picked up as part of normal reporting.

Explore and Search

Explore and Search are faster and easier to use, particularly in large environments.

Faster Search Graph - The Search graph is faster for large, highly connected data sets.
Property Value Autocomplete - Explore filters now suggest property values as you type.
Relationship Type Selected for You - Explore picks the relationship type (informational or access) based on the step, and new queries no longer start with a pre-filled first step.
Save + Run - The Explore save button is now "Save + Run" and shows when the report is running.
Search for Actions - Actions can now be searched in Search. Users only see Actions for the systems their role gives them access to, and Actions on reports without segmentation show the segment as "All".
Search Keeps Your Query - Your last search is kept when you open an entity and come back, and system and type filters now work the first time.
Entity Graph Fixes - The entity graph only shows types from the selected system, the Reset button works, switching from Assignment entity types to other types works, and the graph no longer errors when there are no Person entity types.
Easier Step Editing - Steps are easier to reorder in Explore, the reverse direction control behaves consistently, and the slide-out closes when a report is re-run.
Report to Graph Links - Report results link through to the Search graph again, and Edit Segmentation is available from the report actions menu.

Audits and Responses

A new Last Responder column in exports, plus fixes to protect reviewer decisions and make audit exports more complete.

Last Responder in Audit Exports - PDF and XLSX audit exports now include a Last Responder column, placed between the decision and comments columns, showing who last responded to each row. It appears in the export only, not in the responder view, so reviewers still assess each row on its own.
Select All Keeps Saved Decisions - "Select All" no longer overwrites or resets saved decisions when the selection includes both in-progress and completed items.
Autosave Fix - An item selected just before an autosave now stays selected after the save.
Response View Columns - The audit responses view now supports column filtering and resizing, and decision columns are pinned to the right so they stay visible as you scroll.
Complete Audit Exports - Audit exports now include all responders when more than one is assigned, and older audits show their report information correctly.
Properties With Dots in the Name - Audit previews and response documents now show data for report columns whose property names contain a dot.
Deleting Audits - Deleting an audit now also deletes its responses, and report template fields fill in correctly when creating an audit.
Responder Fixes - The same responder can no longer be added twice, "Generate One Audit Response" no longer assigns responders to all users, and the int_state column on the Responders page now matches the step shown in the report.
Auditor Name in Sign-Off - The default signature statement now includes the auditor's name.
Audit Visibility by Role - Fixed Administrators being able to see campaigns created by SuperAdmins, while SuperAdmins could not see audits and campaigns created by other roles.

Systems, Data Sources and Timezones

Dates are now handled with explicit timezones, and you can bring in last accessed dates to find unused access.

Last Accessed Data - In the system (loader) configuration you can now choose a property to use as the Last Accessed date, so you can report on dormant and unused access.
Data Source Timezones - When you choose a date property on a data source, Gathid asks you to confirm the timezone for that source so dates are read correctly.
Timezone on Hover - Hover over any date to see its timezone.
Editable Entity Types and Icons - Global Settings now lets you edit entity types and their icons to match your organization's terms.
Relationship Builder Fixes - New relationships default to standard (not informational) and direction In (not Out), the correct relationship is selected when there are several between two entities, sub-class changes no longer affect unrelated relationships, and entities no longer move when you change the direction arrow.
System Import Fixes - Importing a system JSON without an icon, recovery or validation entity no longer leaves the system page unusable, and imports now keep the loader GUID and unique ID where possible.
Wildcard Data Sources - You can now view sample data for data sources with a wildcard in the name, and agents no longer fail when an external relationship points to another system.
Identity Provider Settings - Fixed an error when fetching IdP metadata by URL, and the timezone picker now keeps the timezone you select.

Upload Portal and File Management

Improvements for teams that deliver files manually or by script.

Controlled File Editing - Editing files in the Upload Portal now requires the right privilege, is logged, and has a size limit.
More File Types - The Upload Portal now accepts .txt, .json and .xml files.
Re-Upload Fixes - Uploading a new version of an existing file no longer shows unnecessary warnings, and several versioning display issues have been fixed.
File Dates - Fixed bucket folder files showing a date of 31 December 1969.
CSV Preview and Uploads - Fixed an error when previewing CSV files, and fixed uploads failing if you switched windows during the upload.

Dashboards and Navigation

Easier movement between dashboards and reports, and clearer widgets.

Report Collection Breadcrumbs - Opening a report collection from a dashboard now shows a breadcrumb, so you can move between related reports and back again.
System Summary Widget - The System Summary widget no longer gives a misleading result when a system's data is more than a year old.
Entity Counter Widget - The Entity Counter widget now shows the selected sub-type under the count.
Tables and Menus - The last report in a long Report Collections table is now visible, the admin menu adjusts correctly when many dashboards are expanded, and all tables now use the same loading spinner.

Access, Roles and Sessions

Changes to how Gathid roles, sign-in and licensing work.

Multiple Roles per IdP Group - You can now assign more than one Gathid role to a single identity provider group.
Gathid Access Filtering - Fixed the user filter returning "No Data Available" when there were results to show.
Sign-In and Session Pages - The failed sign-in and expired session pages have been redesigned, and the "Access Not Granted" page that could appear on first login has been fixed.
License Expiry Notifications - License expiry notifications have been reworked so you are told in good time before your license expires.

Stacks, Jobs and Logging

More accurate stack status and better logging when something goes wrong.

Stack Status Fixes - Sorting by status now works, stacks no longer show "Active (With Warnings)" without a reason, and stacks migrated from 1.15.0 no longer get stuck in "Cleanup in progress".
Stack Search - Searching for a stack number now works even when the stack is not on the first page of results.
Better Failure Logging - Improved logging for stack failures helps Gathid find and fix problems faster, and database setup now creates the stack and default jobs even if a roles upgrade fails.
Log and Notification Fixes - View Metrics in Logs now works, and action email notifications show a readable date instead of a Unix timestamp.
Python Virtual Environments for Prep-Scripts - Prep-scripts now run in their own Python virtual environments for better isolation and reliability, and prep-script passwords are no longer shown in plain text when editing.

Platform, Security and Performance

Security, dependency and infrastructure updates.

Security Fixes - Added the missing Cache-Control security header, removed a potential cross-site scripting risk via window.location.href, and fixed 30 findings rated severity 4 or higher from a release code review.
Library Updates - Upgraded libraries including axios, uuid, js-cookie, nodemailer, multer, basic-ftp, sharp, form-data, fast-uri, linkify-it and tmp to address known vulnerabilities.
Infrastructure Fixes - Fixed a Secure Boot setting that stopped VMs booting after a resize or replace, fixed a build failure caused by the pinned Node.js version, centralized version numbering to avoid hotfix merge conflicts, and refreshed the default data set and database.
Upgrade Fixes - Fixed an upgrade failure on build 3334 and restored expected behavior for the legacy Angular interface.

Optional - MCP Server

Gathid 2.7 adds a Model Context Protocol (MCP) server so approved AI assistants can read your Gathid data.

Gathid MCP Server - Connect a compatible AI assistant to Gathid and ask questions about your entities, systems, reports, snapshots and system health.
Follows Access Relationships - The MCP tools can follow relationships in the Gathid graph, so answers reflect how access is actually granted rather than looking at single records in isolation.
Read-Only Access - MCP access is read-only and limited to an approved set of data.
MCP Activity in Logs - Each MCP sign-in is recorded in the Gathid logs, so you can see who is using MCP access.

Optional - AI Prompts and Experimental Features

Safeguards and fixes for the custom AI prompts introduced in 2.6.

Prompt Checks on Save - Custom AI prompts are checked when saved to make sure they stay on topic, stay within scope, and do not contain prompt injection attempts.
Dashboard Prompt Scope - Dashboard prompts can no longer reference items outside the dashboard, unknown variables are handled safely, and a dashboard prompt override can now be cleared.
Report Summary Fixes - Summaries of reports with little or no data no longer contain made-up content, and report help text no longer shows content from a different report.
Full AI Descriptions - AI-generated Explore descriptions are no longer cut off mid-sentence, and the AI Summary clause now displays correctly.
Prompt Editor Fixes - Test Prompt now shows the full inline brief, and "Reset to default" re-enables the Save button.
AI Defaults and Access - AI prompt settings are now off by default for administrators, and users with the right permissions can access the experimental AI features for Analytics, Reports and Dashboards.
Role Modeling (Experimental) - Role models can now be imported to a stack in the background and automatically deployed to new stacks, controlled by a dedicated Gathid permission. "Import in Role Model" has moved from Reports to Role Modeling, role model creation errors have been fixed, report lists are sorted alphabetically, and role types now link correctly to Person in the deployed model.

Questions about any of these features? Contact your Customer Success representative or visit support.gathid.com for the full knowledge base.

Link to PDF version here: Gathid 2.7 Release Notes