Changelog

Azure: App Service deploy credentials that bypass Entra ID and MFA

An App Service publish profile is a static password that grants code deployment — and it leaks often, straight into repos and pipelines. The scan now flags apps that still allow basic-auth publishing.

Azure: log history that runs out before the investigation starts

Attackers often dwell for weeks before discovery. If your logs only go back 30 days, the early-stage evidence is already gone. The scan now flags Log Analytics workspaces with too-short retention.

Azure: Defender for Cloud alerts with nowhere to go

Detection without notification is effectively no detection. If Defender for Cloud has no security contact email, high-severity alerts sit silently in the portal while an attack runs. The scan now flags that gap.

Azure: app registrations open to other tenants or personal accounts

An unexpectedly multi-tenant or consumer-account app registration is a classic attacker persistence trick — a foothold that survives password resets. The scan now flags apps that reach beyond your own tenant.

Azure: storage accounts allowing cross-tenant data replication

Cross-tenant replication can quietly stream a storage account’s data into an organisation you don’t control — a low-noise exfiltration pipe that bypasses the account’s own firewall. The scan now flags it.

Azure: SQL servers exposed to the internet or all Azure services

A database reachable from the whole internet is one leaked password away from a breach — and automated scanners will find it. The scan now flags over-broad SQL server firewall rules.

Azure: Key Vaults still on the legacy access-policy model

Vault access policies are coarse, easy to over-provision, and invisible to Entra ID access reviews and PIM. The scan now flags vaults that haven’t moved to the Azure RBAC permission model.

Azure: storage accounts still allowing Shared Key (account key) access

A storage account key is a master key to all of the account’s data — it bypasses RBAC and Conditional Access and can’t be scoped or cleanly revoked. The scan now flags accounts that haven’t moved to Entra ID auth.

Azure: insecure OAuth redirect URIs on app registrations

A wildcard or cleartext-http reply URL turns any sign-in to an app into a potential account takeover — no stolen password required. The scan now flags them.

Azure: risky tenant-wide OAuth consent grants (illicit-consent detection)

OAuth consent-phishing gives an app standing access to everyone’s mail and files — access that survives password resets and isn’t stopped by MFA. The scan now finds those grants.

Azure: over-privileged application & service-principal Graph permissions

Apps consented to a handful of Microsoft Graph permissions are effectively hidden Global Admins — they act with no signed-in user and bypass Conditional Access. The scan now surfaces them.

AWS ECS container security: privileged containers, plaintext secrets & host networking

With EKS already covered, the scan now assesses ECS too — so a containerized AWS estate is checked whichever orchestrator it runs on.

GCP data lifecycle: secret rotation & Cloud SQL customer-managed keys

Two GCP checks so credentials don’t live forever and databases aren’t locked to Google-managed keys — both about who controls the key material and for how long.

AWS data-exposure hardening: SNS encryption & private container registries

Two AWS checks closing quiet data-exposure gaps — message topics that store data unencrypted, and container registries anyone on the internet can pull from.

Fix: “Deploy to Azure” button for the one-time assessment

The one-time assessment’s Deploy to Azure button failed with a template-download error. Beacon now serves the deployment template from its own public endpoint, so the button works again.

GCP workload hardening: least-privilege Cloud Run & node currency

Two GCP checks that keep the serverless and Kubernetes surface least-privileged and patched — so a compromised service can’t roam the project, and nodes don’t drift onto vulnerable versions.

Fix: one-time assessment now scores GCP correctly and reports honest coverage

Two integrity fixes to the one-time assessment tool so a signed report can be trusted end to end — a GCP assessment now actually evaluates its checks, and a scan that reached nothing no longer claims full confidence.

AWS internet-exposed workloads: edge WAF & public Lambda URLs

The public front door of your AWS apps is now assessed. The scan checks that internet-facing load balancers sit behind a WAF and that no Lambda function is invokable by anyone with no authentication.

AWS vulnerability & patch truth: live SSM and Inspector findings

Knowing a patch policy exists isn't the same as knowing a server is patched. The AWS scan now reads the real per-host patch state and live vulnerability findings, so “is anything actually exposed right now?” finally has an answer.

AWS EKS coverage: Kubernetes control-plane security checks

AWS containers were a blind spot — the scan had zero coverage of EKS. This release adds the three most breach-relevant Kubernetes control-plane checks so a containerized AWS estate no longer goes unassessed.

AWS detection efficacy: Security Hub standards & GuardDuty protections

Enabling a security service isn't the same as it detecting anything. The AWS scan now checks that Security Hub and GuardDuty are actually configured to evaluate your estate — not just switched on with an empty dashboard.

GCP identity takeover: federation trust & custom-role escalation checks

The GCP scan now looks for the two quiet paths into a project that the standard IAM baseline misses: federation trust anyone can walk through, and custom roles that let a holder promote themselves.

AWS ransomware recoverability: Backup Vault Lock checks

Backups only help if an attacker can't delete them. The AWS scan now checks that your AWS Backup vaults are locked (WORM) and keep recovery points long enough to survive a slow-burn intrusion — the control that separates “we restored” from “they wiped the backups too”.

AWS identity takeover: role-trust, privilege-escalation & CI/CD OIDC checks

The AWS scan now looks for the identity paths real breaches use, not just the CIS password-policy basics. Three new checks flag roles anyone can assume, policies that let a user quietly make themselves an admin, and CI/CD pipelines that any GitHub repository could hijack.

Assessment tool: framework benchmarks & adoption metrics (Phase 15)

Assessment results now speak the language your prospects care about. Every snapshot reports its pass rate against each mapped compliance framework, and a new metrics view shows how much the tool is actually being used.

Assessment tool: fleet run telemetry (Phase 14)

Running the assessment across a fleet no longer means flying blind. Each run can report its outcome back to Beacon, so an MSP sees central fleet health — "198 of 200 tenants assessed, 2 failed" — including failures, without scraping logs.

Assessment tool: asymmetric signing (Phase 13)

Results files can now carry a real anti-forgery signature. Sign with an Ed25519 private key and a Beacon verifies it with only the matching public key — so a valid signature proves who produced the file, not merely that someone knew a shared secret.

Assessment tool: live-client onboarding (Phase 12)

Promoting a snapshot can now hand you a live client, not just a frozen one. Attach a validated cloud connection at promote time and the new client keeps scanning immediately — closing the last mile from pre-sales assessment to a recurring monitored client.

Assessment tool: standalone AWS scanning (Phase 11)

The downloadable assessment tool now scans AWS, not just Azure — closing the gap between the cloud-aware data model and what the tool can actually do. Point it at an AWS account with --cloud aws and it runs the full AWS check load locally and produces the same importable results file.

Assessment tool: trusted distribution (Phase 10)

You can now audit and vouch for exactly what the assessment tool runs. Every build ships a machine-readable SBOM of the tool's dependencies, and results files can be cryptographically signed so a Beacon imports them as tamper-proof provenance rather than just tamper-evident.

Assessment tool: white-label reports & shareable snapshots (Phase 9)

The pre-sales onboarding bridge now goes the last mile. An assessment report can wear your own brand instead of Beacon's, and any snapshot can be shared as a read-only link a prospect opens without a login — so a one-time assessment becomes a client-ready deliverable.

Assessment tool: multi-cloud foundation (Phase 8)

The assessment pipeline is now cloud-aware end to end. Snapshots record which cloud they cover and the portal tags each one, so the model, import and UI are ready for AWS and GCP alongside Azure. The standalone tool scans Azure today; standalone AWS/GCP scanning is the next step.

Assessment tool: fleet-scale automation (Phase 7)

Running the assessment across a whole fleet no longer means driving it tenant by tenant. A single batch run covers many tenants and resumes where it left off if interrupted, results can be scheduled and consumed by automation, and the portal flags tenants that are overdue for a fresh assessment.

Assessment tool: secret & token lifecycle hardening (Phase 6)

The automation added for unattended imports is now safe to leave switched on. Ingest tokens can be listed and revoked (a leaked token can be killed instantly), the ingest endpoint is rate-limited, and the results file can be encrypted at rest so cleartext identifiers never touch disk.

Assessment tool: productization & ops hardening (Phase 5)

The final roadmap phase polishes the assessment tool for general availability and removes maintenance risk: exported reports carry the MSP's name, the docs report the real check count, the one-click deploy is no longer pinned to a single repo, and a CI guard stops the deploy template from drifting from its source.

Assessment tool: scale & automation (Phase 4)

The assessment tool moves from one-off to fleet-ready. A single run can now cover multiple Azure subscriptions, and results can flow straight into Beacon unattended — so the one-click Deploy-to-Azure container (or any scripted run) lands a snapshot with no manual download and upload.

Assessment tool: diff, trend & snapshot lifecycle (Phase 3)

Repeated assessments now tell a story. Compare any two assessments of the same tenant to see what was fixed, what's new, and how the score moved; watch a tenant's score trend across scans; and re-export a saved snapshot as a report or JSON without re-running the tool. Snapshots are also fully manageable — rename, delete-with-confirmation, and one-click export.

Assessment tool: onboarding bridge (Phase 2)

A one-time assessment no longer dead-ends as a read-only record. You can now turn a snapshot into a fully monitored client in one click, or import a results file straight into a new client — closing the gap between a pre-sales assessment and onboarding the client for real.

Assessment tool: integrity hardening (Phase 1)

The one-time assessment tool now stamps every results file with a tamper-evidence digest and the portal publishes a verifiable checksum for the downloaded tool. This is the first of five planned improvement phases, focused on the trust boundary: proving a results file wasn't altered before it reaches your data, and giving operators a switch to lock down the public download endpoint.

Assessment page: make it clear results are viewable without uploading

The one-time assessment tool already writes a self-contained HTML report you can open in a browser, but the Assessment page read as if importing into Beacon was the only way to see results. The page now leads with the local report, adds a callout explaining that opening report.html needs no account or upload, and relabels the import step as optional — for keeping the result in the portal or attaching it to a client.

One-time assessment tool: run the full Azure scan once from a client tenant, then import the results

A new way to assess a tenant without onboarding it or storing its credentials — built for prospect and pre-sales checks. Download a small command-line tool from the new Assessment page, run it inside the client's Azure environment, and it executes the same full compliance check load the Beacon scan engine runs — locally, talking straight to Microsoft Graph and Azure Resource Manager. It writes a self-contained results file that you import back into Beacon, either as a standalone snapshot (a frozen record that is not a monitored client and uses none of your client allowance) or attached to an existing client (applied to its live posture exactly like a scan). The tool supports interactive device-code sign-in as well as app-registration secret or certificate credentials, and by default the results file carries only per-check counts, not resource identifiers. Beacon always recomputes the compliance score server-side on import, never trusting the file's own number.

Sync one inventory source at a time

The per-client sources screen now lets you re-pull a single source on its own. Each source row has its own Sync button, so after fixing one connector's credentials you can refresh just that feed instead of re-running every other connector for the client. Only the row you clicked shows a spinner while it runs, and its feed health, last-success time and asset count refresh on completion. The whole-client refresh is still one click away — a Sync all sources button now lives in the screen header. Disabled or unconfigured sources have their per-row Sync button greyed out, and a source turned off for the client is still skipped rather than run.

Configurable, per-client inventory sources: connect connectors in-app and turn any source on or off

Lifecycle inventory sources are now a findable, per-client control panel instead of an API-only chore. Open Configure sources from the Lifecycle page, pick a client, and see every source that can feed its software inventory with its connection status, feed health and asset count. All eight connector sources — ServiceNow, Topdesk, NinjaOne, Datto, Automox, Action1, Jamf and SCCM — can now have their credentials entered in-app, per client (including the ServiceNow CMDB table and Topdesk template fields), so client A and client B can hold different credentials for the same connector. A per-client enable/disable toggle lets you skip a source on sync without deleting its credentials — a disabled source no longer counts as a failing feed — and every source stays enabled by default, so nothing changes for existing clients until you turn one off. Azure-derived sources (Intune, Defender, Azure VMs) link straight to the client's Azure connection for setup.

Honest by construction: a provenance firewall on the attestation, a coverage matrix, and opt-in ways to widen the net

The trust half of the full-landscape work. Every asset and fact now carries a source class — how it was obtained, not just which connector wrote it — and a one-directional provenance firewall makes the cyber-insurance attestation honest by construction: only instrumented, confident, matched data can populate a favourable answer, while declared, discovered, manual, community and low-confidence data are structurally barred from a favourable answer and appear only in the scope disclosure. A new coverage matrix (estate category × client) turns that same instrumented-vs-softer line into an at-a-glance grid of Instrumented / Partial / Declared-only / Blind chips, so a blind spot reads instantly instead of hiding inside a healthy total. And three opt-in, credential-gated reach extensions — shadow-SaaS discovery, a validated community catalog, and an on-prem collector-ingest seam — widen what Beacon can see without weakening any of that, because everything they surface is classified discovered or community and stays outside the firewall.

Manage everything: one device = one asset, a lifecycle stage for every item, and an actionable untracked bucket

The data-model half of the full-landscape work — turning "inventory Beacon happens to recognise" into "the whole estate, managed." The same device seen by many sources now collapses onto one managed asset via a deterministic identity ladder (cloud resource id → serial → Intune device id → Entra device id → MAC → hostname); strong identifiers auto-link, while ambiguous MAC/hostname-only overlaps are never auto-merged — they queue as possible duplicates for a human to confirm or split. Every discovered or untracked item is now a first-class managed asset — ownable, with a lifecycle stage (discovered → triaged → managed → renewing → retiring → retired) and a review/renewal date — so you can manage a thing on a calendar even with zero vendor EOL data, and stale items walk themselves toward retirement one step at a time. The untracked bucket gains a real Manage verb (promote, dismiss-as-noise, or clustered bulk triage), and the built-in collectors now report device identity more widely across Intune, Defender, Azure VMs, Jamf, SCCM and ServiceNow to feed the reconcile ladder.

Lifecycle catalog & enrichment: no-deploy catalog fixes, opt-in web/AI enrichment, hardware warranty lookups and opt-in live remediation

The enrichment wave for lifecycle management — all of it behind guardrails. The product catalog is now data-driven: a wrong match or a missing product is a 30-second console edit (an org-scoped, audited catalog alias), not a code deploy, and promoting an untracked item re-tags and re-scores every matching asset at once. An opt-in, admin-enabled AI-assisted normalizer can propose candidate mappings for the names Beacon doesn't recognise — it is off by default, never emits end-of-life dates itself, and only ever writes low-confidence candidates a trusted feed must still confirm. Vendor hardware warranty / EoX lookups (Dell, Lenovo, HP and Cisco) turn the hardware refresh card into real per-device dates once an operator provisions each vendor's API credentials — until then each resolver simply does nothing and dates fall back to the curated base. And a real live remediation mode arrives as an opt-in, consent-gated capability: it actually pushes a fix via Intune / NinjaOne / Automox, but stays fail-closed (write-consent and remediation opt-in required), preserves maker/checker approval and the full audit trail, and keeps simulate as the default.

Lifecycle from an operator's seat: an in-app report & attestation viewer, a searchable client picker, inline remediate and a calmer overview

A last-mile pass on the day-to-day of lifecycle management. The client report and the cyber-insurance attestation now open in a styled in-app viewer — no more raw API tabs — that you can print or save as PDF and hand straight to a client. The client selector is now type-ahead searchable, so you jump to the right client by name across a large portfolio and act on the one you're actually looking at. Closing an item out is lighter: marking it remediated is now a quick inline action with a short evidence note, separate from the heavyweight propose → approve → dispatch flow that remains for controlled, audited remediation. And the dense overview gets real hierarchy — a pinnable daily-glance metric strip, collapsible seasonal cards, a clickable Due this week tile, a month-grouped upcoming-EOL forecast, and an inline glossary that explains EOS vs EOL, KEV, EPSS and the risk score at the point of use.

Lifecycle at scale: bulk per-client config, sync progress, faster portfolio views and data retention & purge

The scale-to-30+ pass for lifecycle management. Onboarding a portfolio no longer means editing clients one at a time: business criticality and the end-of-life warning window can be set across a whole set of clients in a single action, with one batched recompute, and the warning window is now a first-class per-client field. A live sync-progress bar shows how far a multi-client sweep has got (done / total / failed) so you're not re-polling to guess whether it finished. Portfolio views stay flat as client counts grow — the by-product rollup is now computed in SQL and the coverage payload is paginated — and a nightly prune keeps snapshot history from growing unbounded. Alongside it, lifecycle gets a real data-hygiene story: configurable retention, automatic redaction of stale hardware device names (PII), and a per-client purge for offboarding and data-subject erasure requests.

Lifecycle coverage & honesty: the full end-of-life corpus, an untracked bucket, and an attestation that tells the truth

The coverage-and-liability pass for lifecycle management, and the biggest trust change to date. Beacon used to quietly track only a small curated catalogue and silently drop everything it didn't recognise. No longer. Software outside the curated set is now looked up against the full public endoflife.date corpus (hundreds of products), so far more of your estate resolves to real end-of-life dates — with each such match flagged low-confidence ("needs review") and held back from alerts, tickets and attestations until it's confirmed, so a fuzzy match can never silently drive a false alarm. Anything Beacon still can't match is never discarded: it lands in a first-class, countable untracked bucket you can promote to tracked or dismiss, so you always know the size of your blind spot. And the cyber-insurance attestation is now honest by construction — every answer is derived from actual state (answering "insufficient evidence" rather than a hardcoded "yes" when a fact can't be substantiated), and every attestation and client report carries a coverage / scope disclosure of what wasn't assessed and what still needs review.

Lifecycle at scale: trustworthy EOL dates, a rebillable business review, cyber-insurance attestation and hardware refresh tracking

The moat-and-scale tier for lifecycle management. End-of-life dates are now trustworthy: the daily refresh re-fetches upstream dates concurrently and passes each through a change-guard — an implausible upstream update (a date nulled out, a multi-year jump, an ended flag reversed) is rejected and flagged instead of silently rewriting the knowledge base and flipping crossings across every client. A related fix gives repeated EOL crossings a stable ticket reference, so a re-detected crossing updates its existing PSA ticket rather than opening a fresh duplicate on every sweep. The quarterly business review is now rebillable: the scheduled QBR draws the full lifecycle posture — risk-ranked items, estimated budget and the upcoming-EOL forecast — from the same source as the standalone client report, so it carries a costed upgrade story you can bill. A new cyber-insurance attestation export maps a client's live EOL posture (unsupported software, CISA KEV exposure, remediation-SLA adherence) to named renewal-questionnaire fields. And hardware refresh tracking arrives: where a source carries device identity (Intune), Beacon now forecasts device end-of-service-life so refreshes become a planned, billable event.

Lifecycle management, ready to adopt and sell: feed health, portfolio sync, safer triage, per-surface consent and plan packaging

An adoption-and-trust pass on lifecycle management. Every inventory feed now has persisted health: the coverage panel flags any source whose last sync failed or has gone stale (no success in three days) with how long ago it last succeeded, so a silently-dead Intune or RMM feed is visible instead of surfacing only when a report looks wrong — and a new Sync stale sources button re-pulls every affected client across the portfolio in one click. Triage is safer: completing an item now goes through the evidence-capturing remediation dialog only (no more one-click "Remediated" inline), suppressing actions (snooze / exception) confirm before they hide work, and every inline change offers a one-tap Undo. Automated dispatch methods are now disabled up front in the method picker when a client has no write-consent, rather than only failing at execute. Under the hood, tenant write-consent is now recorded per surface (ARM subscription vs. Graph tenant) instead of one blanket grant — existing grants are preserved unchanged — so a future automated slice can be authorized narrowly without re-consenting customers. Finally, lifecycle management is now packaged as a paid capability with a first-run onboarding panel; workspaces already using it keep their access.

The remediation queue comes alive: automatic SLA due dates, tunable & clearer risk, and two correctness fixes

A trust-and-correctness pass on lifecycle management. The biggest change: automatic SLA due dates. Due dates were only ever set by hand, so the remediation queue's SLA columns and the overdue escalation were empty for most assets. Turn on auto due dates in the new Lifecycle settings and Beacon assigns each actionable asset a due date from policy — exploited-and-unsupported soonest, then unsupported, then approaching-EOL on your important clients — with a preview of the blast radius before you enable it and a guarantee that a manually-set date is never overwritten. The risk score is now clearer and tunable: a KEV badge marks actively-exploited assets at a glance, the score is coloured consistently across the Lifecycle page and the remediation queue, and an org can adjust the weighting (exploitation vs. criticality vs. exposure vs. footprint) to match its risk appetite. Two correctness fixes ship alongside: the SLA-breach escalation no longer opens PSA tickets for decommissioned or snoozed assets, and the propose→approve→execute remediation state machine is now transaction-guarded against concurrent double-execution.

Client-facing lifecycle reports, a weekly end-of-life forecast digest & an audited (still fail-closed) automated-dispatch path

Three additions round out lifecycle management. First, a client-facing lifecycle report: pick a client on the Lifecycle page and generate a branded, print-friendly summary — current status mix, highest-risk items, what reaches end-of-life in the next 90 days, the open remediation workload and an estimated remediation budget — ready to share or fold into a QBR. Second, a weekly end-of-life forecast digest is pushed proactively to your Slack / Teams / email channels: what's about to lapse and what remediation work is already overdue, so upgrades get planned before anything breaks (it's a planning digest, so it never raises a PSA ticket). Third, automated remediation dispatch (Intune / NinjaOne / Automox / Action1 / Datto) gains a real, audited consent framework — but stays fail-closed: dispatch is refused unless the client has an explicit tenant write-consent grant and remediation opt-in, and even then Beacon runs in simulate mode by default, recording what it would do without ever writing to a customer tenant. The remediation dialog now shows exactly which guardrail is blocking.

The remediation queue: one cross-client work list with owners, due dates & SLA status

Lifecycle triage was per-client and per-asset; now there's a single Remediation queue — the portfolio cockpit an MSP lead runs their week from. It lists every outstanding end-of-life fix across all clients with its owner, due date and SLA state (on-track, due-soon, or overdue). Headline tiles count what's actionable, overdue, due this week, unassigned, and assigned to you, and each doubles as a one-click filter. You can filter to a specific engineer (or just your own work), toggle overdue-only, assign an owner and set a due date inline, and bulk-assign a whole selection at once. Due dates drive the same SLA-breach escalation that already opens PSA tickets, so nothing quietly slips.

Remediation you can drive end-to-end: propose → approve → record with evidence, PSA/ITSM ticket links, an explained risk score & a 7-day change feed

The remediation-control workflow is now fully in the portal. From any end-of-life asset you can propose a fix (with a generated runbook), approve it, and record it as done with evidence — all without Beacon ever writing to a customer tenant. Automated dispatch (Intune / NinjaOne / Automox / Action1 / Datto) stays fail-closed: the button is shown but the API refuses it with a clear reason until a per-tenant write-consent path exists, so nothing acts on a tenant behind your back. Each remediation can now be linked to a PSA/ITSM ticket (reference plus a click-through deep link), tying a Beacon-driven fix back to your own service desk. The risk score is now explained — hover any score to see exactly how end-of-life status, active exploitation (CISA KEV / EPSS), client criticality, exposure and install footprint add up — and you can filter the inventory by triage state. Finally, a “What changed (last 7 days)” feed on the Lifecycle page surfaces recent status transitions at a glance.

Lifecycle polish: end-of-life we no longer miss, and visible trust signals

Two follow-ups to the trusted-lifecycle work. First, boolean end-of-life recovery: some products are published as “already end-of-life” without a specific date — these previously showed as unknown and were quietly missed. They now correctly resolve to unsupported, so nothing that's actually dead slips through. Second, the trust signals are now visible on the Lifecycle page: rows whose product match is low-confidence carry a “review” badge (and stay out of alerting until you confirm them), and inventory that's been aged out because a source stopped reporting it carries a “stale” badge — so it's obvious at a glance which rows to trust.

Lifecycle you can trust and act on: vendor-gated matching, stale-asset aging, faster recompute, a push API & fail-closed remediation control

Following a cross-functional review, this release makes lifecycle management trustworthy and actionable. Product matching is now vendor-gated and confidence-scored, so look-alikes like “Windows Media Player” or “LibreOffice” are no longer mistaken for the Windows OS or Microsoft Office — and low-confidence matches are held back from alerting until reviewed, so the tool stops crying wolf. Assets a source stops reporting are aged out as stale and excluded from counts, risk and forecasts, so decommissioned machines don't inflate your posture. Under the hood the daily recompute is now incremental and memoized — a steady-state sweep writes almost nothing — so it scales with your portfolio. A new ingestion API lets an agent, script, or webhook push inventory directly. And remediation gains a control framework: propose an upgrade with a generated runbook, get it approved, and record the work with evidence — while automated dispatch to a customer tenant is fail-closed, so Beacon never writes to a tenant without an explicit consent path.

Lifecycle management becomes an MSP lifesaver: risk scoring, upgrade paths, remediation budgets, evidence trail, blind-spot detection & bulk actions

Lifecycle management moves from “tells you what's end-of-life” to “tells you what matters, what to do, and what it costs.” Every asset now carries a composite 0–100 risk score — folding end-of-life status, active exploitation (CISA KEV refined by FIRST.org EPSS probability), the client's business criticality, exposure and install footprint — so the portfolio sorts by what to fix first. Each unsupported item shows an upgrade path: the recommended target, one-line migration guidance, and an ESU-bridge hint where paid Extended Security Updates can buy time. On the commercial side, an estimated remediation budget (licence + labour + ESU) rolls up per client and a scoped, costed upgrade plan becomes the basis of a client proposal, while a daily evidence trail snapshot gives defensible history for audits and cyber-insurance. The tool is now honest about its blind spots — flagging clients with no inventory — and MSP-scale to operate: bulk triage actions, per-client policy (criticality & warning window), and automatic escalation of overdue remediations and expired snoozes.

Lifecycle management becomes autonomous: daily EOL sweeps, a 90-day forecast, a triage queue, six new inventory sources & exploit-aware alerts

Lifecycle management now runs itself. A daily background sweep refreshes end-of-life dates and re-checks every client, so software that crosses into unsupported purely because a date passed on the calendar is caught — and alerted — the same day, without waiting for that tenant's next scan. A new “Upcoming end-of-life” forecast shows what expires in the next 90 days so you can plan upgrades before anything breaks, and a per-item triage queue lets you acknowledge, plan an upgrade, snooze, mark remediated, or accept an exception (snoozed and exception items stop generating noise until they come due). Coverage expands well beyond Azure: Azure VM operating systems, endpoint RMM tools (NinjaOne, Datto RMM, Automox, Action1), Jamf Pro for Apple fleets, and SCCM/MECM for on-prem Windows now all feed the same view, and an authoritative Microsoft product-lifecycle source fills in dates the public data can't. Finally, when unsupported software also appears on CISA's Known Exploited Vulnerabilities list, its alert is escalated to critical — so what's actually dangerous rises to the top.

Lifecycle management goes set-and-forget: EOL alerts & auto-tickets, richer coverage, QBR reporting, sync-now

Lifecycle management now works for you in the background so a sysadmin never has to watch the page. When software crosses into unsupported (end-of-life) or starts approaching end-of-life, Beacon fires a summarised alert to every subscribed channel — Slack, Teams, email — and to your PSA, ServiceNow or Topdesk, opening a ticket in the queue you already work from. Alerts fire once, on the change itself, so there's no noise. Those transitions also land on the drift timeline and in the weekly portfolio digest, and every client's Quarterly Business Review now includes a Software Lifecycle section for client-facing conversations. Coverage got deeper too: applications with standard versioning (Node, Python, PHP, MySQL, .NET, PostgreSQL) now resolve to a real end-of-life status instead of “unknown”, and the ServiceNow table / Topdesk asset template are configurable for non-standard setups. Finally, a Sync now control refreshes a chosen client's inventory on demand instead of waiting for the next scan.

Topdesk completes the lifecycle inventory set — four connectors, one view

The fourth and final launch connector is here: Topdesk. If you've connected a Topdesk environment (the same channel Beacon uses to raise incidents), each Azure scan now reads its Asset Management software assets, aggregates them per product and version with an install count, and resolves each to an end-of-life status. That rounds out the lifecycle inventory set — Microsoft Intune, Microsoft Defender for Endpoint, ServiceNow and Topdesk now all feed the same Lifecycle view, each tagged by origin and every one fail-safe: a source with no permission, no configured channel, or no data simply contributes nothing and never affects the compliance scan. Between endpoint tooling (Intune, Defender) and your ITSM/CMDB systems of record (ServiceNow, Topdesk), Beacon can now build a genuinely complete picture of what software is running across a client's estate — and flag what's unsupported or about to be.

Lifecycle management reaches beyond Microsoft: ServiceNow CMDB inventory

Lifecycle tracking now draws on your ServiceNow CMDB as well. If you've connected a ServiceNow instance (the same channel Beacon uses to raise incidents), each Azure scan now reads its Software Asset Management inventory — one row per product and version, with an install count — and folds it into the lifecycle view alongside the Intune and Defender feeds, resolved against the same end-of-life knowledge base. This brings in software an MSP tracks in ServiceNow that endpoint tooling might miss, and it needs no new setup: Beacon reuses the existing ServiceNow channel's credentials and scope (a client-specific channel maps to that client; an org-wide channel applies across the org). Like every connector it's fail-safe — no ServiceNow channel, no Software Asset Management data, or an unreachable instance simply contributes nothing, and inventory stays tagged by source so you can filter to just ServiceNow on the Lifecycle page.

Lifecycle management adds a second inventory source: Microsoft Defender for Endpoint

Hot on the heels of the Intune connector, lifecycle management now also draws on Microsoft Defender for Endpoint. During each Azure scan, Beacon queries Defender's vulnerability-management software inventory and folds every device's operating systems and applications — with versions and device counts — into the same lifecycle view, resolved against the end-of-life knowledge base. Defender's coverage often reaches software Intune's app inventory doesn't, so the two together give a fuller picture of what's actually installed across a client's estate. Like every connector it's fail-safe and needs no new plumbing beyond the Defender API permission: if a tenant isn't onboarded to Defender or hasn't granted the permission, that source simply contributes nothing and the scan is unaffected. Inventory from both sources is tagged by origin, so you can still filter to just Intune or just Defender on the Lifecycle page.

Lifecycle management goes live with Intune: automatic OS & app inventory, EOL status per device fleet

Lifecycle management now populates itself. The first inventory connector — Microsoft Intune — is live: during each Azure scan, Beacon reads your Intune-enrolled devices and their detected applications straight from Microsoft Graph (reusing the scan's existing token, so there's nothing new to configure), then resolves every Windows build and app version against the lifecycle knowledge base. Your Lifecycle page fills with real data: Windows 10 / 11 feature updates mapped to their end-of-servicing dates and aggregated by version (a fleet of 40 machines on one build shows as a single row with a count), plus browsers, Office, runtimes and databases tracked from the same feed. If the Intune permission isn't granted or a tenant isn't enrolled, the scan is unaffected — inventory simply stays empty. Manual and CSV entry still work alongside it, and the remaining connectors (Graph, Defender, ServiceNow, Topdesk) drop into the same inventory as they come online.

One-click remediation, hardened end to end: in-product write access, honest availability, and self-healing hand-offs

This release finishes hardening one-click remediation from onboarding through to cleanup. Granting and testing the separate, least-privilege “write” Entra app now happens entirely in-product: a client's In-product remediation execution card leads with a write-access readiness checklist and two new actions, Grant write access (a one-click, tenant-scoped admin-consent flow that stores only a consent timestamp, never a secret, and refuses a consented tenant that doesn't match the connection) and Test write access (a real per-scope ARM/Graph probe with a green/red result and a fix hint). On top of that, every finding's “1-click fix” badge and Run-fix availability now come from the same seven guardrails the executor itself enforces — catalog, executor flag, write app, write consent, opt-in, hand-off-only, category — so the UI never promises a fix it can't deliver, and a new Remediation coverage card on each client shows the same breakdown at a glance: how much of what's open is one-click fixable, and exactly why the rest isn't. Approvals now have real teeth too: a 30-minute approval window is auto-expired by an hourly sweep, abandoned drafts auto-cancel after two weeks, and a hand-off closes itself the moment a later scan confirms its finding is actually resolved — no more manually auditing tickets nobody remembered to close. Hand-off delivery now reaches notification channels as well as webhooks, refuses to dispatch into the void when nothing is subscribed, and ships three new operational events. Underneath all of it, every remediation action endpoint is now defined spec-first in the OpenAPI spec with generated, typed clients.

Lifecycle management: track End-of-Life and End-of-Support software across your clients

A new Lifecycle area, alongside Posture, that answers a question MSPs kept asking: “which of my clients are running software that is unsupported, or about to be?” Beacon now tracks the operating systems, applications, databases and runtimes installed in each tenant and matches every version against published vendor lifecycle dates, flagging anything unsupported (End-of-Life passed — no more security updates) or approaching End-of-Life (within 180 days, or already past mainstream support). The portfolio view rolls up the whole estate — how many assets are unsupported, how many clients are at risk, and which products need attention first — with a filterable inventory beneath it. Inventory is source-agnostic: it’s designed to be fed by Intune, Microsoft Graph, Defender, ServiceNow and Topdesk, with manual and CSV entry available today. End-of-Life dates come from a curated dataset of high-value products (Windows, Windows Server, SQL Server, Exchange and more) automatically topped up from the public endoflife.date dataset.

Fixed garbled arrows and dashes in remediation steps

The step-by-step remediation guidance shown in a finding's detail foldout had garbled characters — arrows (→) and dashes rendered as sequences like → because the underlying playbook text had been double-encoded (UTF-8 mistakenly interpreted as Windows-1252). Every affected checklist step now shows the intended arrows, en-dashes and em-dashes. No wording changed, only the corrupted characters were repaired.

Portfolio drift fixes, a collapsible per-check roll-up, and a clearer privacy toggle

A round of polish across the Posture and client views. The Posture › Drift portfolio timeline now shows real cross-client regression and resolution history in the demo instead of appearing empty. On a client's Findings tab the per-check “Remediation readiness” roll-up is now collapsed by default — it's a summary, so the actionable findings list (where you assign, acknowledge and suppress individual issues) reads first. The per-client data-minimisation toggle now explains itself when a client has no connected tenant yet instead of sitting silently greyed out, and the “Beta / Test mode” banner is now limited to demo accounts so real accounts aren't told their changes won't stick.

Data-minimisation for findings, email-auth domain checks, and an auto-fix permissions guide

A privacy-first release. Beacon now defaults to not storing the specific identities behind a finding: after a scan it records an aggregate — "3 users have MFA disabled" — plus a pointer to the remediation script to enumerate them yourself, keeping customer user lists out of Beacon's database. An admin can opt in per client to store and display the actual identities, and turning the option back off scrubs anything already stored. The domain scanner gains an email-authentication category (SPF, DMARC, DKIM, MTA-STS) — the records that stop attackers spoofing a domain in phishing — and there's a new documentation page laying out exactly which Azure permissions an admin grants to enable in-product auto-fix.

Opt-in one-click remediation, plus weekly portfolio digests and attestation reminders

Beacon stays read-only by default, but an org admin can now enable in-product remediation per client: choose which categories are eligible and let an approved fix be applied directly to the tenant instead of only handed off as a ticket. Safety is layered — a fix is written only when the per-client opt-in is on, the category is enabled, the platform executor is provisioned, and an admin has explicitly previewed and approved that exact change. There is no automatic remediation. After a fix Beacon re-verifies the control and only resolves the finding if it confirms closure. Separately, the weekly portfolio digest now actually sends — a once-a-week summary to the org owner of score movement, SLA breaches, and manual attestations due for review.

Fewer top-level destinations: Benchmarking, Checks and alerting settings consolidated

A follow-up navigation cleanup. Peer Benchmarking now lives as a tab inside Posture instead of a separate sidebar entry; the built-in check Catalog and your Custom checks are now two tabs of one Checks workspace rather than a top-level page and a buried settings page; and the three alerting settings — Notification channels, Webhooks and PSA escalation — now share one tab strip so "where do signals go?" is answered in a single place. No routes changed, so existing links and bookmarks keep working.

Unified posture navigation, portfolio drift, and closing the remediation loop

A focused release on usability and on connecting compliance signals end-to-end. The cross-portfolio views — Compliance, Findings, Coverage and Frameworks — now live under one Posture entry with a tab strip instead of four separate sidebar links, and every system setting is reached through a single Settings hub rather than a long list. On top of that consolidation we added a portfolio-wide Drift timeline of every regression and resolution across your clients, a two-way PSA ticket round-trip that resolves a finding when its ticket is closed, pinned-and-verified framework versions, an attestation re-review banner that catches stale manual evidence before an audit does, and a one-click re-verify with scan on any finding.

Cleaner cross-origin rejection on the API

The API now rejects requests from a disallowed browser origin cleanly instead of returning a server error. Previously a cross-origin pre-flight from an origin outside the allow-list produced an HTTP 500; it now returns a normal response with no cross-origin grant, so the browser blocks the request as intended. There was never any change to which origins are allowed and no data was ever exposed — this removes confusing 500s from monitoring and makes the rejection behaviour correct. Surfaced during an internal security review.

A clearer, accurate security page

The public security page now explains exactly how Beacon protects your clients across all three clouds, not just Azure. It documents the read-only connection model for each provider — an Azure App Registration or admin-consented multi-tenant app, an AWS cross-account role assumed on demand with an external ID, and a Viewer grant on Beacon’s GCP scanner service account — and makes clear that AWS, GCP, and Azure admin-consent connections store no long-lived key at all. The Azure permission list now matches what the onboarding wizard actually requests and verifies, and the page now covers single-use recovery codes and SAML single sign-on. No product behaviour changed; this is a documentation accuracy update.

Security hardening

A round of defensive fixes from a full internal security review and authenticated penetration test. SLA resolution targets are now strictly per-organisation, so one tenant’s settings can never affect another’s; remediation analytics now honour team-level client permissions; role management can no longer act on a higher-ranked account or remove an organisation’s last super-admin; SAML logins are single-use to prevent assertion replay; and the two-factor login challenge is rate-limited per account. No action is required and there is no user-visible behaviour change for normal use.

Real-time status monitoring

The public status page is now backed by live monitoring instead of static figures. A background sampler records the health of each Beacon service every few minutes, so the 90-day uptime bars are computed from real data, and incidents are opened automatically when a service fails repeated health checks and resolved when it recovers. Platform operators can also publish and annotate incidents from the admin console, replacing an auto-detected outage with a human-written narrative.

Faster portfolio & a fuller evaluation experience

The client portfolio page now loads noticeably faster: its three backing queries run concurrently and are backed by new composite indexes, so the most-visited screen in the portal stays snappy as your book of clients and their finding history grows. The read-only evaluation environment is also richer — it now ships with sample teams and roles, notification channels, webhooks, scheduled reports, API tokens, a risk register, in-flight remediations, and findings spread across their full lifecycle, so every area of the product has real data to explore. We also tidied a few rough edges around remediation and billing messaging.

Self-hosted licensing: connected & air-gapped modes

Self-hosted installs now choose how entitlements are enforced. Connected mode (the new default) periodically fetches a short-lived, signed license lease from Beacon over HTTPS, so plan changes and revocations take effect within a configurable grace window — while a generous grace period keeps you running through any Beacon or network outage. Air-gapped mode keeps the fully offline signed-license-file model for environments that cannot allow egress, now hardened with a baked-in verification key and a clock-rollback guard. The verification key is baked into the release image and the on-prem build fails closed, so enforcement can’t be disabled by changing environment variables. SaaS customers are unaffected.

Security hardening

A round of defensive security improvements from an internal review. Self-hosted entitlements are now enforced end-to-end against the signed license — paid features, tenant caps, and seat caps all honour the license claims rather than local state, and the background scan engine pauses when no usable license is installed. We added another layer of sanitization to the values interpolated into generated remediation scripts, tightened verification of two-way Slack/Teams acknowledge actions so they are bound to the originating client and expire, and updated a front-end dependency to pick up an upstream security fix. No action is required and there is no user-visible behaviour change for SaaS customers.

Self-hosted — run Beacon in your own environment

Beacon can now be deployed entirely inside your own boundary — your datacenter, or your own AWS, GCP, or Azure account — instead of on the Beacon SaaS. Self-hosted runs the same compliance engine and the same portal, but you operate the runtime stack and your clients’ compliance data never leaves infrastructure you control, which makes data-residency and sovereignty requirements straightforward to satisfy. The whole stack stands up from pre-built, signed container images by registry pull or an air-gapped tarball bundle; entitlements are enforced offline by a signed license file with no phone-home; and your admins can check for and apply updates from inside the portal under System → Updates — backup, migrate, recreate, health-check, and automatic rollback on failure — with the CLI path always available too. Per-cloud deployment guides cover AWS, GCP, and Azure, for a simple single VM or a managed Postgres + Redis topology. A new Self-hosted page and a Self-hosted deployment doc cover the details.

Approvals queue: finish what “Fix all” starts

A batch “Fix all” only proposes remediations — nothing hands off or runs until an admin approves it. Until now those proposals had nowhere to be approved: the Remediation Dashboard was read-only, so a queued action just sat there. This release adds a Pending approvals queue to the top of the Remediation Dashboard that lists every proposed action across your clients, with per-row Approve & hand off and an Approve all button to clear the backlog at once. Approving dispatches the change to your own automation — Beacon still never writes to the tenant. The “Fix all” success dialog now points here.

One-click fix, moved to where you actually work

The batch “Fix all” one-click remediation used to be tucked away in a client’s Settings → Remediation tab — an odd place to go to fix something — it didn’t show you what it was about to run, and after queuing it left you with nothing but a toast. This release fixes all three. Fix All now lives in the Findings tab (under a Remediation Readiness summary) and in the compliance check detail drawer, right where you triage. Before queuing, a dialog shows a command summary plus a per-resource foldout so you can see the exact command for each affected resource. And once actions are queued, a clear next-steps panel explains that each one needs admin approval and links you straight to the Remediation Dashboard to approve and track them.

Wave 13 — Evidence Vault, fleet scan-health, entitlements & hardening

A big release that turns your scan history into a saleable audit deliverable and gives operators the controls to run the fleet. The new Continuous Evidence Vault captures every check result as a timestamped record and assembles per-framework evidence packs you can share with an auditor or cyber-insurer through a scoped, read-only link — no login required. Behind the scenes, operators get a Fleet Scan-Health board that surfaces stale and failing scans across every tenant, and an Entitlements & feature-flag console to grant add-ons, issue comp/trial access and roll features out safely. This release also folds in correctness and security fixes from the latest full code review.

Security hardening across secrets, integrations & access

A focused hardening pass from an adversarial code review. Webhook signing secrets are now encrypted at rest alongside every other stored credential; state-changing requests get an added same-origin (CSRF) check on top of the existing SameSite session cookie; the domain scanner and outbound PSA/SMTP integrations now refuse to connect to internal/private addresses (SSRF protection); generated remediation scripts neutralise resource names so a hostile value in a monitored tenant can’t inject commands into a downloaded script; and global check suppressions are now strictly scoped to your own organisation so they can never affect another MSP. Invite links were also fixed — they now work reliably and always use your configured portal URL.

Fix: blank screen for platform operators in the compliance portal

This was the real cause behind the “blank screen after the demo” reports. When a Beacon platform-operator account (used for the Admin Portal) was also signed in on the compliance portal — for example via the shared sign-in across the admin and compliance subdomains — the portal bounced that session endlessly between the home and dashboard routes, which React aborts with a “maximum update depth” error and a blank page. The compliance portal now detects a platform-operator session and shows a single, stable screen with a link to the Admin Portal and a sign-out button, instead of looping. Normal MSP logins and audited support sessions are unaffected.

Fix: dashboard no longer crashes on an unreadable timestamp

A follow-up to the demo-to-real-account fix. The dashboard’s recent-activity feed formatted timestamps without guarding against a missing or malformed date, which could throw and blank the page. Dates that can’t be read now fall back gracefully instead of crashing the view, and when an unexpected error does occur the recovery screen now shows the underlying technical details so it can be diagnosed at a glance.

Fix: blank screen after switching from the demo to a real account

After exploring the read-only demo, signing into a real compliance-portal account could land you on an empty white screen. The demo session’s cached data was carried over into the account you were signing into, pushing the portal into a broken render — and with no safety net around it, that failure blanked the whole page instead of showing anything you could act on. Signing in now starts from a clean slate: all of the previous session’s data is cleared before the new account loads, the portal recovers gracefully from any unexpected render error with a one-click reload, and logging out fully removes the demo session cookie.

One-Click Fix Rollback

Wave 12 deepens remediation safety without adding any new checks — the Azure check count stays at 133. Admins can now revert an applied one-click remediation: because Beacon captures the resource's pre-fix state when a fix runs, a single “Revert this fix” action restores the previous configuration. Revert is admin-only and available only for fixes that ran in-product. Every revert is fully audited — a remediation.reverted event records the actor and the exact fields restored — and shows up in the Remediation Activity view as a distinct “Reverted” outcome.

CIS Azure Benchmark & Deeper Framework Mappings

Wave 11 deepens framework coverage without adding any new checks — the Azure check count stays at 133. Beacon's Azure checks are now mapped to the CIS Microsoft Azure Foundations Benchmark with L1/L2 profiles, and ISO 27001:2022 and SOC 2 coverage was deepened so that every Azure check now aligns with at least one framework control. Each check's detail page now shows the CIS Azure / NIST CSF / ISO 27001 / SOC 2 controls it aligns with, and the Frameworks UI surfaces CIS Azure first-class with its control families and profiles. These are mappings that indicate alignment, not certification.

Remediation Depth — Preview Diffs, More One-Click Fixes & Coverage Scoring

Wave 10 deepens remediation without adding new checks. More previously handoff-only checks are now one-click fixable, the remediation panel shows an exact before→after diff of the change before you apply it plus a post-fix verification readout confirming Beacon re-checked the resource, and a new per-domain Coverage Scorecard surfaces each domain's pass/fail counts, a risk-weighted score, and how many failures are one-click fixable.

Complete Audit & Remediate CLI Snippets for Azure Playbooks

Every Azure remediation playbook now ships with both an audit (detection) and a remediate CLI snippet, so engineers can confirm a misconfiguration and fix it without leaving the finding. Added audit snippets to five database/messaging playbooks, added remediate snippets (including recreate/migrate procedures where an in-place change isn't possible) to 33 playbooks across Microsoft 365, Azure AI, and Azure platform services, and authored a new playbook for the DDoS Protection Standard check (AZ-042). This brings the Azure playbook-coverage quality gate fully green.

Messaging, Container Apps & Storage Hardening

Wave 9 extends coverage to Event Hubs, Container Apps, Key Vault, Storage, and Azure Bastion with 10 new checks, adds one-click TLS and replication hardening fixes, and lets you export the full Check Catalog to CSV for reporting and engagement scoping.

Platform Service Hardening & Remediation Activity

Wave 8 extends coverage to API Management, Cognitive/AI Services, Storage hardening, Azure Firewall, App Configuration, and Azure Cache for Redis with 10 new checks, adds one-click fixes for the most common public-exposure misconfigurations, and introduces a Remediation Activity view that shows the history of one-click fixes (applied, skipped, or failed) at a glance.

Completed Remediation Guidance for Azure Database & Messaging Checks

Filled in missing remediation guidance for five Azure checks so every check now ships with complete, actionable guidance. AZ-061 (MySQL SSL enforcement) gained a risk reference; AZ-062 (PostgreSQL public access), AZ-066 (Cosmos DB CMK), AZ-068 (Service Bus network restriction), and AZ-069 (Event Grid network restriction) gained audit/remediate CLI snippets, and AZ-068/AZ-069 also gained a risk reference. This restores the guidance-coverage quality gate to green.

AWS Scan Coverage — Wave 3

The third wave of AWS expansion adds 16 new built-in checks, taking AWS from 59 to 75 — bringing Security Hub, Elastic Load Balancing, Lambda, EFS, Secrets Manager, DynamoDB, SNS, SQS, ECR, and ACM into scope for the first time. New checks confirm Security Hub is enabled with no active critical/high findings, flag load balancers with plaintext HTTP listeners or weak TLS policies and ALBs without access logging, surface publicly-invokable Lambda functions and functions on deprecated runtimes, and check encryption at rest for EFS, Secrets Manager, and DynamoDB. They also flag secrets without rotation, DynamoDB tables without point-in-time recovery, public SNS topics and public/unencrypted SQS queues, ECR repositories lacking scan-on-push or immutable tags, and ACM certificates that are expired or expiring within 30 days. Every new check ships with full remediation guidance, audit/remediate AWS CLI snippets, and framework mappings (CIS, NIST, SOC 2).

GCP Scan Coverage — Wave 3

The third wave of GCP expansion adds 12 new built-in checks, taking GCP from 63 to 75 — bringing Artifact Registry into scope for the first time and deepening coverage of encryption, ingress isolation, and Kubernetes posture. New checks flag public Artifact Registry repositories and those lacking customer-managed keys (CMEK), datasets / topics / repositories missing default CMEK, Cloud Storage buckets with no lifecycle or retention policy, Cloud Run services and Cloud Functions that allow unrestricted ingress, GKE clusters without Binary Authorization or with logging / monitoring disabled, firewall rules permitting unrestricted egress to 0.0.0.0/0, Cloud DNS zones still signing with the weak RSASHA1 algorithm, and default service accounts holding Owner / Editor. Every new check ships with full remediation guidance, audit/remediate gcloud snippets, and framework mappings (CIS, NIST, SOC 2).

Edge, Analytics & Observability Coverage

Wave 7 extends coverage to Azure Front Door WAF, VPN gateways, Synapse Analytics, Application Insights, and Log Analytics with 10 new checks, adds one-click fixes for the most common observability misconfigurations, and ships a new Check Catalog page that makes the entire built-in coverage surface searchable in one place.

AWS & GCP Scan Coverage — Wave 2

The second wave of multi-cloud expansion adds 22 new built-in checks — taking AWS from 50 to 59 and GCP from 50 to 63. On AWS it surfaces active IAM Access Analyzer findings, flags security groups exposing sensitive service ports (Elasticsearch, Redis, MongoDB, Memcached, Kibana), and adds AMI snapshot encryption, default-VPC removal, RDS auto minor-upgrade, S3 MFA Delete, CloudTrail S3 data-event logging, AWS Config global-resource recording, and GuardDuty S3 protection. On GCP it deepens Kubernetes (GKE) hardening (network policy, master authorized networks, shielded nodes) and brings serverless and messaging services into scope for the first time — Cloud Run, Cloud Functions, Pub/Sub, and Secret Manager — alongside new checks for weak TLS on SSL policies, Cloud SQL logging flags, public BigQuery datasets, persistent-disk CMEK encryption, Essential Contacts, and full audit-logging configuration. Every new check ships with full remediation guidance, audit/remediate CLI snippets, and framework mappings (CIS, NIST, SOC 2).

Container & Edge Security with Finding Correlation

Wave 6 extends coverage to container registries, Logic Apps, Data Factory, and Application Gateway WAF with 10 new checks, adds one-click fixes for the most common container-registry misconfigurations, and introduces a Finding Correlation view that clusters the same issue across many clients and resources so MSPs can tackle systemic risk in one place.

Expanded AWS & GCP Scan Coverage

Twenty new security checks broaden multi-cloud coverage, taking both AWS and GCP from 40 to 50 built-in checks each as the first wave of an expansion toward ~75 per platform. The new AWS checks harden IAM password policy (reuse prevention, maximum age, no inline user policies), close common data-exposure paths (no security group open on all ports, EBS snapshot encryption, no publicly shared RDS snapshots, no public KMS key policy, S3 Object Ownership enforced), and improve operability (RDS Multi-AZ, CloudWatch log-group retention). The new GCP checks add Kubernetes (GKE) posture for the first time — legacy ABAC disabled, private nodes, and Workload Identity — plus project-level public IAM detection, all-port and unlogged firewall rule checks, least-privilege Compute service-account and API-scope checks, GCS public access prevention, and Cloud SQL point-in-time recovery. Every new check ships with full remediation guidance, audit/remediate CLI snippets, and framework mappings (CIS, NIST, SOC 2).

Database Hardening & Batch Remediation

Wave 5 expands coverage to Azure database and integration services (PostgreSQL, MySQL, SQL Managed Instance, Cosmos DB, Service Bus, Event Grid) with 10 new checks, promotes key data-protection checks to one-click auto-fix, and adds batch remediation to streamline fixing the same issue across many resources at once.

Compute Security, Real-time Alerting & Dashboard Intelligence

Wave 4 expands Beacon's scan coverage to AKS and Azure Functions, adds real-time Slack and Teams notifications for new critical findings, and surfaces at-risk clients directly on the main dashboard.

Network Hardening, QBR Reports & Client Portal Download

Eleven new security checks extend coverage into Azure network security and Microsoft Defender for Cloud plan activation, bringing the built-in check catalogue to 71. NSG exposure checks flag RDP and SSH rules open to the internet; private endpoint enforcement now covers Storage, SQL Server, and Key Vault; DDoS Protection Standard and Network Watcher deployment are checked per subscription; and four Defender for Cloud plan activation checks ensure Servers, Containers, Storage, and Key Vault are protected. Ten new one-click fixes let MSP engineers auto-restrict permissive NSG rules, disable public network access on key services, and enable Network Watcher and Defender plans directly from the findings view. Quarterly Business Review reports are now schedulable from the Scheduled Reports settings page, producing a branded executive HTML document with compliance score trend, top findings, remediation progress, and MSP recommendations — available on Professional and Enterprise plans. Clients can now download their compliance report directly from the branded portal without requiring MSP admin involvement.

PaaS & AI Security Scans, Identity Fixes, and Peer Benchmarking

Twelve new security checks extend coverage into PaaS data stores and Azure AI services — Cosmos DB, Container Registry, Data Lake, Redis Cache, SQL Managed Instance, Azure OpenAI, and Azure AI services — bringing the built-in check catalogue to 60. Four new identity one-click fixes let admins restrict user consent, block default role permissions, prevent app registration by end-users, and limit guest access, all from the finding drawer. A new Peer Benchmarking dashboard shows how your managed tenants rank against anonymised peers, with a percentile score, score distribution chart, and a check gap analysis highlighting where clients trail the median.

Email Security Scans, One-Click Fixes, and Scheduled Reports

Seven new Microsoft 365 checks cover the email security controls most commonly exploited in business email compromise — anti-phishing, Safe Links, Safe Attachments, anti-malware, external auto-forwarding, mailbox auditing, and modern authentication for Exchange Online. Six Azure checks are now one-click fixable directly from the finding (Storage HTTPS & TLS, App Service HTTPS, TLS & FTP hardening, container soft-delete). A new Scheduled Reports hub lets you view, create, edit, and delete all report schedules across your client fleet from a single page. Navigation is faster thanks to TanStack Query caching that eliminates round-trips on route switches.

See at a glance which checks can be auto-fixed

Checks that Remediation Edit Mode can fix in one click now carry a small 1-click fix badge in the check list and on the check detail page, so admins can immediately spot what supports automated remediation. The fix still runs only after explicit admin approval.

Production hardening: real one-click fixes, smarter alerts, sturdier reports, and a clearer setup

A hardening release that takes the v1.40 features from "works" to "production-ready." Remediation Edit Mode can now actually execute a curated set of safe fixes (still opt-in, still behind admin approval); chat & drift alerts gained noise controls; the weekly digest and QBR reports are now restart-safe; the Azure connection wizard shows per-permission pass/fail; and the settings area was reorganised around a single hub.

Updated plan pricing

As Beacon's coverage has grown — multicloud scanning, optional one-click remediation, drift alerting, QBR reports and more — we've refreshed our plan pricing to match. Solo stays at $19/mo; the paid tiers move to Starter $59, Growth $129 and Pro $249 per month, with two months free on annual billing. Every plan still includes every check and continuous 6-hour scans, and a manual quarterly audit across the same tenants still costs far more in engineer time.

A major release: optional one-click remediation, drift alerting, QBR reports, Secure Score, benchmarking and a smoother first run

The biggest Beacon update yet. You can now opt a client into Remediation Edit Mode to see — and, when you're ready, run — the exact PowerShell that fixes a finding, always behind an explicit admin approval. Every scan now records what changed since the last one and alerts you on regressions, and you can acknowledge or assign findings straight from Slack and Teams. There's a new branded Quarterly Business Review report to hand your clients, portfolio benchmarking and a best-ROI fix list, a first-class Microsoft Secure Score view, reusable Conditional Access baseline templates, and a much friendlier first run — a guided setup checklist and a copy-paste Azure onboarding script. Pricing is now public, and there's a public checks catalog.

Fix: the client switcher rail now stays attached to the sidebar

On a client's detail page, the collapsible Clients switcher rail (with its search box and client list) is anchored flush against the main navigation sidebar. Previously, on wide desktop screens the page content was centred within a fixed maximum width, which left the rail floating in the middle of the screen, visibly detached from the nav. The client-detail page now renders edge-to-edge so the rail sits where you'd expect it.

Fix: dashboard open-issue total now matches your clients

The dashboard's Open Issues total was still counting failing/warning compliance checks, so it disagreed with the per-client counts (which now report active findings). It now counts the same open, acknowledged and in-progress findings across all your clients, so the headline number reconciles with what each client shows.

Fixes: accurate open-issue counts, provider-relevant frameworks, and a working cross-client list

Three fixes to how findings and frameworks are surfaced. A client's Open Issues count now reflects the same open, acknowledged and in-progress findings you see on the Findings tab, instead of a separate failing-check tally that could disagree. The per-client Frameworks tab now only shows frameworks relevant to that client's cloud — an Azure tenant no longer lists CIS AWS or CIS GCP coverage. And the Cross-Client Findings list now populates correctly.

Domain scanner: check your clients' public domains against internet standards

Beacon now scans the public domains you manage for each client — an internet.nl-style website scan that runs alongside the cloud compliance scan. Open a client and switch to the new Domains tab (its tenant domain is added automatically, unless it's a Microsoft-managed onmicrosoft.com domain), then add your real public domains. Each scan grades the domain across eight categories and gives it a 0–100 hygiene score; any failing required test becomes a tracked finding that picks up SLA timers, PSA tickets and webhooks exactly like a cloud finding. Domains re-scan daily by default, and Scan now runs an on-demand check at any time.

Notification channels: scope any integration to one client or your whole MSP

Every notification channel — Slack, Teams, email, PSA, ServiceNow, and TOPdesk — now has a scope. Leave it MSP-wide (the default) and it fires for every client in your organisation, exactly as before; or point it at a single client so only that client's alerts land there. That makes it easy to route one customer's incidents into their own ServiceNow or TOPdesk while everything else flows to your shared ops channel. When both a client-scoped channel and an MSP-wide channel of the same type exist, the client-scoped one wins for that client.

TOPdesk: open an incident automatically the moment a finding appears

Hot on the heels of the ServiceNow integration, Beacon now wires straight into TOPdesk too. Add a TOPdesk notification channel under Settings → Notification channels, point it at your environment, and Beacon opens an incident automatically for every net-new finding at or above a severity threshold you choose. Authenticate with an operator username and a TOPdesk application password; for partners hosting multiple clients, set the branch so each incident routes to the right organisation. Beacon stamps a stable externalNumber for traceability and raises each finding at most once.

ServiceNow: open an incident automatically the moment a finding appears

Teams that run on ServiceNow can now wire Beacon straight into their incident queue. Add a new ServiceNow notification channel under Settings → Notification channels, point it at your instance, and Beacon opens an ITSM incident automatically for every net-new finding at or above a severity threshold you choose. Authenticate with a dedicated integration user (HTTP Basic) or OAuth 2.0; Beacon maps the finding severity to the incident's impact and urgency, stamps a correlation_id for traceability, and raises each finding at most once. Optional assignment group and category route incidents to the right queue.

Client portal: a score trend graph and a "closed in the last 30 days" headline

The shareable Client Compliance Portal now tells a story over time, not just a snapshot. We've added an interactive compliance-score trend graph your clients can switch between 30-, 90-, and 365-day ranges, so they can see progress at a glance. We've also surfaced a clear "issues closed in the last 30 days" headline next to the active findings, making the remediation work you've done for them impossible to miss. Both appear automatically — the resolved-activity stat respects the same "show resolved activity" toggle you already control per client.

A calmer client page: grouped tabs, fewer buttons, no more sideways scrolling

The client detail page had grown to a single row of up to fifteen tabs — long enough to force a horizontal scrollbar — and a header crowded with separate buttons. We've reorganised it around the jobs you actually do. The tabs are now grouped into a handful of top-level sections (Overview, Findings, Trends, Reports, and an admin-only Settings), each revealing its sub-views beneath the bar, so the navigation wraps cleanly instead of scrolling off-screen. The header keeps the most-used action visible and tucks the rest — Report, Risk register, Edit, and Delete — into a single ⋯ More actions menu, with Delete safely set apart. Each finding card gets the same treatment: its row of buttons collapses into one overflow menu, and the finding title is now click-to-open.

Frameworks, reorganised: a portfolio overview, per-client controls on the client, and a full control-detail panel

We've split frameworks into the two jobs they actually serve. The Frameworks page is now a clean MSP-wide overview — ranking clients laggards-first per framework with the improving/regressing trend — while the day-to-day work of reviewing a single client's controls now lives right on that client, under a new Frameworks tab. Most importantly, every control now opens a detail panel with the same depth as a regular check: the business risk of not meeting it, how to verify it, links to the underlying Beacon checks (for automated controls) or the framework's own documentation, and — for manual controls — the place to record evidence. No more guessing what a bare control ID means.

Framework manual checks get second-line sign-off and one-click auditor evidence packs

Two additions that make framework evidence audit-ready. First, separation of duties: a recorded manual check now starts as pending review and must be signed off by a different person — you can never approve your own check, and editing a record sends it back for re-review. Approvals and rejections (with the reviewer and an optional note) are written to the tamper-evident audit log. Second, a one-click auditor evidence pack: with a client selected, export any framework to a single CSV (or JSON) listing every control with its status, mapped check IDs, and — for manual controls — the full record: proof note, proof links, date checked, re-review date, who recorded it, and the review sign-off.

Frameworks, upgraded: richer manual checks, an MSP portfolio overview, and an audit trail

Manual framework controls are no longer just a status dropdown. Recording a manual check now captures a small evidence package — the outcome (Pass, In progress, Fail or Not applicable), a proof note, proof links, the date you actually checked, and a re-review date so stale evidence is caught before an audit is. Every record, update and clear is written to Beacon's tamper-evident audit log, giving each framework a defensible history. The Frameworks page also gains an MSP overview that compares your whole client portfolio per framework — ranking laggards first and charting whether you're improving or regressing over time. Status labels for manual checks now match Beacon's automated checks (Pass / Fail) so framework and regular checks read the same way.

Manual review for framework controls Beacon can't auto-scan

Some framework controls — like "Physical devices and systems are inventoried", "Information security policy is established", or "All users are informed and trained" — simply can't be verified from cloud APIs. Previously these sat in an ambiguous "no data" state, indistinguishable from a control that just hadn't been scanned yet. Every framework control is now explicitly one of two kinds: connected to an automated scan, or a manual control that needs a human attestation. Manual controls carry a clear Manual review required status until someone records an outcome. On the Frameworks page, pick a client and mark a manual control as Met, In progress, or Not met with an optional evidence note — tracked per client. Manual attestations are a record-keeping aid and carry no automated compliance-score signal, keeping the score honest.

Fix: framework coverage now reflects what was actually scanned

The Frameworks view maps each control (CIS Microsoft 365, NIST CSF, ISO 27001, CIS AWS/GCP, SOC 2, CMMC and NIST 800-171) to the Beacon checks that assess it. A persistence gap meant the framework tags computed during a scan were never written to the check rows, so coverage was derived from an empty set — every control showed as unmapped even though the underlying checks were running and passing or failing correctly. Scans now record each check's framework alignment, so coverage, passing/failing counts and per-control status populate from live scan data. Checks that were skipped because a prerequisite was missing (no subscription, licence or connected service) are deliberately left out of coverage rather than counted as passing, so the numbers stay honest.

Security: consistent, hardened per-client access checks across the API

A platform-wide hardening of how Beacon authorises access to a specific client's data. Every per-client API endpoint — findings, exports, risk register, report schedules, share links, the client portal, check suppressions, audit log, score history, remediation packs, SLA overrides and more — now runs the same centralised authorization guard before any handler logic. This makes it structurally impossible to ship a new client-scoped route that forgets the access check (the classic cross-tenant data-leak setup), and it standardises the response: a request for a client you can't access returns a clean 403 with a stable CLIENT_FORBIDDEN code. Consistent with this, a request for a client id that doesn't exist now also returns 403 rather than revealing whether the id is real (anti-enumeration). Several endpoints that previously answered an invalid request body with a 500 now return a precise 400.

API: malformed requests now return a clear 400, not a 500

A robustness fix for anyone integrating with the Beacon API. Several endpoints — documentation pages, organisations, teams and users — previously answered an invalid request body with a generic 500 Internal server error, which looked like a Beacon outage even though the request itself was the problem. These endpoints now return a precise 400 Bad Request with a stable VALIDATION_FAILED code and a list of exactly which fields were wrong, so client apps can show actionable errors and we no longer page on a caller's typo. The global error handler was also tightened to preserve the intended status code and to never leak stack traces in production.

Scan engine: crash-safe writes so a scan never leaves your data half-updated

Scan engine: crash-safe writes so a scan never leaves your data half-updated

A reliability hardening of the scan pipeline. Each scan now commits all of its results — findings reconciliation, control statuses, the recomputed compliance score, the score-history snapshot and the connection sync state — in a single all-or-nothing database transaction. If a worker is restarted or a database connection drops mid-scan, the partial work is rolled back instead of leaving, say, new findings recorded but stale ones never resolved, or a score that doesn't match the controls behind it. The next scan simply starts clean. We also consolidated the three cloud providers' control-persistence onto one shared, well-tested path, removing a class of copy-paste drift between Azure, AWS and GCP.

Hardened per-client authorization on the client API

A security and robustness pass over every client endpoint. The per-client access check that protects one customer's tenant data from another is now enforced by a single shared guard that runs before each handler, so it can't be accidentally skipped when a new route is added — closing a whole class of cross-tenant data-exposure (IDOR) risk. As part of this, requesting a client you can't access now consistently returns 403 Forbidden rather than revealing whether that client exists, and malformed request bodies (including connection settings) now return a clean 400 Bad Request instead of a generic server error.

Complete, typed API coverage for previously-undocumented endpoints

A developer-facing improvement to our API surface. Around two dozen endpoints that already powered the product — API tokens, custom checks, notification channels, SLA targets, scheduled reports, share links, support tickets, suppressions, cross-client findings, remediation metrics and GDPR export — are now fully described in our OpenAPI specification. That means each one now has a generated, fully-typed client, removing hand-written request code and making the spec the single source of truth.

Compliance portal: self-service GDPR export, sturdier empty/error states, and a much faster first load

A round of compliance-portal polish. You can now download a copy of your own data (GDPR) straight from your profile — useful on an EU-targeted product where self-service export is expected. The portal also handles the unhappy paths far better: a brand-new tenant with no data, or a momentary network hiccup, now shows friendly empty and retry states instead of a blank or half-drawn screen — including on the public, client-facing report page. Under the hood, the app no longer ships as one giant bundle: pages load on demand, so the login and public-portal screens paint dramatically faster.

Admin portal: faster loads, and clearer empty & error states

The Beacon platform admin portal now loads each screen as its own bundle instead of shipping the whole app up front, so signing in and moving between pages is noticeably quicker. We also hardened the unhappy paths across operator screens: when a panel can't load its data it now shows a clear message with a one-click retry instead of a blank card, and lists that are genuinely empty say so. Destructive actions (like deleting a beta code) now use a proper confirmation dialog, and primary forms gained accessibility fixes (labelled fields and icon-only buttons).

API: versioned /api/v1 base path and a uniform list response shape

The Beacon API now lives under a versioned base path, /api/v1, so future changes can ship without silently breaking your integrations. At the same time, every paginated list endpoint now returns one consistent envelope — { data, pagination: { total, limit, offset } } — instead of a bare array or an ad-hoc { total, findings } shape, and accepts ?limit= and ?offset= for paging. The unversioned /api prefix continues to work during a transition window but is deprecated; point new integrations at /api/v1. This is a deliberate pre-launch break, made once, behind a version prefix.

Reliability: validated startup config & versioned audit chain

Two reliability and security improvements. Beacon now validates its entire configuration at startup — the API and background worker refuse to boot (with one clear, aggregated error) if a required setting like the database URL, encryption key, audit-log signing key, or allowed origin is missing or malformed, instead of failing later when someone first hits the affected feature. Separately, the tamper-evident audit log is now version-aware: the identity-signing upgrade shipped in v1.26.3 no longer re-baselines (and orphans) your existing history — every historical entry continues to verify under the form it was written with, while new entries use the stronger identity-inclusive signature.

Reliability: shared state for multi-instance scaling

As Beacon scales out to run on multiple API instances, abuse-protection rate limits and the authorization cache now share state through Redis instead of living in each instance’s memory. Rate limits are now enforced as a single budget across the whole fleet, and a role or permission change takes effect on every instance within one request instead of waiting for a per-instance cache to expire. Single-instance and local setups are unchanged — they continue to use fast in-memory state.

Site copy: accurate multi-cloud check count

The marketing site described Beacon as running “63 security checks” (and, on the comparison and ROI pages, “36 checks”) — numbers that long predated the multi-cloud expansion and significantly understated the product. Beacon now ships 190+ built-in security checks across the three supported clouds: 100 Azure (identity, Conditional Access, networking, Key Vault, storage, Defender for Cloud, Intune, Microsoft 365, DevOps), 44 AWS (CIS AWS Foundations plus gap-fills), and 46 GCP (CIS Google Cloud Foundations plus gap-fills). Every check-count reference on the public site now reflects this real, catalog-sourced total.

Security: hashed password-reset tokens and stronger audit-log tamper-evidence

Two security hardening fixes. Password-reset tokens are now stored only as a one-way hash — the actual token still arrives in your reset email, but the database never holds a usable reset credential, so a leaked backup or read-replica can no longer be turned into an account takeover. Separately, the tamper-evident audit log now signs the who, tenant, and target of each event (not just the action and timestamp), so an attacker with database write access can no longer silently re-attribute an action to a different user, move it to a different client, or change its target without breaking chain verification.

Fix: AWS and GCP compliance scores now refresh on every scan

For clients connected to AWS or GCP, the compliance control cards and benchmark scores could freeze at their first-scan values: a defect in how scan results were saved meant subsequent scans silently discarded the updated control status, severity, and evidence. As a result a control that was later remediated (or newly failing) would keep showing its original state even though the underlying findings were updating. The save path has been corrected so each scan now writes the latest control status, severity, evidence, recommendation, and evaluation time — AWS and GCP control cards and scores now track reality on every scan, matching Azure’s existing behaviour.

Fixes: scrollable sidebar and working client-portal toggle

Two portal fixes. The left navigation sidebar couldn’t scroll, so once several nav sections were expanded the lower items were cut off below the viewport with no way to reach them — the navigation area is now scrollable while the profile and sign-out footer stays pinned. Separately, the Portal access toggle on a client’s Portal tab appeared to do nothing: the client record returned by the API didn’t include the saved portal settings, so the toggle never showed as enabled and the Generate portal link controls stayed hidden. The client API now returns the portal configuration, so the toggle reflects its real state and the link generator appears as expected.

Remediation scripts in check detail and full finding detail

Remediation scripts used to appear only in the inline panel when you expanded a finding on the Findings tab, and that panel showed a single generated variant at a time. The full Remediation scripts section — with a tab per supported language (PowerShell, Azure CLI, Graph API, and so on) and both the Audit (detection) and Remediate snippet for each — now also renders in the check detail view (opened from a Compliance Checks card) and in the View full detail finding drawer. You can review the complete set of audit and remediation scripts across every language side by side, wherever you open a check or finding.

Fix: findings filter now covers every category

The category filter on the Findings view only listed five categories (Identity, Security, Data, Patching, Monitoring). Findings in the other categories — including M365 (e.g. Exchange legacy-authentication issues), Defender, Endpoint, Governance, DevOps, and Backup — could not be filtered to, and were hidden entirely whenever any category filter was applied. The filter now offers every category a finding can carry, so M365 and the rest show up and can be filtered like the others.

Fix: Azure compliance checks now populate after a scan

After an Azure scan completed successfully, every check in the compliance tab stayed stuck on Never Scanned — even checks with no prerequisites that should have produced a clean pass. The scan engine was evaluating all 100 Azure checks and opening findings for failures, but it never wrote a per-check result row, so the catalog had nothing to show a status against (only the Microsoft Secure Score controls were being recorded). Azure now writes one result row per catalog check on every scan, exactly like the AWS and GCP scanners already did. Checks that ran show Passing, Warning, or Failing; checks whose prerequisites are missing (no subscription connected, no Azure DevOps or GitHub organisation, or a required permission/licence) show Attempted with a clear skip reason. The compliance score now reflects these checks alongside Secure Score.

Domain-grouped compliance checks with full-page detail view

The compliance tab has been rebuilt around a domain-grouped catalog. Every check — across Azure, AWS, and GCP — is now organised into eight logical domains (Identity & Access, Security & Threat Protection, Data Protection, Network & Infrastructure, Endpoint & Patching, Operations & Monitoring, Governance & Compliance, and Applications & Services), so engineers can scan an entire tenant's posture by area without scrolling through an undifferentiated list. A new filter bar lets you toggle between Assessed, Attempted, and Never Scanned groups, and sub-filter by Failing, Warning, or Passing within the Assessed group. Each failing or warning check now includes a per-resource table showing the current value found and the expected compliant value. A full-page detail route at /clients/{id}/checks/{checkId} provides the complete remediation playbook alongside that resource table for deep-link sharing and bookmarking.

Fix: the “Launch demo” button logs you in again

The live demo on the marketing site stopped signing visitors in: clicking Launch demo sent you to the compliance portal but never created the demo session, leaving you on the login screen. A recent security hardening change had made the publicly advertised demo codes (like BEACON-DEMO) require a server-side configuration value that production never set, so every code was rejected. Because those codes are printed on the home page by design, keeping them secret added no protection — the demo’s read-only safety comes from its locked-down account, not the code. The advertised codes now work again in every environment.

Consistent, clearer remediation guidance across Azure, AWS and GCP

We aligned how findings present their remediation across all three clouds. Azure findings now follow the same model as AWS and GCP: each finding leads with the risk and the “why” and “what”, and a ready-to-run script is offered only when one can actually perform the fix. PowerShell and CLI options now appear strictly when they apply — for example, the two Conditional Access checks that previously showed a placeholder Azure CLI snippet are now PowerShell-only — and checks that genuinely require manual or architectural work show step-by-step written guidance with no misleading script buttons. Beacon remains strictly read-only against your cloud environments.

Per-organization SSO and a platform-wide security hardening pass

SAML single sign-on is now configured per organization: each MSP manages its own identity provider in isolation, and you choose your organization at sign-in so Beacon routes you to the right tenant's IdP. Alongside that, we completed a deep security review and shipped the fixes across the board — tightened role permissions so only an owner can grant the top admin role, organization-scoped the audit log and public share links, hardened every outbound webhook and notification against server-side request forgery, made CSV exports safe against spreadsheet formula injection, added rate limiting to public links, locked down internal status/metrics endpoints, and brought our build pipeline and dependencies up to a clean security baseline. Beacon remains strictly read-only against your cloud environments.

Deeper framework coverage, Autotask, branded PDF reports, simpler tenant onboarding & guided remediation

A broad release aimed squarely at how MSPs actually work. Your existing checks now map to more of the standards your clients ask about — with explicit CIS Level 1 / Level 2 profiles and coverage aligned with CMMC 2.0 and NIST SP 800-171, shown honestly alongside the control families Beacon does not assess. Datto Autotask joins ConnectWise, HaloPSA, and Freshservice as a first-class PSA target. Scheduled and on-demand reports can now go out as branded, client-ready PDFs using your logo and colours. Connecting a Microsoft 365 tenant is simpler: a one-click admin-consent flow against Beacon's multi-tenant app means no client secret to store — while the existing App Registration method stays fully supported. And remediation is now guided end-to-end: hand a fix off to your automation or PSA, or apply a curated fix in-product — always read-only by default, opt-in per category, and never running anything until an admin confirms exactly what will happen.

Remediation scripts for every fixable finding — PowerShell-first, across Azure, AWS & GCP

Every finding that can be fixed by a script now comes with a ready-to-review remediation script you can copy, download, and run yourself. Azure and Entra checks generate PowerShell (Microsoft Graph / Az) and Azure CLI; AWS checks generate PowerShell (AWS Tools for PowerShell) and AWS CLI; GCP checks generate gcloud commands. The remediation panel is now capability-aware: it shows only the script types that can actually fix a given check — so you'll never see a PowerShell button that can't do the job — and for findings that need manual or architectural work (credential rotation, an OS migration, a licence purchase, deploying a SIEM) it shows step-by-step guidance with no script buttons at all. Beacon remains strictly read-only: every script is generated text for your engineers to review, test in a non-production environment, and run manually — Beacon never touches your tenant, account, or project.

Compliance checks you can actually act on — one click to the full finding

The compliance checks list is no longer a wall of terse one-liners. Each check is now a scannable row showing its real title, its check ID (like GCP-VM-003), severity, and a one-line summary — and clicking it opens a single, shareable finding detail drawer with the complete playbook: a plain-English business-risk summary, step-by-step remediation, the roles you need, how to verify the fix, how to roll it back, and grouped "Understand the risk" / "How to fix" links. The same drawer opens from the Findings Explorer and from a client's page, and its URL is deep-linkable, so you can drop a link to a specific finding straight into a ticket or chat. Behind the scenes, every check now carries a stable identifier so this guidance resolves consistently across Azure, AWS, and GCP.

A fully interactive multicloud demo — Azure, AWS & GCP

The Beacon demo is now a hands-on sandbox spanning all three clouds. The sample portfolio has been rebuilt with six themed client organisations — three on Azure, one on AWS, one on GCP, and one running across all three — each with realistic, deterministic compliance results and a few deliberately dramatic findings so you can see Beacon at its best. The demo is no longer read-only: every feature is unlocked and fully clickable, with friendly inline notices showing which plan a feature would need in a live account, instead of upgrade walls. Billing is tucked away so there's nothing to get in your way — just explore.

Remediation & business-risk guidance on every scan — across Azure, AWS & GCP

Every check Beacon runs now comes with complete guidance, no matter which cloud it scans. Alongside the step-by-step fix (required roles, how to verify, and how to roll back), each finding now carries a plain-English Business risk summary written for managers — what the issue could cost the business in a breach, outage, fine, or failed audit — plus curated documentation links split into "Understand the risk" and "How to fix". The business-risk summary and fix links also appear in the client portal and in exported reports, so the people approving the work can see why it matters. This guidance now spans Azure, AWS, and GCP equally, and a build-time check guarantees no scan can ship without it.

Fix: portals no longer "refresh" and close your menus

We fixed a long-standing annoyance where the compliance and admin portals could appear to refresh on their own — closing open dropdowns and pop-up menus and jumping you back to the top of the page, often just after switching back to the browser tab. The cause was a routing quirk that rebuilt the whole page whenever your session was re-checked in the background. Pages now update in place, so menus stay open and your scroll position is preserved. No action is required.

Session hygiene and review follow-ups

A second maintenance pass from the codebase review. Changing a password, resetting one, or turning off two-factor now signs out your other sessions, and an in-progress two-factor login is re-checked against the portal it was started for. The rest is internal polish — faster SLA and findings handling, and a batch of small portal fixes. No action is required.

Hardening pass: tenant isolation, scan reliability, and fixes

A focused maintenance release from a full codebase review. We closed several tenant-isolation and request-forgery gaps, made the background scan and report engine safe to run across more than one worker, and fixed a handful of portal bugs — including one where toggling an organisation feature could wipe an operator's note. No action is required; all changes are backward-compatible.

A dedicated platform-admin role and a three-way documentation split

Beacon's platform operators now have their own first-class turbo admin role instead of sharing the top customer role. The two tiers are cleanly separated: a turbo admin opens only the Admin Portal and can reach a customer's data solely through an explicit, audited support session — never directly. Alongside this, documentation now lives in three purpose-built homes — public guides on the marketing site, an operator handbook in the Admin Portal, and the existing in-product guides for MSP teams — with shared components and a per-audience editor. The public site has also been repositioned to reflect Beacon's full multicloud coverage.

Encryption in transit, end to end

Beacon already encrypts stored secrets at rest with AES-256-GCM. This release makes the in-transit story just as strong: every connection now runs over TLS — including the link between Beacon's services and its database — so credentials and scan data are never carried over the network in the clear. We also extended HTTP Strict Transport Security to every web surface and hardened email delivery so it can never silently fall back to plaintext.

AWS and Google Cloud compliance scanning

Beacon now scans Amazon Web Services and Google Cloud alongside Azure, with the same score, benchmark, findings, framework reporting and alerting across all three. Both connect read-only with no stored customer secrets — AWS via a cross-account IAM role (CloudFormation one-click or manual), GCP by granting Beacon's scanner service account access (Cloud Shell one-click or manual). AWS scans every enabled region; GCP scans every project in the organization — each with drift detection that flags newly-appeared regions or projects for approval.

Multi-cloud foundation: provider-aware architecture

Under-the-hood groundwork to extend Beacon beyond Azure. The platform is now provider-aware: each client connection carries its own cloud provider and credentials, stored in a dedicated, individually-encrypted connection record. Azure remains the only provider today and its behaviour is unchanged. This release lays the foundation for Amazon Web Services and Google Cloud support, coming next.

Content marketing launch — blog, Netherlands go-to-market, and EU legal groundwork

Groundwork for taking Beacon to market in the Netherlands and the wider EU. A new public blog with high-intent articles for MSPs evaluating Azure compliance tooling, plus internal go-to-market, outreach, and EU/AVG legal-readiness documentation. No application behaviour changed — this release is marketing content and internal strategy material.

GDPR compliance, performance monitoring, and operator tooling improvements

Three independent improvements bundled into one release: full GDPR Article 17 (Right to Erasure) and Article 20 (Right to Portability) compliance with self-service org deletion and a data export endpoint; Vercel Speed Insights on both the marketing site and the compliance portal; and a structural decomposition of the operator backend from a single 1,169-line file into six focused modules.

Pre-launch security hardening — auth, multi-tenant isolation, credentials, and input validation

A comprehensive pre-production security review covering six domains across all 297 TypeScript files in the platform. Fixes span authentication hardening, multi-tenant data isolation, credential encryption at rest, CSV and path-injection prevention, and business-logic race conditions — none of which were user-visible but all of which matter before real customer data lands.

Endpoint, DevOps, and PSA escalation — the largest scan expansion since launch

Beacon's scan engine now reaches two entirely new surfaces: Intune-managed endpoints and developer tooling (Azure DevOps and GitHub). Five new Intune checks surface non-compliant, unsupported, and stale devices across your client fleet. Seven DevOps checks flag public ADO projects, over-privileged service connections, unreviewed branches, secret-like pipeline variables, and unpinned GitHub Actions workflows. On top of the new scan coverage: a cross-client findings view with bulk acknowledge/assign/suppress actions (Pro+), automatic PSA ticket escalation for overdue findings (Growth+), and a Remediation Dashboard showing per-client MTTR, SLA breach rates, and weekly trends.

M365 + Defender for Cloud scan coverage and client compliance portal

Beacon's scan engine now covers Microsoft 365 and Defender for Cloud alongside its existing Azure/Entra ID checks — adding 18 new compliance checks across Exchange, SharePoint, Teams, and Defender workload protection. MSPs on the Growth plan and above can now share a read-only client compliance portal with each Azure tenant they manage: the client gets their own URL showing current score, active findings, and resolved activity, with no access to internal MSP tooling or other clients' data.

Collapsible sidebar navigation

The compliance portal's left navigation has been reorganised from a single flat list into labelled, collapsible sections — Core, Resources, Admin, and Settings. Super-admin accounts previously saw up to 15 items with no visual grouping; the secondary sections now start collapsed and remember their state across reloads. Navigating directly to a page inside a collapsed section auto-expands it.

Beta access control — invite codes, waitlist, and test-mode banner

Beacon's registration flow now has a three-state access gate — closed (waitlist only), beta (invite code required), and open (public launch). Platform admins can manage the live state, create and revoke named invite codes with optional use limits, and view the waitlist from a new Beta Access page in the admin portal. An amber test-mode banner in the compliance portal prevents testers from mistaking the Stripe sandbox for a live environment.

Portal link routing fix

All Sign in, Get started, Portal login, and demo-login buttons on the marketing site were resolving against the marketing origin (beaconcompliance.eu) instead of the compliance portal (compliance.beaconcompliance.eu), causing 404s for every action button in production. The inline PORTAL_ORIGIN helper is now hardcoded to the correct portal subdomain in all eight marketing pages.

Security hardening & pre-beta stability

A focused hardening pass ahead of the live beta. Four authorisation and authentication findings from an internal security review are closed, and a batch of build-blocking artifacts left by an earlier branch merge are resolved so the full stack compiles cleanly again. No user-facing feature changes.

Platform expansion — 22 features across competitive parity, MSP manageability, and admin operations

The largest release wave in Beacon's history. Twenty-two full-stack features land simultaneously, closing the gaps against CIPP, Cynomi, and Vanta/Drata: framework-to-control mapping, posture drift tracking, compliance baselines, a vCISO risk register, and a dramatically expanded check library. MSP engineers gain bulk actions, saved views, remediation workflows with assignment and MTTR, auto-generated PowerShell and Azure CLI remediation scripts, webhook delivery history with manual retry, and a portfolio command-center. Beacon admins gain cross-org audit log with HMAC integrity, a scan-fleet health dashboard, per-org feature-flag overrides, revenue and churn signals, support-session audit trails, and full org lifecycle management.

Security hardening — secret rotation

Rotated all exposed secrets (encryption key, database password, HMAC audit key, and API keys) and purged the committed .env from git history. Added a key-rotation migration script for future key rotation operations.

Emerald refresh, enforced plan limits, and a read-only demo

A wide release wave that resets how Beacon looks and how it is bought. An emerald visual refresh now runs across both portals and the marketing site, plan limits and feature gates are enforced rather than advisory, and two new pages help teams compare Beacon and size the return on investment. Sign-up moves away from a free trial: prospects explore a read-only demo, and paid sign-up takes a card up front with annual billing selected by default. Reliability and observability work rounds out the release.

Solo plan — personal Azure compliance monitoring

Introducing the Solo plan: a lightweight tier for individuals who want to monitor a single Azure tenant without the overhead of a full MSP organisation. One account, one tenant, zero team management — sign up, connect your Azure app registration, and land directly on your tenant's compliance dashboard.

Security patch — 17 vulnerabilities remediated

A focused security hardening release addressing findings from a full codebase audit. Fixes span cross-tenant access control, authentication robustness, injection vulnerabilities, and server-side request forgery vectors. No new user-facing features; all existing behaviour is unchanged.

Security hardening & deployment improvements

This release focused on eliminating known vulnerabilities in dependencies, tightening the CI pipeline, and expanding the first-party deployment guide to cover Railway and Vercel as fully supported targets alongside the existing Azure App Service path.

Admin portal, platform operations & UI refresh

A major platform release adding a fully separate Admin Portal for Beacon operators alongside a comprehensive visual refresh across all three portals. New support session tooling lets Beacon staff assist customers directly from the admin interface.

Billing, SaaS multi-tenancy & public launch

The foundational SaaS release. Beacon became a fully multi-tenant platform with a public marketing site, Stripe billing, a demo mode for prospective customers, and a built-in support system. Each MSP organisation is completely isolated from all others.

MSP readiness — 36 checks, integrations & reporting

A series of milestone releases transforming Beacon from a proof-of-concept into a production-ready MSP platform. Check coverage expanded from 15 to 36 controls, and a complete integration layer was added: SLA tracking, PSA webhooks, API tokens, scheduled reports, share links, and compliance framework mapping.

General availability

The first production release of Beacon. A multi-tenant Azure compliance management platform for Managed Service Providers with 15 built-in security checks, full RBAC, SAML SSO, and a tamper-evident audit log.