Serie v6.0.x
v6.0.7 (2026-09-11)
Sensor
Removed the Combined Behavior Anomaly Rule: Removed the combined behavior anomaly rule. It produced alerts too broad to act on.
More Accurate Alert Source IPs: Fixed a case where an alert could show an incorrect source IP for the affected device. The device’s known inventory IP is now used consistently.
v6.0.6 (2026-09-10)
On-Prem Console
New NIST SP 800-82 Compliance Benchmark: Added support for auditing against NIST SP 800-82 Rev. 3, covering OT-tailored NIST SP 800-53 controls across 19 control families.
Compliance Page Category Tabs: The Compliance page now groups benchmarks into tabs by category, making it easier to find the one you need.
v6.0.5 (2026-09-07)
Sensor
Fewer False Positives in Anomaly Detection: Traffic-volume and behavior-based rules (traffic anomaly, lateral movement, port scanning, off-hours activity, and combined behavior anomaly) now judge a device by its own directed traffic, cutting down on alerts that weren’t tied to a real behavioral change.
New Sensor Appliance: Siemens SIMATIC IOT2050: Added support for running the Safetybits sensor on the Siemens SIMATIC IOT2050 gateway.
On-Prem Console
Anomaly Model Status in Network Activity: A device’s anomaly-detection model training status now shows directly in its Network Activity tab, with a clear empty state, and devices with no recorded traffic no longer show an error there.
Faster Network Activity History: Network activity history loads faster on the resource detail page.
v6.0.4 (2026-09-04)
Sensor
- More Consistent Anomaly Model Readiness: Anomaly detection models now start training based on how long a device has been observed instead of how many traffic samples were captured, so readiness is more consistent across devices.
v6.0.3 (2026-09-03)
Sensor
- Fixed arm64 Sensor Image: Fixed the arm64 sensor Docker image, which was missing its binary and could fail to run on arm64 hardware.
v6.0.2 (2026-09-03)
Sensor
arm64 Sensor Support: Added arm64 support for the sensor Docker image.
Fewer False Alerts from Anomaly Detection: Tuned the anomaly detection threshold further down to better match how stable OT environments normally behave, reducing false alerts.
v6.0.1 (2026-09-03)
Sensor
- More Accurate Device IP on Traffic Without One: Fixed a case where network traffic lacking a source or destination IP could show inconsistent device data. The device’s known inventory IP is now used instead.
On-Prem Console
- Longer Anomaly Detection Training Window: The anomaly detection engine now trains on 30 days of a device’s traffic history instead of a shorter window, and keeps 5 weeks of network data available for it, so the model has more history to learn normal behavior from.
v6.0.0 (2026-09-01)
Sensor
New Anomaly Detection Engine: Anomaly detection now runs on a new machine learning engine in place of the previous z-score based approach, still trained per device on its own traffic history. This should surface behavioral deviations more accurately than before.
New Anomaly Rules: Added detection for combined behavior anomalies, off-hours device activity, and sudden protocol mix shifts on a device.
Breaking: Rule IP Allow/Deny Parameters: Removed the
allowedSourceIPsandallowedDestinationIPsrule parameters. Use a scope expression to allow or restrict IPs instead.
On-Prem Console
Model Status on the Resource Page: You can now see a device’s anomaly-detection model status directly on its resource detail page, and refresh a model on demand instead of waiting for the next scheduled run.
Unified Severity Across Rules and Controls: Rules and compliance controls now share one severity scale, shown consistently across alerts, findings, and the UI, making it easier to compare risk across both.
Remediation Guidance: Findings and threat-detection alerts now include suggested remediation steps, so you know what to do next without leaving the alert.
New Controls: Added a control that flags PLCs stuck in STOP state, and a control that tracks Siemens devices approaching end of life through their successor model. Cancelled-device detection for Siemens hardware now also recognizes two additional device states.
Clearer Findings and Vulnerability Trends: Reworked the findings and vulnerabilities evolution charts to show trends grouped by snapshot and stacked by severity, making it easier to see what’s driving a change over time.
Network Conversations View: Added a view for browsing network conversations between devices, with pagination and the ability to select a custom date range when looking at traffic history. Device pages now also show when a device was last seen in traffic.
Redesigned Sign-In Page: Refreshed the sign-in experience with an updated look.
Alert Groups Table Fix: Fixed an issue where an alert group’s occurrence count, age, or last-seen time could fail to display.
More Reliable IP Reputation Enrichment: Fixed an issue where a failed IP reputation lookup could silently leave an alert without threat context instead of surfacing the error.
Agentic OTSPM
New Assistant Skills: Added assistant-guided workflows for detecting inventory drift, planning network zone segmentation under IEC 62443, reducing alert noise, reviewing a device timeline, checking policy consistency, and running a compliance gap analysis.
Rule Scope via Assistant: You can now view and update a rule’s scope through the assistant, and query network flows, countries, and inventory changes directly from it.