--- title: What’s New in GravityZone October 2026 (v 6.78) description: Here is new functionality within Bitdefender GravityZone, a unified cybersecurity platform that provides prevention, protection, detection, and response. --- [Business Insights Cybersecurity Blog by Bitdefender](https://businessinsights.bitdefender.com) # [What’s New in GravityZone October 2026 (v 6.78)](https://businessinsights.bitdefender.com/whats-new-in-gravityzone-october-2026) Written by [Grzegorz Nocoń](https://businessinsights.bitdefender.com/author/grzegorz-nocon) | Oct 21, 2026 Bitdefender rolled out new functionality in [Bitdefender GravityZone](https://techzone.bitdefender.com/en/gravityzone-platform.html), a unified cybersecurity platform that provides prevention, protection, detection, and response capabilities for organizations of all sizes. These features, aligned with our multi-layered security strategy, are designed to reduce the workload for security analysts, administrators, and users. ## What’s new for Security Analysts As attackers increasingly blend into legitimate activity, security analysts must uncover signs of sophisticated attacks and make the invisible visible. This section describes new functionality designed to elevate analysts' capabilities, offering enhanced tools for threat detection, investigation, and response. ### CLAIRE AI Assistant Enhancements (Early Access) When an analyst opens an incident and needs to decide on containment, the assistant now starts from that page’s context instead of a blank prompt. CLAIRE, previously named GravityZone AI Assistant, is a conversational assistant built into the Control Center. It applies large language model (LLM) reasoning to Bitdefender Support Center documentation and to data from your GravityZone environment to answer questions, issue recommendations, and initiate selected response actions. CLAIRE is available through a controlled Early Access Program (EAP). It now has its own entry in the GravityZone navigation menu, with a **Chat** page and an **Advisor briefing** page. On the **Incidents**, **Network**, and **Policies** pages, a new chat opens with page-specific prompts, and coverage extends to the rest of the interface. As the conversation continues, CLAIRE suggests follow-up prompts. When asked to isolate the endpoints associated with an incident, CLAIRE builds the endpoint list for review, and isolation runs only after the analyst refines the list and clicks **Isolate**. Outside incident work, the **Advisor briefing** page lists proactive posture recommendations. Each recommendation’s details page explains why CLAIRE chose the issue, summarizes the top affected items, and suggests remediation actions. The chat window also adds a **Stop** button that cancels a prompt before the response is generated. A message now appears when you reach your usage limit, and all chats now follow a 30-day retention period. ### Attack Path in GravityZone Exposure Management Attackers rarely reach a critical asset in one step. They chain a misconfiguration on one asset to an exposed account or vulnerability on the next. Attack Path is now available as part of the new GravityZone Exposure Management license. It correlates [endpoint risk findings](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/endpoint-risk-management.html), [Cloud Security Posture Management (CSPM)](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/cloud-cspm.html) data, and [External Attack Surface Management (EASM)](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/external-attack-surface-management--easm-.html) asset records to determine the most likely paths an attacker could take to compromise your assets. Each attack path under **Risk Management \> Attack Path** shows a graph and an asset list that mark potential entry points, exploitable vulnerabilities, and misconfigurations along the route. The graph can highlight the shortest path to the target asset, showing where a single remediation action breaks the largest portion of the chain. Risk factors such as **Public exposure** and **Critical asset** appear in both the graph and the asset table. When an asset also has a Risk Management entry, the asset details panel includes a button that opens the matching **Risk Management \> Resources** or **Risk Management \> Accounts** record. Four new widgets on **Monitoring \> ASM Dashboard** track attack paths across the environment: - **New attack paths:** lists newly created attack paths for **Last 24 hours**, **Last 7 days**, or **Last 30 days**. - **Open attack paths over time:** charts **New** and **Resolved** attack paths, with a trend line, for **Last 7 days**, **Last 30 days**, or **Last 90 days**. - **Top 5 attack path destinations:** lists the five assets that attack paths target most often. - **Top 5 attack path entry points:** lists the five assets that most often serve as attack path entry points. For detailed information about Attack Path, see the dedicated TechZone article [here](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/attack-path.html). ## AI Visibility and Control Enhancements Unmanaged AI tools on endpoints are now a routine part of an organization’s attack surface, and assessing that exposure requires seeing it alongside other risk data. [AI Visibility and Control (AIVC)](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/ai-visibility-and-control--aivc-.html), is a discovery and risk layer that reports which AI software is installed and running on managed endpoints and assigns a risk score to each finding. This release extends AIVC data to the ASM Dashboard, the AI Services page, and Risk Management \> Resources. **Monitoring \> ASM Dashboard** now includes a dedicated **AI Visibility and Control** smart view with an overview of AI usage and risk exposure across the organization. Its widgets show the overall AI risk posture, compare risk across AI categories, list the affected users and endpoints, break findings down by AI category, and list the discovered AI services. AIVC widgets can also be added to custom dashboard smart views. On **AI Visibility and Control \> AI Services**, each discovered AI service now shows its associated finding or finding count, in both the grid and the service details. From there, analysts can open the **AI Findings** page to investigate. AI-related findings also appear in **Risk Management \> Resources**, so an endpoint’s AI exposure sits alongside its other risk data. From there, analysts can move between the affected resource, its findings, and the associated AI services. For comprehensive insights into AIVC, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=upcoming&filters=risk-management-and-compliance&search=AI+visibility). ### EASM Enhancements [External Attack Surface Management](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/external-attack-surface-management--easm-.html) builds an attacker-centric view of an organization’s internet-facing exposure. This release adds classification detail to similar domain findings, and maps discovered public IP addresses back to the managed servers that use them. Similar domains flagged as potential brand impersonation attempts now identify the typo squatting technique used to construct them — misspellings, alternative top-level domains, and substitutions involving visually similar or keyboard-adjacent characters. EASM also highlights public IP addresses used for external communication by servers managed by Bitdefender Endpoint Security Tools (BEST), with the managed servers using each address viewable alongside it. Analysts can identify which addresses to add to the EASM scan list, giving Attack Path additional context on potential entry points into the organization’s network. For comprehensive insights into EASM, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=recorded&search=EASM). ### EDR and XDR Enhancements [GravityZone Endpoint Detection and Response (EDR)](https://techzone.bitdefender.com/en/security-layers/detection/edr-xdr-and-mdr-overview.html#UUID-a6f34d02-48dd-d2fb-ebbc-dc21484d83c2_section-idm462837759532003428071410809) and [Extended Detection and Response (XDR)](https://techzone.bitdefender.com/en/security-layers/detection/edr-xdr-and-mdr-overview.html#UUID-a6f34d02-48dd-d2fb-ebbc-dc21484d83c2_section-idm4572751691512034280721819866) give security analysts the tools to detect, investigate, and respond to threats across managed endpoints and connected sensors, with raw event telemetry that supports historical querying and incident investigation. This release changes how search is organized and shared and adds detail to incident and alert data. **Search and investigation** - **Separate menu entries:** **Historical search** and **Live search** now appear as separate entries in the left-side menu of GravityZone Control Center. - **Shared smart views:** Smart views created on the **Live search** page can now be shared with other users in the company, with read-only or editable permissions. Company Administrators can edit, delete, rename, or make editable for any shared smart view, regardless of who created it or what permissions it has. Other users can delete, rename, or make editable only the views they created, and can edit only those they created or have edit permissions for. Shared smart views appear in a separate section of the **Queries** panel. Each one has a banner showing its access rights, creator, last update date and time, and the user who last modified it. Create, edit, and delete actions are logged on the **User activity** page, in the **Live search** area. - **FQDN search:** **Historical search** now supports searching and filtering raw events and alerts by endpoint-submitted fully qualified domain name (FQDN) values. The fqdn field is available in the query editor helper under the **Other** category, and other.fqdn can be added as a column in the results table and viewed in the event details panel. **Incidents and alerts** - **Entity type filter:** A new **Entity type** filter under **More filters** on the **Incidents** page narrows incidents by the types of entities they contain. It supports multiple selections, and its options are populated from the entity types present in your incidents. - **Self Protect attribution:** In alert details for Endpoint incidents, alerts generated by the Tamper Protection module now show **Self Protect** in the **Detected By** field. - **MITRE ATT&CK tactics:** XDR and EDR incident and alert details now also support the Resource Development, Stealth, Defense Impairment, and Reconnaissance tactics. Activity previously classified as Defense Evasion may now be reported as Stealth or Defense Impairment, depending on the detection context. - **Timestamps with seconds:** Timestamps throughout **Incidents** and **Historical search** now include seconds as well as hours and minutes. For analysts reconstructing an intrusion, the new tactics and second-level timestamps work together. A sequence in which an attacker disables a security service and then clears event logs within the same minute can now be ordered precisely, with each step mapped to Defense Impairment or Stealth. For comprehensive insights into detection and response with GravityZone EDR and XDR, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=recorded&search=EDR). ## What’s new for Administrators With administrators constantly juggling numerous tasks and responsibilities, they appreciate tools that make their daily work easier. This section describes new functionality designed to simplify managing features responsible for prevention, protection, and detection in a defense-in-depth security architecture. ### Extended Email Security Enhancements [Bitdefender Extended Email Security (EES)](https://www.bitdefender.com/en-us/business/products/gravityzone-extended-email-security) offers flexible deployment models (Gateway, API-based, and Unified) to provide a comprehensive defense against sophisticated spear-phishing, brand impersonation, and supply chain fraud. This release adds outbound data loss prevention rules, distributor-level console access, and a confirmation step for identity provider sign-in. DLP rules in Extended Email Security now also cover outbound email for the Gateway and Unified deployment models, which require **Outbound Smarthost**. Rules inspect the subject, headers, body, attachment types, URLs, and sensitive data patterns, including credit card numbers, International Bank Account Numbers (IBANs), and Social Security Numbers (SSNs). Matching outgoing messages are sent to **Quarantine** or deleted with **Delete**. You can apply enforcement globally or target specific customers, domains, or users. Distributors and higher-level partners can now access the Extended Email Security consoles of the downstream partners they manage directly from the Extended Email Security section, across nested partner hierarchies, without Extended Email Security being provisioned for their own company. Console visibility follows the existing **Your Bitdefender partner can assist you with security management** settings, and the available actions are determined by Extended Email Security permissions within each accessible company. For detailed information, see the dedicated TechZone article [here](https://www.bitdefender.com/business/support/en/77211-1656553-access-extended-email-security-consoles-of-companies-you-manage.html#UUID-313d235c-113d-f2ef-b87d-74b061ef176d). In addition, users who sign in with GravityZone credentials and open the Extended Email Security console now see a confirmation prompt. The prompt asks them to approve the automatic switch to the [GravityZone identity provider (IdP)](https://www.bitdefender.com/business/support/en/77209-1416517-login-with-gravityzone-identity-provider.html) before proceeding. For comprehensive insights into Extended Email Security, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=recorded&search=Extended+Email+Security). ### Security Data Lake Single Sign-On Security teams that use [Security Data Lake](https://techzone.bitdefender.com/en/security-layers/detection/security-data-lake.html) alongside GravityZone can now sign in to both with the same corporate credentials. Bitdefender GravityZone Security Data Lake combines SIEM operations with scalable data lake storage and advanced analytics, collecting and correlating data from multiple organizational sources for proactive threat hunting. Security Data Lake now supports single sign-on (SSO) through [GravityZone IdP Proxy](https://www.bitdefender.com/business/support/en/77209-1416517-login-with-gravityzone-identity-provider.html), so users authenticate with their organization’s identity provider. GravityZone IdP Proxy supports SSO using SAML 2.0 and System for Cross-domain Identity Management (SCIM) to manage and verify digital identities across the GravityZone ecosystem. With Security Data Lake added, sign-in to it is now handled by the organization’s existing identity infrastructure, the same as for the other GravityZone services connected through IdP Proxy. ## Network Enhancements The GravityZone Network inventory gives administrators a consolidated view of all managed endpoints, containers, and network assets across their environment. This release adds two network identifiers to the Network page and refines one filter option: - **Public IP column and filter:** Displays each endpoint’s public IP address, separately from the existing **IP** column and filter, which show the local IP address. The filter supports text matching with **starts with** or **contains**, so partial IP addresses also return results. Endpoints imported through integrations such as Active Directory, Microsoft Entra ID, VMware vCenter, or Amazon Web Services (AWS) do not display a public IP address. - **MAC addresses column and filter:** Displays each endpoint’s MAC address information with the same text-matching options. Devices with multiple network interfaces show all their MAC addresses in a single cell, and the filter matches any of them. - **Golden Image role option:** The **Golden Image** option in the **Role** filter now appears only when the feature is turned on for your company. With public IP and MAC addresses searchable directly in the grid, administrators can locate an endpoint from a known address, match devices against data exported from external network or security tools, and narrow large endpoint inventories even when only part of an address is known. ## Compliance Manager Enhancements The [Compliance Manager](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management/compliance-manager.html) in GravityZone maps endpoint findings against regulatory and industry compliance standards, giving administrators a structured view of their organization’s compliance posture across managed assets. This update adds two new compliance standards, now available across the Findings, Identity risks, and Compliance manager pages: - **BNM RMIT 2025 (MY):** Issued by Bank Negara Malaysia (BNM), the Risk Management in Technology (RMiT) policy document sets out requirements for financial institutions on technology risk management, covering technology governance, cybersecurity management, and operational resilience. - **CSA Cyber Trust 2025 (SG):** Issued by the Cyber Security Agency of Singapore (CSA), Cyber Trust is a risk-based certification mark for organizations with extensive cybersecurity measures and practices. The 2025 edition extends coverage to cloud, operational technology (OT), and AI security. In addition, a new **Notes** column and filter on the **Compliance manager** page let administrators add and view notes for individual controls, such as justifications, context, or links to external documentation. Control notes can also be included when exporting compliance reports in PDF or XLSX format. For comprehensive insights into Compliance Manager, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=recorded&search=compliance). ## Security Telemetry Enhancements Organizations that correlate endpoint activity in their own Security Information and Event Management (SIEM) platform depend on the range and naming of the events they receive. [Security Telemetry](https://www.bitdefender.com/business/support/en/77209-342928-security-telemetry.html) forwards raw operating system events from endpoints running BEST to a third-party SIEM. Administrators configure it in the Policy under General \> Security Telemetry, where they select the event types to send. This release groups all events by category, adds descriptions for every category and event, and extends coverage with additional event types. The **Security Telemetry** page now lists event types under named categories. Each category and event has a description, so administrators can see what an event captures before turning it on. The following categories and event types are now available: - **Service:** Added, Change status, Modify. - **Scheduled task:** Create, Delete, Modify. - **Account management and authentication:** Create local account, Delete local account, Logon failed, Settings changed. - **Shell and script activity:** Command Prompt command, PowerShell command, PowerShell script block logging, Antimalware Scan Interface (AMSI) buffer. - **Background Intelligent Transfer Service (BITS) job activity:** Add file, Create, Delete. - **Windows Management Instrumentation (WMI) activity:** Execution method, New activity, New binding. - **Device and driver:** Driver module load, Hardware mount, Hardware unmount. - **BEST agent:** Agent uninstall request. - **Audit policy:** Change Windows audit policy. - **Process:** Injection. Existing event types now sit within the new categories under shorter names: - **Process:** Create and Terminate, previously Process creation and Process deletion. - **File:** Create, Delete, Modify, Move, and Read, previously File creation, File deletion, File modification, File move, and File read. - **Registry:** Create key, Delete key, Modify value, and Delete value, previously Registry key creation, Registry key deletion, Registry value modification, and Registry value deletion. - **Account management and authentication:** Logon, and Logout (renamed from Logoff). - **Network:** Connection and DNS query. With command-line, PowerShell, and AMSI buffer events added next to service, scheduled task, and WMI activity, a SIEM can now correlate script-based execution with the persistence mechanisms that commonly follow it. Examples include a PowerShell command that registers a scheduled task, or a new WMI binding created shortly after an AMSI buffer event. ## Firewall for macOS Organizations that run mixed Windows and macOS fleets can now apply the same network traffic controls across both platforms. The GravityZone Firewall gives administrators granular control over network traffic, including which services and applications can communicate. The module, previously available on Windows servers and workstations, now also supports deployment and management on macOS endpoints. Also, macOS support for the Firewall module carries through the Control Center areas that already handle Firewall on Windows: policy settings, installation packages, **Threats Xplorer**, **Executive summary**, **Network**, **Reports**, **Dashboard**, **Health dashboard**, **Notifications**, **User activity**, and the public API. The module requires BEST for Mac version 8.26.10.2000xx or later. Policy rules now account for the platform they target: - **Platform column:** The **Policies \> Firewall \> Rules** table includes a new filterable **Platform** column that shows which operating system each rule applies to. - **Existing rules:** All rules previously defined in a policy are automatically set to **Windows** as their default platform. - **Protocol support:** The complete list of macOS-supported protocols is available on [Bitdefender Support Center here.](https://www.bitdefender.com/business/support/en/77209-342962-rules.html) The rollout of the Firewall module on macOS endpoints will take place in phases, so availability in individual environments may follow the console update. ## Service API Keys Automated integrations such as SIEM connectors, ticketing systems, and orchestration scripts often run on API keys tied to an individual user account, so the integration’s access depends on that user’s account and permissions. GravityZone now introduces dedicated service API keys and associated service accounts that manage automated integrations and API access independently of user API keys. Service API keys are managed from the new **Accounts \> Service API keys** page, with options to create, edit, clone, suspend, activate, and delete keys. You can configure each key with specific API module permissions, a target company and folder scope, and an expiration period of 1 to 365 days. Access to the page is controlled by the new **Manage service API keys** permission, available in the user account settings under **Accounts**. Key lifecycle events are recorded in the **User activity** log, and administrators can receive email and Control Center notifications before keys expire. This keeps integration access auditable and scoped to the companies and API modules each integration needs. More information about service API keys can be found on the Bitdefender Support Center [here](https://www.bitdefender.com/business/support/en/77209-1658556-service-api-keys.html). ## API Enhancements [Bitdefender Control Center APIs](https://www.bitdefender.com/business/support/en/77209-125277-public-api.html) enable developers to automate business workflows. These APIs are exposed via the JSON-RPC 2.0 protocol. You can find usage examples and documentation in our Support Center, located [here](https://www.bitdefender.com/business/support/en/77209-125277-public-api.html). This update introduces new methods, push events, and response parameters to support incident assignment and tracking, service API key permissions, scan task visibility, network inventory, and macOS package configuration. - **Incidents:** The new assignIncident method assigns and reassigns Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) incidents to eligible GravityZone users in bulk, and also removes assignees. All assignment changes are recorded in the **Incident history** panel and on the **User activity** page in GravityZone Control Center. Actions performed by Managed Detection and Response (MDR) analysts are attributed to an **MDR Service** account. - **Event Push:** Six new Event Push API events report EDR and XDR incident updates: incident-status-changed, incident-assignee-changed, incident-priority-changed, incident-note-created, incident-note-updated, and incident-note-deleted. They are turned on through the existing setPushEventSettings method. The **Task Status** push event payload now also includes the parentTaskId parameter for correlating parent tasks with their child subtasks. - **Companies:** The getCompanyDetails method now returns the status of companies undergoing migration between partners instead of a generic error. - **Accounts:** Accounts API methods now support the manageServiceAPIKeys permission, which corresponds to the **Manage service API keys** permission described in the Service API Keys section above. The createAccount, updateAccount, getAccountsList, and getAccountDetails methods now accept and return the updated role identifiers used with service API keys. - **Network:** The getTaskStatus response now includes the subTaskId (unique child task identifier) and scanType parameters in the subtasks object for scan tasks (Type 1). This identifies the scan type: Quick Scan, Full Scan, Custom Scan, Network Scan, Memory Scan, or YARA Scan. The getEndpointsList and getNetworkInventoryItems methods now also return the endpoint’s public IP address in the publicIp parameter. - **Packages:** The createPackage, updatePackage, and getPackageDetails methods now support configuring and installing the Firewall module on macOS endpoints. For comprehensive insights into the GravityZone API, we invite you to watch our masterclasses [here](https://www.bitdefender.com/en-us/business/masterclass?sessions=recorded&search=API). ## Where Can I Learn More About Bitdefender GravityZone? To learn more about the Bitdefender GravityZone platform, [contact us](https://www.bitdefender.com/business/products/inquire/business-security-enterprise-inquire.html) or a Bitdefender partner for more information. You can also start a free trial by requesting a demo [here](https://www.bitdefender.com/business/products/free-trials/). The Bitdefender GravityZone unified security platform offers a one-stop solution for all your organization's security needs. As the digital landscape evolves, Bitdefender stays ahead, providing prevention, protection, detection, and response capabilities to help keep organizations of all sizes worldwide safe. [View full post](https://businessinsights.bitdefender.com/whats-new-in-gravityzone-october-2026) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Grzegorz Nocoń" }, "dateModified" : "2026-10-21T16:18:05.312Z", "datePublished" : "2026-10-21T15:59:28Z", "headline" : "What’s New in GravityZone October 2026 (v 6.78)", "image" : { "@type" : "ImageObject", "height" : 1024, "url" : "https://businessresources.bitdefender.com/hubfs/Bitdefender%20GravityZone%20Update%20Oct26.png", "width" : 1535 }, "mainEntityOfPage" : "https://businessinsights.bitdefender.com/whats-new-in-gravityzone-october-2026", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60.0, "url" : "https://cdn2.hubspot.net/hubfs/341979/PAN/ransomware/header-1.jpg", "width" : 304.3478 }, "name" : "Business Insights" } } ```