October 2026 release notes

October focused on access, capacity and trust. Passwords are gone, roles follow the tier a user works at, and every tenant now runs within a daily ingest allocation with early warnings.

Access and roles

• No more passwords. Users sign in with a one-time code sent by email, then a code from an authenticator app. The second factor is now required for every user, not only administrators, and a user without one sets it up before getting a session. Password sign-in and password reset are gone, and new tenant administrators are no longer sent a temporary password.
• Recovery and lockout. Recovery codes can be entered on the authenticator step. Failed recovery codes count towards the same lockout, and a recovery code entered while locked is not used up.
• Admin help. A platform administrator can unlock any locked user; MSSP admins can do this only for their own tenants. A platform administrator can reset a user's second factor after confirming with their own code, and the user is emailed.
• Tier-aware roles. Analyst, senior analyst, auditor and service roles work at every tier. Every MSSP role gets a tenant switcher. An MSSP cannot read the data of a tenant that runs its own SOC.
• Controls on configuration, not SOC work. Analysts can update incidents, run playbooks, manage threat indicators and run threat hunts. A disabled playbook can no longer run.
• Clear ownership. The platform team cannot change settings, users or agents inside a client tenant. MSSPs, not the platform, create client tenants.

Capacity and licensing

• Daily allocations. Each tenant runs within a daily ingest allocation set by its MSSP, inside the MSSP's overall envelope. Data over the limit is dropped and counted. A tenant without an allocation is refused until one is set, and collectors hold their data instead of retrying.
• Early warnings. Tenant and MSSP admins are emailed at 80% of the allocation and again when data is being dropped.
• MSSP overview. A new column shows how much each tenant dropped today. Dropped data is not billed.
• Licence page. Platform administrators can see licence status, its terms and current use against limits. A new licence can be installed without a restart. Editions are MSSP and Enterprise, and expiry raises alerts.

Collection and parsing

• Parser Factory learns from unparsed events. It now collects stored events that no parser recognised and groups them by device type and shape. A new shape goes live only when it passes the quality gate. Otherwise it is held back and parses nothing.
• One parser per device type. Shapes the Parser Factory learns are added to kymeer's shared parser for that device type, so every tenant with the device benefits. A shared parser never contains log lines or the identity of a contributing tenant, and each promotion is recorded in the audit log of every tenant whose logs contributed.
• Nothing silently lost. Values a generated parser does not map stay on the event as unmapped fields.

Governed AI

• Clear AI notices. When AI cannot help, kymeer says why: switched off, not configured, timed out, rate limited or a provider error. You can retry where that makes sense.
• Built-in masking, always on. Before any model call, kymeer replaces each IP address, MAC address, hostname, email address and user name it recognises with a numbered stand-in, such as IP_1 or HOST_2, and puts the real values back in the answer before you see it. The list linking stand-ins to values stays in memory for that one call. The "redact identifiers" setting is now a note that masking is always on; any extra patterns you add still apply.
• One switch for everything. Background AI services now follow the live egress switch too.
• Ask without AI. Ask kymeer's rules planner now understands IP addresses and hostnames typed into a question.

Reliability and audit

• Contained failures. A record that keeps failing is set aside and an alert is raised. It no longer stops a background job for everyone else.
• Honest numbers. When kymeer cannot read a figure, it shows it as unknown, not as zero.
• Email delivery record. Every notification email is recorded per recipient, including failed sends.
• Sigma import. Documents up to 1 MiB now import, and documents that are nested too deeply are rejected with a clear error.