Tanium Cloud Release Notes External Attack Surface Management
Product Documentation and Resources
Release Date: August 17, 2026
New Features
Manually Add Seeds via Seed Configuration panel
You can now add seeds to your attack surface directly from the Seed Configuration panel, without prompting Atlas. Open the Attack Surface Configuration template and enter seeds as a comma-separated list, domains, IPv4 or IPv6 CIDRs, and IP ranges addresses are all supported, or upload a CSV to add up to 500 seeds in one batch.
Cloud Connectors
Cloud Connectors as automatic needs now support Microsoft Azure alongside AWS, so you can enable an Azure integration profile as a seed source and automatically feed your Azure-hosted internet-facing assets into attack surface discovery. Seeds added through a cloud connector are now labeled with their origin, such as an AWS cloud integration, wherever they appear in the Discovery Path panel, making it easy to tell which seeds were added automatically versus manually.
Improvements
- Updated the misconfiguration OWASP Top 10 category mappings.
- Added a hover tooltip on misconfiguration category pills that shows the full OWASP category name.
- Restored CVE-based counting for web property vulnerability counts so they match the drill-in totals.
- Added a direct link from the Cloud Connectors panel to the provider's Configuration tab in the Integrations Gallery.
- Added filtered-of-total counts (for example, 85 of 1,234) to EASM findings and inventory tables.
- Unified the hover-reveal behavior for overflow chips across Host Inventory and extended it to Misconfigurations.
- Removed the redundant Services count column from Host Inventory and made Port/Service sortable by service count.
- Added a hidden, sortable Created On column to the Seeds panel and fixed the View Cloud Connectors link styling.
- Removed a stray inset border from the Cloud Connectors panel.
- Shortened the Attack Surface Inventory panel and redesigned its no seeds empty state with a link to attack surface configuration.
- Moved panel descriptions into the Atlas panel header for a more consistent layout.
- Added a success confirmation when removing an entity from exclusions.
- Improved keyboard and pointer accessibility for the severity chart drill-down in the Vulnerabilities by Severity panel.
- Persisted row-expansion state for the Exclusions and Seeds list panels.
- Extended malformed-ID validation and error handling to the Discovery Path, Certificate Details, and Web Property Details panels.
- Improved cloud connector seed sync reliability so a temporary sync error no longer removes seeds that are still valid.
- Moved detail panel action buttons into a sticky footer on the Certificate, Host, and Web Property detail panels.
- Aligned Atlas panel titles with their component names to remove duplicate header labels.
Resolved Issues
- Fixed an issue where the Cloud Connectors AWS coverage column was labeled Accounts while Azure showed Total Subscriptions. It now reads Total Accounts for consistency.
- Fixed an issue where the Open Ports, Vulnerabilities, Misconfigurations, and Web Property panels reset column widths to their defaults after applying a filter.
- Fixed an issue where the Seeds panel's hidden Date Added column had no way to be shown or persisted.
- Fixed an issue where the Exclusions list column label Date Excluded didn't match the row detail panel's Excluded On label.
- Fixed an issue where the Host Inventory DNS Names column understated the DNS name count on hosts with more than 100 names.
- Fixed an issue where the Certificate Details panel failed to load presenting hosts and web properties for certificates with related services.
- Fixed an issue where the plus-count overflow pill was cut off in the Vulnerabilities and Misconfigurations columns on the Host and Web Property inventory panels.
- Fixed an issue where the Attack Surface Overview and Attack Surface Configuration panels had no title.
Release Date: July 31, 2026
New Features
Exclusion List
You're now in full control of what counts as your attack surface. Exclude any host, certificate, or web property to remove it and keep it out of future discovery, so your attack surface stays accurate and free of extraneous assets. Managing exclusions, whether adding, reviewing, or removing them, is entirely up to you.
Cloud Connectors
Cloud Connectors introduce Tanium's first automatic seed integration, starting with AWS. After enabling an AWS integration in the Integration Gallery, activate its profiles as Cloud Connector seeds to automatically feed your internet-facing cloud assets into attack surface discovery, expanding visibility beyond what you'd catch by adding seeds manually. Connector status is always visible, so you know what's active and inactive.
Attack Surface Configuration Template
The Attack Surface Configuration template accelerates your path to visibility into your external attack surface. It guides you through the onboarding workflow, covering what a seed is, how to add one via Atlas chat, and where to check on discovery status, and includes sample prompts you can use right away to start asking Atlas questions about what's been discovered.
Attack Surface Overview Template
The Attack Surface Overview template gives you an executive-level view of your external attack surface, an all-in-one page to get started and gain critical visibility into your exposures, including open ports, expiring certificates, misconfigurations, and vulnerabilities.
Improvements
- Improved the Software section on asset pages with clearer formatting and a link to view other assets running the same software version.
- Aligned the Seeds List loading, empty, and error states with the Host, Certificate, and Web Property inventories.
- Added ascending and descending sort to the Critical Findings column in Host Inventory.
- Added support for IPv6 CIDR ranges as attack surface seeds.
- Added support for subdomains as attack surface seeds.
- Improved the DNS Names column formatting in Host Inventory to make truncated values easier to scan.
- Added a Not-contains (exclude) filter for the IP column in Host Inventory.
- Improved the discovery path view to show the reason for each pivot and clearly distinguish seed, discovery hop, and web property nodes.
- Standardized terminology and messaging across the Host, Certificate, and Web Property inventory and detail views.
- Vulnerabilities are now enriched on host/web property detail panels with CVSS score, EPSS score, and exploit maturity.
- Finding the Discovery Path on asset details panels is more apparent.
- Added the ability to bulk select and delete in the seeds list.
Resolved Issues
- Fixed an issue where the Host Details AI overview could understate a host's critical and high-severity findings due to a query row limit.
- Fixed an issue where the DNS Names tooltip in Attack Surface Inventory could not be scrolled when a host had many DNS names.
- Fixed an issue where invalid entity or seed type values returned an incorrect error type instead of a clear validation error.
- Fixed an issue where the Host Details AI summary failed to load for hosts with a malformed IPv6-based asset ID.
- Fixed an issue where IPv4-mapped IPv6 addresses could be added as seeds and silently stored in their IPv4 form.
- Fixed an issue where long identity values such as URLs, IPv6 addresses, and issuer names could overflow and overlap adjacent text in the Host, Certificate, and Web Property detail panels.
- Fixed an issue where the standalone Web Property Inventory panel did not refresh automatically after seed changes.
- Fixed an issue where the Host Inventory page could fail to load results due to a query compatibility issue.
- Fixed an issue where the Certificates Discovered in Past 7 Days card was out of order compared to the Host and Web Property inventories. It now appears in the same rightmost position.
- Fixed inconsistent vertical alignment of cell content across Host Inventory table rows.
- Fixed an issue where Host Inventory quick search could match values in hidden columns.
- Fixed an issue where the Created By and Updated By fields on seeds could appear without the display name of the user who made the change.
- Fixed an issue where loopback and link-local IPv4 address ranges could be added as CIDR seeds even though the equivalent single IP addresses were correctly rejected.
- Fixed an issue where narrow default column widths truncated Common Name and Issuer values in Certificate Inventory.
- Fixed an issue where creating a seed incorrectly required a description field.
- Fixed an issue where the Atlas overview for Web Properties could report incomplete or incorrect findings counts due to a query row limit.
- Fixed an issue where global and administratively-scoped multicast addresses could be added as seeds.
- Fixed an issue where Certificate Inventory quick search did not match values in the Presenting Entity or Port/Service columns.
- Fixed an issue where the Certificate Details panel always showed 0 entities under Entity Relationships, even when the certificate had presenting entities.
- Fixed an issue where the Certificate status tooltip and remaining lifetime field could show inconsistent day counts for certificates expiring the same day; expiration is now shown down to the minute.
Release Date: July 1, 2026
Improvements
- Improved DNS name display in the host detail view from a comma-separated string to a scannable list.
- Updated vulnerability and misconfiguration lists on web property and host detail panels to sort by severity descending and display each CVE as a single identifier.
- Updated Host Inventory to reflect all agent-applied column filters in the grid header, including findings-count filters.
- Updated Web Property Inventory to expose all column filters, including findings-count and severity filters, to the Atlas agent.
- Improved Host Inventory search bar performance by optimizing the underlying graph query.
- Improved performance of the Hosts with Critical Findings metric by optimizing the critical-severity query.
Resolved Issues
- Fixed an issue where the Certificates Expiring Soon metric counted already-expired certificates in addition to certificates expiring within the next 30 days.
- Fixed an issue where host vulnerability counts were capped at 100, causing actual finding totals to be under-reported in the inventory table and host details panel.
- Fixed an issue where the year field in date filters accepted more than 4 digits, causing filters to evaluate incorrectly.
Release Date: June 30, 2026
Improvements
- Added a Misconfigurations column to the Host Inventory table with sort support.
- Updated the Host Inventory findings count to include misconfigurations, matching the detail panel.
- Added Port/Service column to the Host Inventory table.
- Added sort and filter support for date columns across Host, Certificate, and Web Property inventory tables.
- Added date filter support for First Seen and Last Scanned columns in the Web Property inventory table.
- Aligned the quick filter, refresh, and clear filter controls across all inventory views.
- Aligned loading state and overlay behavior across Host, Web Property, and Certificate inventory views.
Resolved Issues
- Fixed an issue where the Host Details panel would get stuck loading and not display content.
- Fixed an issue where column widths reset to their default values after applying a filter or sort.
- Fixed an issue where programmatically-applied date filters in Certificate Inventory did not display their date value in the column filter menu.
- Fixed an issue where the Certificate Inventory filter indicator shifted position when toggling summary tiles.
- Fixed an issue where the AI summary was not auto-generated when opening web property details from the inventory table.
Release Date: June 19, 2026
Features
Tanium External Attack Surface Management (EASM) is an Atlas-first solution that gives security teams continuous visibility into their organization's internet-facing attack surface (hosts, web properties, and certificates). With access to contextualized EASM data, Atlas enables security teams to ask complex questions and get actionable answers about their attack surface.
- External Asset Inventory: An inventory of internet-facing hosts, web properties, and certificates associated with your organization, seeded from configured domains and IP ranges and refreshed every 6–8 hours. Users can search, filter, and browse all EASM asset types from Atlas.
- Asset Investigation: Drill into any external asset to see its full context, including open ports, running services, identified software, TLS certificates, and discovery path, so users can assess exposure details and understand how an attacker sees a specific asset.
- External CVE Findings: CVEs associated with externally-facing assets to show real-world exploitability so that remediation focuses on exposures that are both internet-exposed and actually exploitable from the inside.
- HTTP Header & Service Risk Findings: HTTP header-based and service-level risk findings across external web properties and hosts, including missing security headers, insecure configurations, and exposed protocols.
- Role-Based Access Control: Administrators can grant and restrict EASM access by role, separating read from write and user from operator, so security teams can safely extend external visibility.
Configuration Notes
Tanium External Attack Surface Management is built natively in Tanium Atlas, the modern, AI-powered console that brings investigation, prioritization, and action together in one place. EASM's inventory, investigation, and findings surfaces are designed from the ground up for the Atlas experience, taking full advantage of Atlas's natural-language search, contextual navigation, and unified workbench.
Customers must configure at least one seed (domain, IP address, or IP range) through the seed configuration settings before asset discovery begins. Seed configuration is handled through the EASM settings in Atlas.
Requirements
- Tanium Data Service (TDS) 4.4 or later
Known Issues
- The Host Details panel is not loading properly.