Product Updates

Each release below is shown in StyxView as "Product Updates" when it reaches your account. The newest release comes first.

Version 3.24

Released on 2026-Sep-28.

AI Features

Iris in the left menu, and as a full page. Iris now sits second in the left-hand menu, directly under "Dashboard", and opens as a full page with the menu and top bar still in place. From the side panel, "Open Iris as a Page" does the same, and the Iris icon in the top bar takes you back to the page you were on.

Iris can act on findings. Ask Iris to comment on findings, change their status, assign them, or mark them as "False Positive", "Accepted Risk", "Legitimate", "Brand Infringement", or "Watchlist", and it sets the change out on a card for you to confirm. Nothing changes until you press "Confirm", the change is made as you with a comment posted to each finding, and one request covers up to 10 findings for now, and we will be raising that limit soon.

AI Overviews go deeper on attack surface findings. A finding's AI Overview now adds two sections, "How to Fix" and "Applicability". "How to Fix" says where the change is made, from what is detected on the host, and gives the steps for that setup, such as Apache, Nginx, IIS, cPanel, Plesk, or Cloudflare, or the DNS host that serves your records. When the change belongs to a provider, or there is nothing to change, it says so. It ends with how to check the change worked, and names the other hosts on the same server that the same change clears. "Applicability" says whether a vulnerability really applies to you: when the detected version cannot settle it, as with Apache on Ubuntu, it explains why and asks for the package version rather than guessing.

"Continue in Chat" from a finding's AI Overview. On a finding's details page, "Continue in Chat" moves the AI Overview into the Iris panel as its first message, so your follow-up questions already know which finding you mean.

"Past Conversations". Iris keeps your recent conversations for the account you are in. "Past Conversations" in the panel header lists them so you can pick one back up, and after a refresh Iris reopens the conversation you were in.

Hover a host or a finding in an answer. Hosts, addresses, and findings named in an Iris answer show a preview when you hover them, with "Open in a New Tab", and "Attach to the Context" to include it in your next question.

Findings

A clearer finding details page. A finding's details page is now much shorter and reads top to bottom. "Status", "Severity", "First Seen", and "Last Seen" sit together at the top, with any disposition you have set, such as "False Positive" or "Accepted Risk", shown beside them. Comments sit next to the finding they are about, and the tables that used to run further down the page read as simple lists and checklists.

Third Party Risk

Questionnaire scoring. A questionnaire template can now be scored. On the "Templates" tab of "Questionnaires", the star on a template opens its "Scoring" tab, and "Answer Sets" set how each answer counts toward the score.

"Third Party Risk Summary", a one-page report. A new report puts the Third Party Risk dashboard's headline charts on a single A4 page: "Third Parties by Risk", "Risk Matrix", "Automated Risk Exposure", and "Questionnaire", with the same figures the dashboard shows and a short note on how to read the Digital Risk Rating bands. Generate it from "Reports" like any other report.

Reports

Create an export from the table you are looking at. The "Export" icon on Findings, Alerts, Advanced Stealer Logs, Compromised Accounts, Social and News, Rogue Mobile Apps, Vulnerabilities, and other tables now opens "Create Export". Choose CSV or XLSX, run it once or on an hourly, daily, weekly, or monthly schedule, and take everything in view or only rows first seen in a period. Collect it from "Generated Exports", or have a secure link emailed as well: links expire after 7 days, need a StyxView login, and files are never attached.

Platform

API keys, scoped by solution. On the "API Keys" tab under "Configuration", then "Integrations", an administrator can now create a key for only the solutions it needs: Company Protection, Executive Protection, or Third Party. A key returns data for its own solutions and nothing else, and its value is shown once, when it is created.

Response Actions / Takedowns

Simpler takedown requests. A takedown can now be requested without a description or an evidence file. Both are still recommended, but neither is required. The request dialog also answers the questions we hear most often: "What Counts as Evidence?", "What Happens Next?", and "Can I Withdraw This?"

Data Leakage and Dark Web Detection

"Assign User" on Advanced Stealer Logs. On an Advanced Stealer Logs record, "Assign User" links it to one of your monitored accounts, so the record shows whose credentials were exposed. The assignment can be changed later.

Version 3.23

Released on 2026-Sep-14.

Platform

StyxView in your language. The platform is now available in French, Spanish, Portuguese and Arabic as well as English, including every table header, dashboard, dialog and tooltip. Arabic lays the whole platform out right to left. Choose a language from Language in your profile menu at the top right; your choice is saved to your account, so it follows you between browsers and devices. Support for more languages is coming soon.

A sidebar that collapses to a rail. Collapse the sidebar from its foot, its right edge or with Ctrl + B (Cmd + B on a Mac) and it becomes a slim rail of your top-level sections, giving the page back its width without losing the navigation. Hover any section and the whole branch opens in a panel, so the deepest page is two clicks away instead of four. The top bar now names the project you are in, and its controls share one style.

StyxView on a phone and a tablet. The header, controls and tables now adapt to a phone or tablet screen, so a finding, an alert or a risk score can be checked from wherever you are, from the same address you use at your desk. More look and feel enhancements are on the way.

Explanatory tooltips across the platform. Column headers, cards, charts and detail fields carry an explanation of what the value means and where it comes from, wherever the value is not self-evident. Hover the marker beside a label to read it.

Find any page with Ctrl + K. Press Ctrl + K (Cmd + K on a Mac), or use the search field in the top bar, and type the name of any section, page or in-page tab to jump straight to it. The palette only ever offers pages your account can open.

A simpler sign-in. Enter your work email and Continue takes you to the right step for your account, single sign-on or password, with a one-click switch to the other. The sign-in screen also follows your light or dark preference.

Smoother loading. The header, navigation and breadcrumbs appear at once, and each card fills in as its data arrives, with a placeholder holding its place in the meantime. Tables do the same when you change page, filter or search, so the layout holds steady while the content catches up.

Open a tab in a new browser tab. Middle-click or Ctrl + Click (Cmd + Click on a Mac) any tab across the platform, the way you would any link, and keep the page you are on: compare two Monitored Assets tabs side by side, or keep Compromised Accounts open while you read Breach Source Summary.

A clearer Subscriptions page. Subscriptions opens with your plan, its term and its status, then sets out what your plan covers and what you have used against it. Switch between By solution and By limit.

Policy Configuration

Policy page redesign. Sections sit on a vertical tab rail, and Domains, Hosts, Social Media, Mobile Apps, User Accounts, Job Posting Channels, Credit Cards, IP Addresses and Keywords all use the standard table, with the same filtering, search, density and full-screen controls as the rest of the platform. Networks and app stores are shown by their mark, Basic Information is laid out in aligned groups, and the Summary tab shows what is configured, what is with our team for review, and what is saved but not yet submitted.

Add rows from the keyboard. While adding assets to a section, Ctrl + Enter (Cmd + Enter on a Mac) saves the row you are on and opens the next one, so a list of assets can be entered without reaching for the mouse.

Clearer review status. A submitted policy now says who is holding the change, which request it belongs to, and why each asset is checked before it reaches the scanners. Statuses read Pending StyxView review while our team looks at a change, then Approved or Denied.

Response Actions / Takedowns

Attach evidence to a takedown request. Requesting a takedown on an Unauthorized Job Posting, Rogue Mobile App, Account Impersonation, Potential Employee Profile or Lookalike Domain finding now lets you attach evidence of the infringement and add supporting context, then confirm before it is submitted, so a request can reach our team with what it needs to act on. Bulk takedown requests are coming very soon.

Brand Protection

An ownership check before Mark as Legitimate. Marking a finding as legitimate, from a table or from its details page, now asks you to confirm that the account or asset belongs to your organization before it is cleared.

Data Leakage and Dark Web Detection

Active Directory sync status on Accounts Monitored. Accounts Monitored shows whether Active Directory sync is connected for the account, and where it is, a monitored account's details include the date of its last password reset.

Version 3.22

Released on 2026-Aug-28.

Platform

Iris, the new AI copilot. Ask questions about your findings, risk scores, and remediation in plain language, and get a direct answer instead of moving between modules to assemble the picture yourself. Iris opens from "Iris - AI Assistant" at the top right of the platform and appears as a side panel alongside the page you're viewing, so you can ask a question without navigating away or losing context. Every finding also gets an AI Overview on its details page: a generated summary of what's known about it, ready as soon as you open it.

Self-service REST API key management, under Configuration, then Integrations. Generate and reset your own API key without raising a request with the support team. Reveal or copy the key in one click, and reset it at any time for routine rotation or if a key is compromised.

Right-click actions now cover multiple records at once, across every table in the platform. Select a set of rows and right-click within the selection to apply an action to all of them in a single step.

Findings page redesign. Stacked filter cards are replaced by a compact set of controls at the top of the page, giving more room to the results themselves. Solution filtering moves to a tab bar, including a new All Solutions tab for reviewing findings across every solution at once.

Digital Risk Score

Historic Risk Score. A new tab on Digital Risk Score shows how your risk score has moved over time, and exactly what drove the change between any two scans. The timeline plots the last 30 days of runs: drag across it to pick a range, or choose any two runs from the From and To lists, including runs older than the charted window. The risk framework runs more than once a day, so each run is identified by its date, time and refresh number. The comparison then breaks the change down by category and by indicator, with the grade, score and finding-count movement for each, and opens all the way down to the individual findings behind it, with a link through to those findings.

Policy Configuration

Edit your own policies, under Configuration, then Policies. Selecting the edit icon next to a policy opens every section except Basic Information for editing, so monitoring coverage can be adjusted as your organization changes without emailing StyxGuard@styxintel.com (opens in a new tab) to request the change. Basic Information stays managed by Styx Intelligence; to update it, contact StyxGuard@styxintel.com (opens in a new tab). A change you make shows a Pending status while our team gives it a quick review, then Active once it's added to monitoring. A new Change History tab records every edit made to the policy, giving a complete audit trail of what changed and when.

Third Party Risk

Reviewers can edit and delete their own questionnaire comments. An edited comment shows the date it was last updated.

New Overall Feedback view on completed questionnaires. A Feedback option in the top right of a Completed questionnaire's details page opens the reviewer's closing feedback.

Create Risk Register entries directly from a third-party questionnaire response. Tie the entry to one specific answer or to the response as a whole, with that link shown back on both the risk and the questionnaire.

Two-way ITSM ticket sync for alerts. If you've connected an ITSM system, the status of a ticket raised from a Styx alert now syncs back automatically, so the alert reflects what's actually happening in your ticketing system without a manual check.

Data Leakage and Dark Web Detection

Infostealer exposure data for third parties. New widgets on the third-party Data Leakage page and a new section on third-party vendor reports show compromised employees, compromised users, and exposed third-party credentials for a vendor, sourced from infostealer intelligence.

Disinformation

Disinformation, a new add-on module. Monitor for coordinated inauthentic activity and disinformation campaigns targeting your organization's executives and brand across social media. Available as an add-on to your subscription. Reach out to your Styx Intelligence account team or StyxGuard@styxintel.com (opens in a new tab) for a demo.

Version 3.20

Released on 2026-Jul-31.

Third Party Risk

Questionnaire email theming. Emails sent as part of the third-party questionnaire flow now carry your organization's branding.

Brand Protection

Potential Employee Profile is now its own finding type. Separated out from general Social Media Account Impersonation, it can be marked as brand infringement the same way Account Impersonation already can.

Version 3.19

Released on 2026-Jul-24.

Reporting

Report branding, under Customization, then Reports. Choose from several report templates, upload your own logo, and set a custom footer, so a generated report carries your organization's look rather than Styx Intelligence's defaults. One-time reports can also be generated for a specific start and end date instead of the default period.

Attack Surface Management and Data Leakage

Server-side export for Vulnerabilities and Compromised Accounts. Both can now be exported the same way as other modules.

Third Party Risk

Add a risk to the Risk Register at the account level. A risk can now be tied to a specific third party from the Risk Register itself, without going through that third party's own page first.

Version 3.18

Released on 2026-Jul-16.

Platform

Full screen and density options on every table. Expand any table to full screen, and choose how much information is shown at once with a new density control.

Right-click actions in tables. Right-click a row to act on it directly, without opening the row or reaching for a toolbar button.

Self-service Postman collection. A Download Postman Collection button is available under Configuration, then Integrations, so you can start testing the API immediately.

Cyber Insights

A new IOC page. Indicators of compromise now have their own page under Cyber Insights, rather than being folded into another view.

Attack Surface Management

A Supported Protocols column on TLS/SSL Certificate Issues. Shows which protocols a certificate supports alongside its other detail.

Two new DNS Health findings. SPF record contains a wildcard and SPF Softfail, so a permissive or partially-enforced SPF record is flagged instead of only a fully missing one.

Digital Risk Score

The Risk Rating Over Time chart now plots every run. rather than one point per day, on the dashboard overview, the Company Protection overview, and the third-party overview.

Data Leakage and Dark Web Detection

Advanced Stealer Logs added to the Company Protection Data Leakage overview. The Data Leakage overview layout was also updated across Company Protection and Third Party.

Alerts

Alert Rules refinements. An Info severity option was added alongside the existing severity levels, the Accounts scope is now labelled Projects to match the rest of the platform, and Third Party selection now auto-selects.

Version 3.07

Released on 2026-Jun-23.

Platform

Granular, module-level role-based access control. Users can be granted access to individual modules independently, so someone can be given Brand Protection without also receiving Data Leakage and Dark Web Detection, Attack Surface Management, or Social and News.

Multi-factor authentication improvements. A refreshed setup and verification experience:

"Can't scan the QR code?" reveals the secret key for manual entry into any authenticator app, with one-click copy, so the key never has to be transcribed by hand.
Authenticator codes can be pasted directly into the verification screen instead of being typed digit by digit.
A countdown shows how long remains before verification expires. When it runs out, the Verify button becomes Return to sign in, so a stalled attempt has an obvious way forward.

Dark mode. Light and dark themes can be switched from the upper right of the header.

Table readability and filter values. Table views were reworked to be easier to parse, and setting a filter now presents its values more clearly.

Data Leakage and Dark Web Detection

Active Directory Sync. StyxView can connect directly to your Microsoft Active Directory so findings reflect your current workforce. Findings tied to employees who have left generate noise that hides the ones that matter; once connected, findings for inactive users are suppressed on a schedule. Set it up under Configuration, then Integrations, using Sign In With Microsoft under AD Sync with a Microsoft Entra administrator account.

Brand Protection and Executive Protection

Screenshot previews. Screenshots are available as a dedicated column on Domain Impersonations, Account Impersonations, Rogue Mobile Apps, and Unauthorized Job Postings. Hovering a thumbnail expands it, so a finding can be assessed visually without opening it.

Third Party Risk

The Risk Register. A single place to record and work the risks you identify across your third parties. Log a risk with a title, description and category, set an owner, rate its inherent likelihood and impact, record the treatment option and plan, and track it to a target resolution date with a next review date and a status.

Third party descriptions can be edited. Descriptions are editable from the Change Description menu on the third party page.

The Show Description column can be hidden. on the Third Parties listing page.

Third Parties listing export. Listing data can be exported for reporting and analysis.

Documents and expiry dates. A configuration under Contracts tracks documents such as attestations and contracts along with their expiry dates, and alerts can be set for upcoming expirations.

Social and News Content. Search Social and News is renamed Social and News Content and carries two tabs: the original card view, and a new tabular view matching the table layout used by other modules.

False positive filtering. False positives can be filtered within Social and News Content, and a finding flagged as a false positive shows an orange border on the left of its card.

Version 2.21

Released on 2026-Mar-03.

Attack Surface Management

New Attack Surface Management dashboard. A reworked landing view for the module.

Owned Domains details page. Additional detail on the owned-domain record.

EPSS score and percentile on vulnerabilities. Vulnerabilities now carry the Exploit Prediction Scoring System score and percentile alongside severity, so triage can weigh likelihood of exploitation rather than severity alone.

Brand Protection

Letter of Authorization documents moved under Brand Protection. The documents section now sits with the module that uses it, rather than in general configuration.

Third Party Risk

Third Party Risk enhancements. Improvements across the third-party surfaces.

Reporting

Reporting module enhancements. Changes to report generation and output.

Platform

Column reordering and saved views. Columns can be reordered on a grid, and a configured view can be saved and returned to, so a layout tuned for a particular investigation survives leaving the page.

Enhanced column visibility on main pages. More control over which columns appear on the primary listing pages.

Finding-related actions. Changes to the actions available directly from a finding.

Risk indicator sorting on the Digital Risk Score page. Indicators can be sorted to bring the ones that matter to the top.

Audit logging enhancements. Expanded coverage of recorded activity.

Web Beacon and Web Referral allowlists. Both monitors can now be given an allowlist in Configuration, so beacons and referral sources you already know about stop being reported as findings.

Version 2.20

Released on 2025-Sep-17.

Attack Surface Management

Web Referral Monitoring. Tracks the external sites sending traffic to your domains, so referral sources that you did not expect surface as findings rather than sitting unnoticed in analytics.

Web Beacon Monitoring. Detects third-party beacons and trackers embedded in your web properties, including ones added without your knowledge.

Brand Protection

Logo Detection Match. Finds unauthorised use of your logo across monitored sources, catching impersonation that carries no matching text or domain and would otherwise be missed by keyword detection.

Executive Protection

Executive Protection enhancements. Improvements across the executive monitoring surfaces, including changes to how executive findings are presented and navigated.

Data Leakage section updates. The Data Leakage view within an executive profile was reworked to match the structure used elsewhere in the platform.

Platform

Light Mode improvements. Contrast and readability corrections across light theme surfaces.