Changelog

Each release is one version number for the Argus platform and the agent. A platform change can be live a few days before the release that lists it; an agent change reaches you when you update the agent (see Updating the agent).

1.3.0 (2026-10-22)

Platform

• Scheduled scans no longer stop for a whole cloud account because one scan job is stuck: an account is skipped only while every one of its scannable datastores is busy, and a job that never started is closed after 12 hours. If your scheduled scans had stopped running, they resume with this release.
• After an Argus update, an open browser tab now picks up the new version instead of showing a blank page, and if a page does fail, the error card shows an error ID you can quote to support.
• The Overall Risk Score no longer shows a confidence figure. It was a fixed figure, not a measurement, so it is removed; risk estimates are described by the range Argus recorded and the sample size behind them.
• Password reset requests are now limited per account (3 an hour) as well as per network (20 an hour), so colleagues behind one office network no longer block each other. A reset email’s link expires in 15 minutes and works once, and if you asked for more than one reset, only the newest email’s link works.
• A datastore now stays Scanning when a new scan overlaps one already running, instead of briefly showing an error. The password-changed email is now sent and recorded like every other account email. The agent update guide (Deploy the Agent > Updating the agent) is rewritten with console steps and a single-stack script.
• Email addresses are now matched without regard to case when you sign in, reset a password or accept an invitation, so Name@example.com and name@example.com are the same account. Stored addresses were converted to lowercase at deploy.
• Compliance no longer marks a control Partly met because the content sample covered less than the whole datastore. Each datastore’s saved compliance result was recomputed at deploy. Controls that were Partly met only because of sample size now read Passing. Some controls now read Partly met or Not verified instead of Passing, because Argus stopped treating evidence it could not assess or could not read as passing. Saved results now match the compliance page; alerts and risk scores follow on each datastore’s next scan, so an alert’s severity can rise. The datastore drawer now states how much was sampled and how far that sample can be trusted. Controls Argus cannot assess (procedural, such as an incident response plan) no longer appear as Passing in exported results.
• GLBA multi-factor authentication (314.4(c)(5)) is now assessed on your IAM identities only. It no longer appears on individual datastores, where Argus has no MFA to read: private datastores holding customer financial data had shown it as Passing, and public ones as Failing. Your GLBA score is unchanged; GLBA assessment coverage can drop by a few points, because those datastores no longer count as checked for MFA, and the per-datastore compliance score moves on datastores that held a GLBA MFA row. Recommendations that listed GLBA MFA as a source on a public datastore drop that source at the datastore’s next scan; none closes. For HIPAA 164.312(a)(1), ISO 27001 A.5.15 and SOC 2 CC6.1, each datastore and identity result now names only the signals it judged. Security alerts list the compliance controls their datastore violated when they last fired. An alert that still fires drops GLBA multi-factor authentication at the datastore’s next scan; an alert that has stopped firing keeps the controls it listed then.
• Discovery and assessment runs now send one summary when the run finishes, in place of a notice per datastore and per finding. The summary carries the severity of the most serious finding in the run; critical alerts and incidents still notify you straight away. Choose where summaries go under the new Scan run summary type in Profile > Notifications. Policy violation emails are now available there too, off unless you turn them on. When scheduled scans or discovery stop running, one notice now names every operation affected. Several account and remediation emails have clearer wording. On the first update, a run that finished in the 48 hours before it may send one summary, and a bulk scan started before the update is reported in the older scan failure digest.
• Changing your profile email to an address that is already in use now says “That email can’t be used. Choose a different address.” instead of failing with an error. When accepting an invitation fails, the page now says “This invitation could not be accepted. Try again, or contact the person who invited you.” in place of a technical message.
• Policies: the Region condition is now a picker over every supported region; the contains and not contains operators are no longer offered. The policy builder previews how many resources would violate before you save, replacing POST /policies/{id}/evaluate (use POST /policies/preview). Remediation: rollback is one “Allow rollback” setting per workflow instead of per step, and a change applies to future runs only. Tenants taken live through a partner now get the default policies and remediation workflows, as tenants set up by their owner already did.
• Links that take you to a filtered page now arrive as ordinary filters you can see and remove. A datastore’s manual runs, an identity’s datastore, or a policy that needs review open with the matching filter chips already applied, and clearing a chip or reloading the page shows the full list again. The Policies tile “Overdue review” is now “Needs review”.
• Settings are now grouped by area, and forms and dialogs ask before discarding unsaved changes. Auto-assignment rules can now assign incidents. Rollback after a remediation is available for up to 24 hours.
• Scheduled scan frequency now follows your plan: every 48 hours on Essential, 12 on Professional, 6 on Enterprise. Schedules set more often than your plan allows now run at your plan’s minimum. Manual scans stay unlimited on every plan. Remediation now follows your plan: Essential shows recommendations, Professional runs remediations after approval, and Enterprise adds automated workflows.
• Selecting several datastores in the inventory and scanning them, across any number of cloud accounts, now sends one summary when the last scan finishes, in place of a notice per datastore. Each person’s summary counts only the accounts they receive notices for and links the datastores that failed or did not complete; high-severity findings and policy violations are counted in it, and critical alerts still notify you as they are found. Datastores Argus could not queue, for example because they are already scanning or have no operational agent, are named straight away. IAM discovery started for several accounts likewise sends one summary, under the new IAM Discovery Summary type in Profile > Notifications; a run where any account failed is emailed if email is on for IAM Discovery Failed.
• A new Billing page shows your plan and term, this month’s datastore usage against what your plan includes, and your invoices, each of which you can view and pay or download as a PDF. Once invoicing starts for your account, Argus invoices through Stripe: an annual plan’s base at the start of each term, datastore overage monthly in arrears, and a monthly plan once a month, payable by card or bank transfer within your payment terms. An annual plan sends a reminder email 30 days before it renews. If your plan is billed through a partner, the page shows your usage and the invoices go to the partner. All billing dates are in UTC.
• The Argus landing page and the sign-in pages of the Argus app now carry a small, muted line at the bottom that reads ‘Argus by Noemant’, with the small Noemant mark beside it. The line is not a link and changes nothing about how you sign in or use the product.
• When a customer is deleted partway through a month, that month is still invoiced up to and including the deletion day, with the monthly base charged by days to that day (an annual plan’s prepaid base is not refunded): on the customer’s own invoice, or as its line on the partner’s monthly invoice, with the partner discount. A customer deleted on the 1st is not invoiced for that month, and nothing is invoiced for the months after.

Agent

• The agent now sizes its sampling work to the memory it runs with. A 1 GiB agent runs one scan at a time (on 0.5 vCPU that is faster for content scans); give the task 2 GiB to run three at once.
• On machines with fewer than 2 vCPUs the agent runs fewer scans side by side than before: one at 0.5 vCPU, two at 1 vCPU.
• Content sampling now draws objects and rows at random, grades a database by its least-read table, and reads gzip-compressed log files, so the first scan after you update the agent can raise a log bucket’s readable count and coverage. Buckets of large text files (over 10 MB, read in fragments) can drop toward 0% coverage, so their content-based controls read Not verified. A DynamoDB table whose every read is denied now reads content not verified instead of a clean empty table.
• Database sampling now draws rows at random from each table with a bounded load on your database: a table whose draw hits the time limit is reported as ‘timed out, unread’, never as empty, and system tables are listed as not read by design instead of as unreadable. Agents before this release keep the previous draw and labels.

Platform and agent

• Compliance controls now take the worst result across every datastore and identity they cover: a single failing datastore fails the control. A datastore Argus read before but could not read on the latest scan keeps the results of its last successful read and says the latest read failed, until that read is older than your evidence age limit, when Passing and Partly met read Not verified and a Failing result stays Failing with its last read date; an expired Partly met no longer asserts its recommendations, so they close on the next scan. A control Argus could not check now says why, for example an identity input not collected, instead of reading not applicable or passing. A datastore Argus has never read is listed once as Applicability unknown instead of under every control. Statuses are renamed Passing, Failing, Partly met, Not verified and Manual. Framework scores can fall sharply: a control with some passing and some failing datastores used to read Partly met and earn partial credit, and now reads Failing, so a framework whose controls were all mixed can drop to 0 (one measured framework went from 65 to 0). To see what drives a score, open one of its Failing controls: it lists the datastores and identities that failed it first. Stored results are re-derived on deploy; alerts and policies catch up on each datastore’s next scan.
• Every scan is now incremental, including scheduled, bulk and discovery scans: coverage builds up across scans instead of resampling each time, and scheduled scans now notice objects deleted since the last scan. Agents at this release advertise the incremental floors; a store served by an older agent keeps the full scan it had until every agent on the account is upgraded. The first scan of each RDS or Redshift database after the agent upgrade re-reads every table once, because the change fingerprint gained insert, update and delete counters; after that, a table changed in place is re-read on the next scan.
• Evidence staleness now counts from the last successful read. A scan that could not read a datastore or an identity input no longer resets it: the results from the last successful read hold, with a note, until your evidence age limit, then Passing and Partly met drop to Not verified (Failing stays Failing). A datastore whose last scan failed after reading may show that scan’s date as its last successful read until its next scan. With this agent release, a database scan that could not read some databases says which and why; with an older agent, Argus says the scan did not report why. The first database scan after this update reads each partitioned PostgreSQL table through its parent and each child table you have granted on its own, so findings recorded on those tables move once between parent and child, and alerts on them may resolve and reopen. A child table that adds columns Argus cannot read is now listed as not fully read.
• Argus now checks each agent’s own IAM role after the agent updates, and Cloud Accounts shows when the role is missing permissions the new version needs, with a button that opens the stack update in AWS with the right template. Until the role is updated, the affected checks read Not Verified.
• The agent’s check of its own IAM role now covers database credentials. For each database you have given Argus a credential for, it asks AWS whether the role grants that database’s ARN, and any ARN it does not grant is listed under Database ARNs not registered in the Agent role permissions window, with the parameter or statement to add it to. Adding or removing a database credential checks the role again. When nothing is missing, the window now says Current: every checked permission is held, because one permission, s3:ListAllMyBuckets, cannot be checked this way and shows up as a refused bucket listing instead. Agents before this version keep reporting as before.

Upgrading

• Update every agent on a cloud account together: scans go to any free agent, and an older agent records no read extent, so coverage and the High confidence label can change from scan to scan while old and new agents run side by side.
• When Argus reports missing permissions, update the stack with the template for its version (see Updating permissions).

1.2.0 (2026-10-04)

Platform

• Scan Completed, Agent Online and IAM Discovery Completed notifications are now off by default. Turn them back on for your tenant under Settings > General, or for yourself under Profile > Notifications.
• Risk scores were recalculated with the current risk and compliance rules, and the risk timeline marks the change as Risk recomputed. Some per-type counts and evidence links refresh after each datastore’s next scan.