You can now tell your appliance to delete an archived session recording file when the session record is deleted.

We've add two new features to your BeyondInsight Services:

• Scan processing & purging services are available in the Monitored Services list.
• Logs for new for new services are available on the Log File Export and Appliance Logs page.

We've refined our interface with multiple enhancements, including:

• Updated tool tip text
• Reformatted Config Wizard Signup/Login page
• Translation Service - Replace Deprecated Methods with new Methods
• Standardized colors
• Theme selection now displays on first login
• Adjusted positioning of High Availability Step panel
• Added cell padding to separate Page Banner from Page Headers/cards
• Branded color scheme
• Fixed inconsistent spacing on the Diagnostics tools page
• Fixed inconsistent card border colors for Dark mode
• Replaced top navigation icons/label with new controls
• Added Match System Theme option in theme selector
• Fixed inconsistent text in the Show Password button
• Session Monitoring Archive: Fixed color for the Test Connection message in the Dark mode

We've improved the memory consumption and handling for backups of large databases in the Backup and Restore process.

Dependency management provides visibility into the underlying frameworks that support's a product suite. The frameworks are updated by the Security Update Package Installer (SUPI) as part of the monthly Supporting Software update, which automatically:

• removes unnecessary .NET frameworks, freeing up resources and reducing potential security risks.
• processes new additions and upgrades.
• processes removals without dependent products.

The estimated time for an update to run was including packages that would be skipped in the update. The estimated time displayed now more accurately reflects the actual time it will take to run the update.

Great news! The Password Safe mobile app is now available on both the Apple App Store (iOS) and Google Play (Android). With the app, you can easily view, check out/check in, and request credentials—right from your mobile device.

That’s not all - you’ll also have quick access to your Secrets Safe entries and credentials stored in your personal folder, making it easier than ever to stay secure on the go!

ℹ️

The mobile app requires customers to be on version 25.1 or later.

With Password Safe 25.1, Workforce Passwords is fully compatible with Pathfinder! Previously, the extension didn’t work when customers were activated in Pathfinder. Now, everything runs as expected.

Plus, there’s a great new feature on the login screen: a handy dropdown menu that lets you choose your login portal. Simply select Pathfinder to sign in via beyondtrust.io, then enter your Pathfinder credentials to access your Workforce Passwords secrets with ease.

ℹ️

For more information, see Workforce passwords deployable extension.

In Password Safe Cloud and on-prem, you’re in control - configure the Mobile app to auto-timeout after a set number of minutes!

Workforce Passwords makes it easy and secure to store and access business credentials right from your browser. And now with Password Safe 25.1, deploying the WFP browser extension is smoother than ever!

Admins can effortlessly roll out the extension across Chrome, Edge, and Firefox on Windows systems using the Group Policy Management Editor and Group Policy Objects (GPOs) - no more asking users to install it themselves.

Even better, admins can pre-configure the Workforce Passwords server URL, giving users a seamless, ready-to-go experience from the moment they log in.

ℹ️

For more information, see Workforce passwords deployable extension.

Accessing secrets in Secrets Safe just got easier! You can now jump straight to a secret’s details using a direct link (URL).
Authenticated users can use the link to go directly to the secret within its designated safe.

The URL includes the secret’s title and sub-folder path, and it’s easy to grab - just copy it from the UI or your browser’s address bar. Provide this link to users who have access for quick, no-hassle navigation right to the info they need!

ℹ️

For more information, see Workforce passwords deployable extension.

To enhance security and streamline access, web console login sessions are now limited to one session per user.

And more good news - if you have multiple tabs open in the same browser, you can seamlessly use the same session across all of them. No interruptions, just a smoother, more secure experience!

More information will be available in a future release.

Security just got a boost! With Password Safe 25.1, devices now use stronger, modern ciphers to keep your data safer than ever.

We’ve added support for the latest encryption algorithms and are phasing out older, less secure ones to ensure top-tier protection across the board.

• Secrets Safe API
  • Added SecretType information in response of GET Secrets-Safe/Secrets/{secretId:guid}.
  • User can now set a Prior Expiration Date for Safe Permissions with new ExpiresOn field.
• Password Safe API
  • Added RequestorName and RequestorUserID to Get Requests
  • Added paging support with 2 new optional quire parameters: limit and offset

ℹ️

For more information, see Secrets Safe APIs and Password Safe APIs.

We've made some great updates to improve clarity and consistency in Secrets Safe:

• User names are now displayed as Last Name, First Name in grids, and First Name, Last Name everywhere else, making it easier to quickly find who you're looking for.
• For secrets shared from a personal folder, ownership is now locked for added control. You’ll see the owner’s name, but the Manage Ownership option is hidden to keep things tidy.
• The Owner dropdown in the Secrets grid now shows all owners at a glance - and yes, you can filter secrets by owner for faster navigation!

Beyond Insight 25.1 brings a powerful new enhancement for Endpoint Privilege Management customers! You can now easily search your connected Local AD environments right from the Web Policy Editor.

Quickly find and add users or groups to Windows Workstyle Filters, Messages > Designated Users, Application Rule Filters, On-Demand Application Rule Filters, and Custom Tokens (for groups) - all in just a few clicks!

Session Replay just got a major upgrade! You can now zoom in on specific areas of a recording, making it easier than ever to see and read details—especially when working with high-resolution displays or multi-monitor setups.

Crystal-clear visibility, right where you need it!

ℹ️

For more information, see View Recorded Sessions.

Further improved page responsiveness based on screen resolution.

We’ve removed the Directory Attributes Match option from the Dedicated Account smart rule filter in Pathfinder instances. If any Smart Rules are included that filter before upgrading to Pathfinder, you’ll now see empty drop downs when editing that smart rule post-upgrade; affected Smart Rules should be reviewed and edited as needed.

Directory Attribute Match smart rule filter continues to be available for Cloud and On-prem.

A new folder named Usage is now available in Analytics and Reporting. The following reports are included in this folder:

• The Workforce Passwords Usage Summary report
• The Active Users report
• The System Usage Statistics report (new)

Have you ever wondered which accounts used for Scheduled Task management are managed by Password Safe? Now you can see this information for any system that has associated Scheduled Task scan data, just by running the new Scheduled Tasks Account Usage report!

Have you ever wondered which IIS Application Pool identity accounts are managed by Password Safe? Now you can see this information for any system that has associated IIS Application Pool scan data, just by running the new IIS Application Pool Account Usage report!

The new System Usage Statistics report gives you a clear snapshot of overall system usage - tracking unique logins over your selected time period and providing key insights into the number of Managed Systems and Managed Accounts available at the time of the report.

Prior to 25.1, only Oracle, MS SQL, and MySQL were included. We now include all database platforms present in Password Safe.

We’ve improved load times on the Analytics & Reporting home page.

The Licensing folder has been deprecated. Due to folder reorganization, any report saved views, report subscriptions, or subscriptions to saved views relating to the following reports no longer function and must be recreated from the new Usage folder if still required:

• Workforce Passwords Usage Summary
• Active Users

The Password Safe User Licensing report that lived within the Licensing folder has been deprecated. Any report saved views, report subscriptions, or subscriptions to saved views of this report no longer function. Users should consider creating fresh views and subscriptions based on the System Usage Statistics report, which has replaced the Password Safe User Licensing report.

In 25.1, we have begun the process to deprecate and remove Endpoint Privilege Management for Unix and Linux (PMUL) and Solr functionality in Password Safe.

The first step is to no longer receive and process PMUL and Solr events.

In an upcoming release, we will remove all user interface components, reports and event forwarding functionality.

In an upcoming release, BeyondInsight and Password Safe will phase out the use of mutual TLS (mTLS) to support the adoption of TLS 1.3, which eliminates support for optional mTLS (client certificate renegotiation) on inbound connections. The following product areas will be affected:

• Client certificates will no longer be supported as an authentication method for API registrations.
• The option to download a client certificate from the System > Downloads configuration page will be removed.

The POST Imports and POST Imports/QueueImportFile APIs have been deprecated, and will be removed in an upcoming release.

When installing a product for a subscription that runs an installer, and the installer requires a pending reboot:

• Case 1: Auto Reboot is OFF
  • The subscription is not marked as published.
  • The machine does not reboot automatically.
  • The activity log shows: "update deferred (reboot needed)".
  • Once the user manually reboots the machine and it starts back up, it automatically tries to publish the subscription again.
• Case 2: Auto Reboot is ON
  • The subscription is not marked as published.
  • The machine automatically reboots.
  • The activity log shows: "update deferred (reboot needed)"
  • After the reboot, it automatically tries to publish the subscription again.

Improve user feedback when a reboot is recommended:

• Added notifications to inform user that reboot is recommended.
• Added a banner to inform user that reboot is recommended.

When installing a product for a subscription that runs an installer, and any of the following system settings indicate a reboot is pending:

• A reboot is required by Windows Update.
• A reboot is pending from Component-Based Servicing.
• A system update is scheduled on boot.
• There are pending file rename operations.

Then:

• The updater sets a global reboot flag.
• The Updater UI displays a banner message saying "Reboot recommended".
• After the machine is rebooted, the global reboot flag is resets the banner disappears.

The system uses the installer’s recommended reboot exit code as a natural signal to pause.

When the installer returns this code:

• The updater knows a reboot is required and does not mark the install as complete.
• The installation automatically retries after the machine is rebooted.
• If the user clicks "Update Now" before rebooting, the installer may return the same reboot recommended code again, since the reboot still hasn’t occurred.

You can now use Retry to see if your RPC service is running when you're executing a BTDiscovery.cmd client command.

Use the new runtime option to allow for additional ports in your port scan.