In-app notifications and MITRE ATT&CK mapping

In-app notifications

Your alerts have always lived in Recon, but you had to go to the alerts area to find them. Now there's a notification icon in the top bar — new alerts land there as they happen, and you can scan and filter them without leaving whatever you're working on, much like notifications in Jira. For now the feed carries Smart Alerts, with breach monitoring alerts joining soon.

MITRE ATT&CK mapping in the Villain Vault

Threat actor profiles now include MITRE ATT&CK mapping, so alongside who an actor targets and what software they go after, you can see how they operate — the tactics and techniques they use. It gives your team a common language for taking an actor's profile and asking the practical question: are we defended against these techniques? Mapping is live for 180+ threat actors at launch, covering the most active and tracked groups, with more added as new intelligence lands.