Version 0.9.0+1273

• The email records plan is a list of cards: what to do, where to do it, the record and why, with each protocol's state and the Gmail, Yahoo and Outlook.com sender rules at the top.
• Two SPF records, short DKIM keys and report addresses at another domain are caught.
• TLS reports are read by upload or from the report mailbox, and hold the move to MTA-STS enforce while deliveries fail.
• DKIM selectors come from the DMARC reports and unnamed senders get a suggested name. Changes to your mail records are flagged on Email fraud and in the digest.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1263

• Every email record to add or change says why it is needed and how high its priority is, on the page, in the PDF and in the free check's report. The PDF can be downloaded straight from Email fraud.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1259

• The email records plan and its PDF are written in plainer words, name the real DKIM selectors, say when a domain does not exist and no longer suggest records they cannot justify.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1253

• A domain's records plan downloads as a PDF, with every record, the notes beside them and the day DNS was read.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1247

• The records plan reads an SPF record as receivers do. A record in its own order or written with + is no longer marked for change, and a redirect is kept.
• The step to DMARC reject asks for reports when none are set and raises a lower subdomain policy to reject.
• DKIM is checked at the selectors of each service that sends your mail, so Microsoft 365 not signing is no longer hidden by a key elsewhere.
• The free check's report no longer suggests tightening DMARC on a domain that sends mail, since that step needs the reports first.
• Subdomains that are aliases get no records, and the dates of the next DMARC and MTA-STS steps start from a daily read.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1243

• Risk > Email fraud opens a records plan for each domain: every mail record in order with its final text, SPF built from the services that send your mail and the next DMARC step held while a named sender still fails. Each record can be checked on demand.
• The free check's emailed report and PDF give the DNS records that fix what it found.
• The public demo leads with the ΕΑΚ assessments, with the rest of the menu under More.
• Quote requests ask for yearly or monthly billing.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1237

• The subject line of the emailed report from the free check names the grade.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1235

• A demo link opens the demo for 7 days on any device, and can be forwarded to a colleague.
• The demo email and the free check's emailed report read more plainly, with the grade in the subject line of the report.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1231

• Packages and their prices are published: Essentials from €290, Professional from €690 and Enterprise from €1,490 a month, Partner from €190 a client a month. Settings names your package.
• At 80% of your package's monitored assets the owner is told, and nothing ever stops working.
• A partner sets each client's monthly price beside its own cost. The client never sees either.
• The demo opens by a personal link: ask on the access form and the link arrives by email. The partner demo is opened by a link the platform owner sends.
• The free check's emailed report wears Vardion's brand in plainer words and names each lookalike domain with why it matters.
• A subdomain with no DMARC record of its own is graded under its parent's policy, and a null MX counts as no mail, as receivers treat them.
• The board pack names the account a credential fix is about, and a chain's rating reads as combined.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1229

• Packages and their prices are published: Essentials from €290, Professional from €690 and Enterprise from €1,490 a month, Partner from €190 a client a month. Settings names your package.
• At 80% of your package's monitored assets the owner is told, and nothing ever stops working.
• A partner sets each client's monthly price beside its own cost. The client never sees either.
• The demo opens by a personal link: ask on the access form and the link arrives by email. The partner demo is opened by a link the platform owner sends.
• The free check's emailed report wears Vardion's brand in plainer words and names each lookalike domain with why it matters.
• A subdomain with no DMARC record of its own is graded under its parent's policy, and a null MX counts as no mail, as receivers treat them.
• The board pack names the account a credential fix is about, and a chain's rating reads as combined.

Released 4 November 2026. Supported until 4 November 2031.

Version 0.9.0+1216

• The exposure score follows Qualys TruRisk: each host is scored by its worst finding and how critical it is, and the estate by its riskiest host. Fixing a host always lowers it.
• The board pack's score page says what a board should expect: fixing the riskiest host moves the score most.
• Partners can explore a demo of the partner pages with three sample clients.
• ΕΑΚ assessments have their own place in the sidebar, with one compliance figure.
• A client's own people land on My work, which now shows what is being done and who has it.
• The Risk page offers six starting loss scenarios, each with the published figure it rests on.
• Every message is sent through the platform mail server under the Vardion name, with replies to a person. A scheduled report can use it too.
• An address that unsubscribed at the mail provider is marked on the Users page and the report recipients, so a missing message is explained.

Released 3 November 2026. Supported until 3 November 2031.

Version 0.9.0+1192

• A scanner that stops before reading its targets now fails only its own step. The run goes on and records what the other scanners found.

Released 2 November 2026. Supported until 2 November 2031.

Version 0.9.0+1184

• The assessment report rates an attack path as the combination of its findings and says how each of those findings is rated.
• Every action on the assessment report's roadmap has an owner and a due date. A missed date is marked overdue and the same change is listed once.
• A report names a finding whose account it leaves out by a short reference, and the console opens the finding from it.
• A supplier's request to correct its grade is kept on its record, with the day it arrived, its outcome and the day it was decided.
• Search engines may index the empty form of the public domain check. Every result and every link naming a domain stays out.
• The board summary's first step names the account and the planned change.
• The exploited vulnerability pages give English to a reader whose language has no page, and the index says when the list was last read.
• The console's compose service is now named vardion. The next update removes the container made under the old name and keeps every volume.

Released 2 November 2026. Supported until 2 November 2031.

Version 0.9.0+1168

• WordPress plugin, theme and core vulnerabilities from Wordfence Intelligence are matched against your websites once a key is set under Data sources.
• Critical advisories for the products you watch, from ENISA's EUVD, show which of your workspaces they reach.
• The incident record says whether an incident is reportable under DORA and NIS2, and drafts the DORA reports.
• Critical entities under Law 5236/2025 get their catalogue, clock and deadlines.
• DORA's ICT risk standard, TLPT stages, the electricity network code, EASA Part-IS and ΑΔΑΕ decision 304/2025 are assessment catalogues with their incident clocks.
• The NIS2 regulation report walks the 10 measures of Article 21(2) in their states, in English and Greek.
• The partner portfolio gains client tags, a coverage row, the monthly service review and a batch of client reports.
• Agents read as reporting, late or silent with the cause and the fix. A stepped page adds a new one.
• Accepts take a reason category and can last until a fix ships or need a second person.
• Report deliveries, a language per recipient and a notification matrix set who hears about what.
• Host configuration checks show each setting as met, not met, undetermined or not applicable.
• A scan that could not run a scanner leaves the findings that scanner would have read as they were, never marked fixed.
• An area or a surface nothing has looked at reads not measured, on the headlines, the lists and the reports.
• Opened and fixed findings are counted once across a period's start, so every page gives the same figures.
• The console is faster on large estates: the score page, the overview, the portfolio and the audit log.
• STIX and MISP exports leave out evidence unless an export asks for it.
• Enrolment tokens can be made with a lifetime, and the token list shows each one's last refused push.
• Findings held for the baseline review reach MISP and webhooks only once the review releases them.
• Host and token names may be written in Greek letters.
• Many Greek wording and layout fixes, on the console and in the printed reports.

Released 1 November 2026. Supported until 1 November 2031.

Version 0.9.0+880

• The evidence pack carries the management system's scope, the internal audit programme and the supplier register with each supplier's tier, access and next review.
• A subdomain whose parent domain publishes a CAA record is no longer reported as having none.

Released 27 October 2026. Supported until 27 October 2031.

Version 0.9.0+868

• Fixes and passing checks are proposed as evidence on the controls they map to, and a person accepts each.
• Cloud and identity settings are checked every day, and any drift opens a finding.
• One answer is proposed across the instruments of Greece's National Cybersecurity Authority (ΕΑΚ), ISO 27001, NIS2 and DORA.
• Import the authority's gap analysis workbook, and assets, suppliers, risks and incidents from a spreadsheet.
• Getting started proposes what applies from your scope memo, with a countdown to your ΕΑΚ dates.
• Write and sign the scanning authorisation letter in the console.
• Appointment checks for the security officer the law requires (ΥΑΣΠΕ), a quarterly report to the board and policy acknowledgement by every employee.
• Every sender using your domains, from DMARC reports.
• A public trust page you control, with an evidence request form.
• Insurer proposal answers as a workbook.
• A group view of every subsidiary, and one group Statement of Applicability proposing answers in each.
• Content checks count the personal data in your exposed data stores and keep only the counts.
• Regions and municipalities are classified by Law 5160/2024.
• Every figure on the board pack opens the records behind it, and the score opens its breakdown by host.
• On request, a scanner you run in your own network takes signed jobs and stops as soon as you revoke its token.
• A write API with scoped tokens and signed webhooks, on request.
• Each framework is a file that names its source and the day it was checked.
• An install with no internet takes the reviewed templates and reference tables from a signed bundle, and agents take signed updates.
• Admin > Licence shows a self-hosted console's licence and its entitlements.
• A supplier's tax standing from ΑΑΔΕ with your own access codes, on request.
• An SBOM nested deeper than 64 levels is refused with a reason.

Released 27 October 2026. Supported until 27 October 2031.