Release Notes

This page lists the changes introduced in each Open-AudIT release. For download links and upgrade instructions, see the Installation section.

Open-AudIT 7.0.1

Released: 2026-11-10

Open-AudIT 7.0.1 is the first Windows release of the 7.x series. It ships for Linux and Windows, and brings fixes and improvements from feedback on the Linux 7.0.0 release. The FirstWave VM still carries 7.0.0. The complete notes are in the Open-AudIT 7.0.1 release notes on the community wiki.

Upgrading

Open-AudIT 7.0.1 upgrades in place from 7.0.0 or from any supported 6.x release. Take a database backup first. The upgrade adds two benchmark history settings, delete_noncurrent_benchmark and feature_benchmarks_expire_noncurrent, and no new database tables.

Open-AudIT 7.0.0

Open-AudIT 7 is built around discovery. Version 7.0.0 shipped for Linux and in the FirstWave VM. The Windows build of the 7.x series followed with 7.0.1. The complete notes, including upgrade and database notes, are in the Open-AudIT 7.0.0 release notes on the community wiki. The site summary is on the Open-AudIT 7 page.

Licensing

Every download of Open-AudIT 7 starts with a 30-day Enterprise licence covering unlimited devices, so you work with the full product from day one. Upgrading from version 6 starts the same trial. Activation asks for your email address. When the trial ends you can buy a licence, ask for an extension, or move to the Free edition, which covers up to 100 devices.

Every edition

• Credential-free discovery engine. Protocol helpers identify devices from what each open port reveals. Every probe is gated on an open port, and the full parsed reply is kept in the discovery log as JSON.
• Parallel subnet scanning over longer TCP and UDP port lists.
• ARP discovery from the server's own table and from the tables of every switch, router and computer you audit.
• OT discovery of PLC and SCADA devices over BACnet, Modbus, S7, EtherNet/IP and more.
• SSDP, NAS and service processors. SSDP retrieves the device's own webpage; NAS devices and baseboard management controllers (Redfish, IPMI, Intel AMT) identify themselves without credentials.
• 353 device types, up from 98.
• In-application documentation rewritten from scratch, with a Learn About page for every feature.
• The installer bundles every dependency on Linux and Windows.

Professional

• OpenStreetMap-based maps. No API key, no sign-up and no billing account. The maps_api_key configuration item has been removed.

Enterprise

• Active Directory as a discovery target, and Collectors now run on Windows.
• Network Dependency Mapping. Pick a subnet and see the whole chain, router to switch to wifi to every device, with the network's DHCP, DNS, gateway and IP counts alongside.
• Network Routing Map. How your networks connect to each other through routed links and VPN tunnels.
• Application Relationship Mapping. Model each application as its discovered components, with named relationships such as runs-on, uses-database and uses-certificate.
• Directories. Users, groups, computers, domain controllers, sites and subnets from Active Directory or Entra, with change history.
• People from your directory, linked to the devices they use.
• Windows benchmarking with DISA STIGs, run as part of a normal audit and graded by severity.
• Active Directory security, benchmarked against the DISA STIGs in the Security view on the directory's page.
• Four new standards control sets. CBDDO (660 controls) and BDDK (319) for Türkiye, NCA ECC (174) for Saudi Arabia and ASD Essentials for Australia join ISO 27001 (93), 1,304 controls across five standards.
• Domains, a register of your domain names with registrar, certificate, expiry and renewal status.
• Vendors, now a register of the companies you buy from, linked to what each supplies.
• Certificates record issuer and fingerprint and are matched to the web servers using them.

Upgrading from 6.x

Open-AudIT 7.0.0 upgrades in place from any supported 6.x release. Take a database backup first. Run the new installer, log in, and you will be taken to the database schema upgrade screen. The ip table is renamed to ip_address, and a view named ip is created so existing reports and integrations that read it keep working.

Open-AudIT 6.0.3 (Windows)

Released: 2026-05-14

We are releasing Open-AudIT 6.0.3 for Windows as a minor release for bugs and improvements.

The new items are installed user browser extensions (assuming you're auditing using Administrator for Windows or sudo/root for MacOS), and MS Entra for authentication.

We have also enabled a basic discovery scan that will be executed if Nmap is not detected.

Our Windows installer is now signed with our FirstWave certificate. Initial tests on Windows Server do not trigger a warning, however initial testing on Windows 11 do still trigger a warning. To get around this, we have submitted the file to Microsoft for review. It is unknown how long this will take to make its way to client machines (the updated "this file is OK" detail).

Open-AudIT 6.0.2

Released: 2026-01-23

This is an update release to address a few bugs found, improve a few items and just generally tidy up. We recommend you update ASAP.

The discovery code has received attention to make it more robust and withstand non-standard responses from devices.

Open-AudIT 6.0.1

Released: 2025-12-15

This is a bug fix release for the large 6.0.0 release.

The important bits are:

• Processing an audit result and/or completing a discovery will not trigger a vulnerabilities scan. Once an hour we scan all devices for vulnerabilities from your chosen vendor list. Then once per day we scan all devices for all vulnerabilities. This is scheduled for sometime in the early AM (morning). Check the tasks schedule to determine exactly when (we randomise it).
• Agents now delay for X minutes (settable) before executing and submitting their audit. X minutes means a delay of between 0 and X. By default this is 120 minutes. This reduces load on the server when a large number of agents check-in at the same time.

Open-AudIT 6.0.0

Released: 2025-11-30

This is the one you've all been waiting for. We are introducing quite a few new features, the most compelling of which is vulnerability detection. When a device is audited, during data processing Open-AudIT will compare the installed software to the current CVE listing. You will know — right on the default dashboard — if something has an outstanding vulnerability.

In our experience, 99% of these are rectified by upgrading the affected software to the latest version. But now you'll know just how many affected programs are on your estate.

Vulnerabilities

Open-AudIT reaches out to our server and downloads a list of vulnerability definitions. These are used each time device data is processed to return a list of affected items. On our side, we use the CVE feed from NIST, process the data, enrich it, then create a suitable SQL query for your use.

Your Open-AudIT install will require access to the internet. The Vulnerabilities feature can be disabled. The Help icon on the Vulnerabilities list page shows you exactly what data is sent to us — we send only license data, application data (name, version, platform, timezone), logged errors, and counts of device types and feature usage. UUID and Server fields are SHA-256 encoded. No networks, IP addresses, OS versions, or software names are sent.

News Feeds

News feeds let you keep up with various Open-AudIT items such as updated Windows version numbers in queries. Configuration item changes are sent with recommendations as one-click fixes — read the news item, click Enable, and you're done. Like Vulnerabilities, News requires internet access and can be disabled, and sends only non-sensitive data points.

Standards Reporting

FirstWave is ISO 27001 compliant. Standards Reporting brings that workflow into Open-AudIT — review and answer the questions once, then in subsequent years simply revise where required and extract to Excel (click Report in the GUI) for auditors.

New Languages

Open-AudIT now has built-in support for: Albanian, Arabic, Azerbaijani, Bulgarian, Chinese, Czech, Danish, Dutch, English, Esperanto, Estonian, German, Greek, Finnish, French, Irish, Hindi, Hungarian, Indonesian, Italian, Japanese, Korean, Lithuanian, Latvian, Malay, Norwegian, Persian, Portuguese (Brazil), Polish, Portuguese, Romanian, Russian, Slovak, Slovenian, Spanish, Swedish, Thai, Tagalog, Turkish, Ukrainian, Urdu and Vietnamese.

Translations were done via LibreTranslate. If you find anything that needs fixing, email us what is in the GUI, where, and what it should actually say and we'll include the correction and send you an updated translation file.

Certificate Management

Select a certificate found during an audit and mark it to make management (renewal, responsibility, et al) easier — and report on it. A typical use is a monthly report listing certificates expiring in the next 45 days and who needs to renew them.

Discoveries

The largest change is deprecation of the VBScript used to audit Windows. We now use a PowerShell script, which has all the property retrieval of the deprecated VBScript with the exception of local device group policies (to be added in time). We also return Cisco license info using show licenses via SSH, and Redhat subscription details, and audit Hyper-V hosts.

New Icons

We have changed from FontAwesome to Lucide icons. There are more available without a commercial license. We still love FontAwesome though.

Agents

We now have agents for MacOS and Linux. They are simple scripts that check in with the Open-AudIT server each day and (usually) audit and send the details. No remote access required if you don't want to enable it.

Benchmarks

New Benchmark definitions for Redhat 10 and Ubuntu 24.04 have been added.

Syslog in CEF Format

New configuration options to log certain events to syslog (on Linux) using the Common Event Framework format, consumable by Splunk and similar. All disabled by default. A typical CEF entry looks like:

CEF:0|FirstWave|Open-AudIT|6.0.0|5|Access|1|Info|collection=devices action=collection user=admin

Which corresponds to:

Cef:Version | Vendor | Product | Product Version | Event ID | Event | Severity Number | Severity Text | Details

Event IDs are: 1 — New Device, 2 — Component Added, 3 — Vulnerability Detected, 4 — Component Removed, 5 — Access. Events that do not change data are severity 1; events that change data are severity 5.

The available configuration items are feature_syslog_access, feature_syslog_components, feature_syslog_devices and feature_syslog_vulnerabilities.

Open-AudIT 5.6.5 (Linux)

Released: 2025-03-31

This is a minor release mostly to address a couple of bugs that appeared for Redhat users.

We also now retrieve arp tables when running a discovery and, if we then find an IP that we don't have a MAC address for, check the arp table records (only against arp tables generated by this discovery).

Various discovery improvements have been included.