You asked, we delivered! New enhancements in runZero 5.1 take on the heavy lifting across five key areas, enabling you to unmask and remediate exposures with less friction and more speed.
First off, we know many of you want to use AI to streamline exposure management, but strict compliance boundaries prevent you from sending sensitive metadata to third-party LLMs. With 5.1, you can now bring your own AI into runZero and leverage it across the platform to perform searches, create custom reports, build custom dashboards, and more. Now you can use natural language queries to explore the treasure trove of data in runZero and ask the platform questions about your assets, risks, and exposures via one simple interface. This powerful enhancement makes your runZero data infinitely more extensible and accessible to all stakeholders.
This release also offers an enhanced framework that lets you use LLMs and AI coding agents to help build custom integrations faster and with more control over how multiple data sets are merged into a single asset, ensuring you don’t end up with duplicate asset records. We know how important integrating all your data sources into runZero is; with this new feature, it’s never been faster or easier.
While runZero’s best-in-class active scanning excels in discovering unknown and unmanaged assets, correctly scoping those scans can be challenging in some environments. With 5.1, you no longer have to rely on institutional knowledge about IP ranges, CIDRs, domains, subdomains, and schedules. Our new autonomous discovery feature uses the results of each previous scan to expand coverage of the next one until your entire attack surface is fully encompassed.
This release also deepens our integration with Dragos. In converged environments, analysts are often forced to swivel between tools during high-stakes triage to manually connect critical OT context between systems. In 5.1, we bring Dragos data natively into runZero, including crown jewel designations, Purdue model levels, and asset communication insights, helping you quickly get the context you need when it matters most.
Finally, we know your goal isn’t just to uncover exposures; it’s to eliminate them, which means ensuring remediation doesn’t stall at the handoff. Teams without an IT Service Management (ITSM) solution lack a native way to track ownership of remediation, while teams with an ITSM bury critical affected-asset lists inside static CSV attachments. In this new release, you can now assign issue ownership of exposures directly via email, even to team members without a runZero account. For customers with ITSM solutions, cumbersome CSV attachments to tickets are replaced with direct, secure links to interactive reports of affected assets.
Let’s take a closer look at each of these key areas.
runZero 5.1: Five pillars to reduce friction #
1. Compliance-friendly AI workflows seamlessly deliver powerful data insights #
Ready to get all the power of AI to help manage exposures without the compliance risks? runZero now offers two ways to leverage flexible AI workflows:
- Bring-Your-Own-Key (BYOK)
- Completely self-hosted.
Regardless of deployment type, combining AI workflows with runZero means you can leverage natural language search across all of your datasets including assets, vulnerabilities, misconfigurations, and fingerprint attributes. You no longer need to learn runZero’s query syntax to get to the data you need. Simply type in questions like “show me all end of life systems,” “find all expired TLS certificates,” or “give me a list of all endpoints missing EDR” and runZero will translate it into query syntax and show you the results.
This same natural language capability also drives custom reporting, dashboards, and deep insights without sending a single byte of data to a third party outside of your control. Usability has also been improved using the new Quick Command Menu – accessible anywhere in runZero by using the “command-k” or “control-k” keyboard shortcut – giving you access to your AI prompt or letting you directly move to any part of the runZero Platform.
You can enable AI features two ways, at the account level or at organizational level. To enable AI at the account level, go to “Account→AI Configuration→New AI Credential” (see below). These settings apply to all organizations under the account. If AI is disabled at the account level, it is disabled for all organizations regardless of their settings.
To enable AI at the organization level, go to “update organization” and scroll down till you see “AI Provider Credential” and select either “Inherit from account settings,” or “+New Account Credential.”
Enter your provider and API key (shown above). Once AI is enabled, you can use natural language processing for searches, custom reports and dashboard creation.
2. Autonomous discovery automates complete attack surface intelligence #
In the past, scoping a runZero scan meant specifying IP addresses, CIDRs, domains, subdomains – and a schedule. That scope stayed fixed to what you entered; nothing changed unless the scope was manually expanded. This meant that assets could easily be missed if the scope was outdated or not on point to begin with, especially given the rapid pace of change across IT and OT environments. We’ve addressed this gap in 5.1 with autonomous discovery.
Autonomous discovery changes what happens after your first scan runs. Enable it for internal and/or external scans and runZero uses the evidence in your results to autotune the scope for things like routing tables and adjacent subnets internally, or related hostnames and domains externally. runZero will use this tuned scoping in follow-up scans and will keep expanding coverage automatically until your entire attack surface is covered. By replacing static scoping with an automated, self-expanding discovery engine, runZero 5.1 helps ensure you have visibility into every asset, exposure, and attack path, eliminating the guesswork on the road to comprehensive attack surface intelligence.
3. Enhanced framework accelerates custom integrations and refines merge logic #
Our new enhanced Custom Integrations Framework simplifies building custom pipelines with LLMs and coding agents, expanding data sources, and merging multiple integration inputs into a single, high-fidelity asset record. Data sources from integrations have also been expanded with options for SSH, SMB, WinRM, WMI, and SQL. This new framework eliminates the pain of duplicate asset records from multiple sources and speeds up custom tool connectivity.
4. Streamlined remediation facilitates handoffs directly inside runZero or with ITSM integration #
For customers without an ITSM tool, 5.1 makes it easier to pass the baton on remediation, and then track the status to ensure exposures actually get fixed. You can now assign issue ownership directly via email — even to team members without a runZero account — and track remediation status by owner. And for those of you who do use ITSM tools like Jira, we’ve got improvements for you, too! You can now replace static CSV attachments in ITSM tickets with direct, secure links to interactive reports.
5. Improved Dragos integration enriches OT context and eliminates siloes #
If you have both runZero and Dragos, you can now see Dragos crown jewel indicators natively within runZero. “Crown jewel” assets are automatically flagged as Critical in runZero, enabling you to ensure you are keeping an eye on the most sensitive assets in your environment.
5.1 also surfaces Purdue levels from Dragos inside runZero, as well as insights into high-level asset communications, bringing together rich OT context in one single interface. You can also drill into all Dragos asset communications directly from the runZero console. (Sidenote: we’ll be adding the ability to bring in Purdue levels from other tools like NetBox and Nozomi in the near future!)
With these integration enhancements, runZero makes it easier and faster to action OT data and insights. For example, you can filter for Purdue Level 2 controllers and above, open a controller to read its aggregated communication paths, use runZero to identify the attack path into the controller, and then jump into Dragos for all the details. Simultaneously, an AI-assisted report can summarize exposure and remediation recommendations.
Our goal with 5.1 was to deliver features that make exposure management frictionless and ensure we are continually providing the product enhancements you’re clamoring for. And we’d love your feedback! Dive into your console or start a free trial and let us know what you think.
