CyberStrong 4.21 broadens what the platform can connect to, sharpens automation, and makes more of your risk data usable outside the platform. The release centers on four updates: generic telemetry connectors, workflow scheduling tied to real due dates, complete Bowtie risk exports, and policy finding exemptions that keep scoring accurate without hiding anything.
Each one addresses a gap customers raised directly. Here is what changed and what it means for your program.
Not every system in your environment has an out-of-the-box integration. Until now, that meant its telemetry stayed outside your risk picture.
Generic connectors close that gap. They bring policy configuration, vulnerability, and patch data from additional systems directly into CyberStrong's security and risk workflows. Connector information is also available through the public API, so your team can manage and reference connectors programmatically.
What this means for you: more of the environment you actually run is reflected in your findings and risk calculations, not just the systems with a prebuilt integration.
Automation is only useful when it runs at the right moment. Customers need workflows aligned to the dates that already govern their programs, plus clear visibility into what ran and what came back.
In 4.21, you can schedule workflows around individual assessment renewal dates and asset-group due dates, including on the date itself. Workflows can also update the things they depend on: asset-group due dates, recurrence settings, and asset attributes.
Two additions make automation activity easier to follow:
What this means for you: renewals and due dates drive the work automatically, and your team can confirm what happened without chasing it down.
A Bowtie model is only as useful as the context around each risk. Previously, risk-register CSV exports left out risk factors, impacts, and secondary impacts, so the full structure stayed inside the platform.
Risk-register CSV exports now include Bowtie risk factors, impacts, and secondary impacts.
What this means for you: when risk data moves into a board report, an audit package, or your own analysis, it carries the cause-and-consequence context that makes it meaningful.
Some policy findings are legitimately exempt. They shouldn't distort your scores, but they shouldn't disappear either.
In 4.21, exempt policy findings are excluded from scoring while remaining visible in the platform. Exemption details are available in client views, so anyone reviewing a finding can see that it was exempted and the details behind it.
What this means for you: scores reflect the findings that actually count, and your team keeps a transparent, reviewable record of every exemption.
4.21 also includes a set of refinements across integrations, automation, risk, and assessments.
Taken together, 4.21 connects more of your environment, runs automation on the dates that matter, and keeps your risk data complete wherever it goes.
Existing customers can reach out to their Customer Success Manager to walk through the new capabilities.
New to CyberStrong? Request a demo to see how the platform turns security data into risk intelligence your team and board can act on.