Last month, we shipped updates across Terra Platform™ and Terra Offensive Research Collaboration Hub (TORCH). The goal of the releases last month was simple: findings must be accurate, governed, and straightforward to act on. The release adds deeper detection before validation, a formal process to dispute severity, audit data in your SIEM, rebuilt Jira, Linear, and Slack integrations, and action-based MCP Server tools.
For CISOs, these changes support three outcomes.
- Your teams triage with better evidence.
- Your auditors get a full record of who changed what, and why.
- Your engineers get findings in the tools they already use, with fewer manual handoffs.
Below is a summary of each update and why it matters.
Deeper detection with Deep Active Probe
Deep Active Probe gives your team earlier, higher-quality input before validation starts. It researches endpoints for reachable vulnerability vectors. It identifies insertion points, records observations, and builds evidence-backed hypotheses.
Deep Active Probe does not exploit vulnerabilities or prove impact. That boundary is deliberate. The probe produces leads. Each lead shows as an evidence-backed signal that your team can triage. Validation and remediation then follow through your normal workflow.
Why it matters
Validation time is expensive. When a tester starts from weak leads, much of that time goes to dead ends. Deep Active Probe moves research earlier in the process, so validation effort goes to vectors that are reachable and supported by evidence. You can also re-run the probe when you want another research pass. For example, you can re-run it after a release changes your attack surface.
Cleaner triage and stronger governance
Severity change requests
Severity is not always one-size-fits-all. A finding can carry less risk in one environment than in another because of compensating controls or business context. Teams need a way to raise that difference without informal edits to the record.
You can now request a severity change from the finding page. You propose a new severity and give a justification. The severity does not change until Terra approves or rejects the request. Every request has a full audit trail, and a rejected request keeps the rejection reason.
In TORCH, you can filter findings by Severity change requests, so no request sits unnoticed. For regulated teams, this gives a documented, reviewable path for every severity decision.
Catch up notification inbox
When open actions and setup gaps spread across many applications and workspaces, you can easily miss them. The new Catch up inbox collects them in one place. The bell in the sidebar shows open actions and health issues across all applications you can access. When you close the panel, the unread count clears. Opening a row does not dismiss it. On an application's Overview, Catch up also shows setup gaps and what changed since your last visit.
Smoother handoffs into your existing tools
Splunk audit logs
Our Splunk SIEM integration now sends more than findings. After you connect through the HTTP Event Collector (HEC), you can stream three data types into Splunk: Findings, Audit log, and, optionally, Application interactions.
Security and compliance teams get finding activity, status and field changes, and actor context where they already investigate. This makes it easier to correlate pentest activity with other security events and to answer audit questions from data you already retain.
Improvements to Jira and Linear ticketing
We rebuilt native ticketing for Jira and Linear. You connect once and map projects or teams, fields, and statuses. When auto-create is on, Terra opens a ticket when a finding is published. You can route each application to its own Jira project or Linear team, so the right people get the work. The revamp includes:
- Two-way status sync
- Custom field mapping
- Optional proof-of-concept (PoC) attachment
- Severity thresholds to control which findings create tickets
- Links to existing tickets from the finding page
- Backfill tickets for existing findings (Jira)
- Limit a configuration to specific repositories (Linear)
Wiz auto-mapping
Wiz application mapping is now faster. Matched objects from connected repositories show as Suggested mappings. You review each suggestion before it applies, and nothing applies silently. The result is fewer missed routes for Wiz-sourced signals, with your team in control of every mapping.
Rebuilt Slack integration
We also rebuilt the Slack integration. Terra can send Actions (published findings, retests, and remediation PRs), health issues, and an activity summary digest to Slack. You can give each application its own channel, so updates reach the team that owns it.
Action-based MCP Server tools
The Terra MCP Server lets your team work with Terra from Cursor, Claude Code, or Codex. You can work with findings, reports, Validation Hub, scans and jobs, attack-surface operations, and TORCH. The tools each user can access depend on their licenses, their role, and whether TORCH is online.
Action required for existing MCP users: Tools are now grouped by action, and the old tool names are removed. Update the auto-approve lists in your MCP clients. Each MCP connection covers one tenant only.
TORCH: clearer workflows and agentic testing with guardrails
TORCH is the AI workstation where pentesters work with Terra's agents. It brings together agent executions, signal queues, agent reasoning, the interactive Copilot, and reporting. This month's updates make daily work clearer and give testers more control over Copilot.
UX refresh
Asset and execution lists now use one layout across target types. Executions now show Status and Result separately, so the state of a run and its outcome are easier to read. In Copilot Chat History, you can now rename or delete sessions. The aim is less time searching the UI and more time testing.
Copilot terminal approval
In TORCH, Copilot can run terminal commands under your control. You choose one of three Terminal approval modes: Allowlist (the default), Auto-review, or Run everything. You can also set Terminal rules, inspect session files in the Chat filesystem, and stop background agents when needed. Copilot also has a dedicated command executor and Live Terminal tabs.
These controls let each team match agent autonomy to its own risk tolerance. A team can start with a strict allowlist and widen access as it builds trust. These are policy controls. They reduce risk, but they do not replace human oversight of agentic testing.
What this release means for your program
Each update in this release supports the same goal: findings that are accurate, governed, and straightforward to act on.
Deep Active Probe improves the quality of input before validation. Severity change requests and Splunk audit logs give auditors a clear, reviewable record. The Jira, Linear, Slack, and Wiz integrations reduce manual handoffs between security and engineering. The MCP Server lets teams work with Terra from the AI coding tools they already use. The TORCH updates give testers clearer workflows and more control over agentic testing.
Existing customers can contact their Terra representative with any questions. And to see these updates in a live environment, book a demo.
