The update is related to the Countercept Agent’s Response Engine (RE) Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Linux – CRAM and RE

Version:

• Response Engine 3.3.3
• CRAM 1.26.137

Pilot Availability: 19/05/2026

General Availability: 26/05/2026

Predecessor:

• Response Engine 3.3.3
• CRAM 1.24.112

Release Purpose:

• Generic Maintenance

Customer Action Required

• N/A

Name Changes:

• No changes to process, or service names.

Files Updated:

• Numerous files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Bug fixes and general maintenance

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Security Cloud Core component. The Security Cloud Core component provides means for accessing WithSecure’s Security Cloud functionalities utilized by the agent’s detection components.

Product Name: Countercept Agent for Windows – Security Cloud Core

Version: 2.1.21903

Pilot Availability: 11/05/2026

General Availability: 18/05/2026

Predecessor: 2.1.21205

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Updates to third-party libraries and vulnerability fixes.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity. 

Product Name: Countercept Agent for Windows – Sensor Component

Version: 2026.2.37

Pilot Availability: 11/05/2026

General Availability: 25/05/2026

Predecessor: 2026.1.40

Release Purpose:

• New Features and Enhancements
• Generic maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
   for more details.

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• fsatp.sys
• fsatpl.exe
• fsatpn.exe
• install.exe
• sensor_control.exe

New Features and Enhancements:

• New detections and monitoring improvements

General Maintenance:

• Bug fixes and dependency updates

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Core. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.21833

Pilot Availability: 20/04/2026

General Availability: 23/04/2026

Predecessor: 2.1.21758

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
     for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response components (FAMP). The Response
components (FAMP) of the Countercept Agent enable the Detection and Response Team to
retrieve artefacts for analysis or contain any identified threats within the environment.

Product Name: Countercept Agent for Linux – Response component (FAMP)

Version:

• 1.0.541.400

Pilot Availability: 14/04/2026

General Availability: 21/04/2026

Predecessor:

• 1.0.452.373

Release Purpose:

• Generic Maintenance and improvements

Customer Action Required

• N/A

Name Changes:

• No changes to process, or service names.

Files Updated:

• fampd
• famp.so

New Features and Enhancements:

• Updates to enable network isolation

Generic Maintenance:

• Bug fixes and general maintenance

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

The update is related to the response component of the Countercept Agent, which enables the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment.

Product Name: Countercept Agent for Windows – Response component

Version:

• 1.0.530.395

Pilot Availability: 09/04/2026

General Availability: 20/04/2026

Predecessor:

• 1.0.333.332 

Release Purpose:

• New features and enhancements 

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe

New Features and Enhancements:

• Added ARM64 support 

General Maintenance:

• Updates to third-party libraries and vulnerability fixes

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• Response Engine 3.3.3
• CRAM 3.30.35

Pilot Availability: 09/04/2026

General Availability: 21/04/2026

Predecessor:

• Response Engine 3.3.2
• CRAM 3.8.19

Release Purpose:

• New features and enhancements 

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ffind.exe
• fls.exe
• fscram-response.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• Added ARM64 support

General Maintenance:

• Updates to third-party libraries and vulnerability fixes

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

This is a notification that the update to our Windows agent’s Ultralight Core planned for GA release tomorrow, 2nd of April 2026, has been postponed until Thursday, 16th of April. The update went to Pilot group endpoints on the 26th of March 2026. Events received from the Pilot group identified the need to adjust sensor side rules before going to General Availability.

The update is related to the Countercept Agent’s Ultralight Core. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.21739

Pilot Availability: 26/03/2026

General Availability: 16/04/2026

Predecessor: 2.1.21258

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
    for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• fshoster64.exe
• FsPisces.exe
• install.exe
• jsondump64.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity.

Product Name: Countercept Agent for Linux – Sensor Component

Version: 2026.1.188

Pilot Availability: 31/03/2026

General Availability: 07/04/2026

Predecessor: 2026.1.170

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• sensor

New Features and Enhancements:

• N/A

Generic Maintenance:

• Dependency updates and bug fixes

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

The update is related to the Countercept Agent’s FSBG components. The FSBG component is responsible for the core functionality (e.g. settings management and updates) of the Countercept Agent and does not affect the components responsible for telemetry collection or response.

Product Name: Countercept Agent for Linux – FSBG

Version: 1.0.930

Pilot Availability: 09/03/2026

General Availability: 16/03/2026

Predecessor: 1.0.923

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• Several auxiliary files have been added in this release.
• No changes to process, or service names.

Files Updated:

• Most files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Changes to the functionality not utilized by Countercept.
• Minor bug fixes and improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04