The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity. 

Product Name: Countercept Agent for Windows – Sensor Component

Version: 2026.1.40

Pilot Availability: 03/03/2026

General Availability: 17/03/2026

Predecessor: 2025.3.64

Release Purpose:

• New Features and Enhancements
• Generic maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
        for more details.

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• fsatp.sys
• fsatpl.exe
• fsatpn.exe
• install.exe
• sensor_control.exe

New Features and Enhancements:

• New detections and monitoring improvements
• Additional tampering protection

General Maintenance:

• Bug fixes and dependency updates

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity.

Product Name: Countercept Agent for Linux – Sensor Component

Version: 2026.1.170

Pilot Availability: 24/02/2026

General Availability: 10/03/2026

Predecessor: 2025.2.185

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• sensor

New Features and Enhancements:

• CPU improvements on heavy load systems
• Extended file attributes for file metadata 
• Improved security of scanning results 
• Improved file event info gathering 
• Extended firewall monitoring 

Generic Maintenance:

• Dependency updates and bug fixes

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

The update is related to the Countercept Agent’s Security Cloud Core component. The Security Cloud Core component provides means for accessing WithSecure’s Security Cloud functionalities utilized by the agent’s detection components.

Product Name: Countercept Agent for Windows – Security Cloud Core

Version: 2.1.21205

Pilot Availability: 09/02/2026

General Availability: 16/02/2026

Predecessor: 2.1.20961

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Core. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.21258

Pilot Availability: 09/02/2026

General Availability: 17/02/2026

Predecessor: 2.1.21134

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
   for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• fshoster64.exe
• install.exe
• jsondump64.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Linux – CRAM and RE

Version:

• Response Engine 3.3.3
• CRAM 1.24.112

Pilot Availability: 03/02/2026

General Availability: 10/02/2026

Predecessor:

• Response Engine 3.3.2
• CRAM 1.24.112

Release Purpose:

• Generic Maintenance

Customer Action Required

• N/A

Name Changes:

• No changes to process, or service names.

Files Updated:

• Numerous files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Bug fixes and general maintenance

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• Response Engine 3.3.2
• CRAM 3.8.19

Pilot Availability: 26/01/2026

General Availability: 02/02/2026

Predecessor:

• Response Engine 3.1.33
• CRAM 3.8.19

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ffind.exe
• fls.exe
• fscram-response.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Updates to third-party libraries and vulnerability fixes

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Updater. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Updater

Version: 2.1.20910

Pilot Availability: 15/01/2026

General Availability: 22/01/2026

Predecessor: 2.1.19173

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe 
• ulu.exe 
• ulu_handler.exe 
• ulu_handler_ns.exe 

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Core. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.21134

Pilot Availability: 07/01/2026

General Availability: 14/01/2026

Predecessor: 2.1.21067

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
  for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• fshoster64.exe
• fsulgk.sys
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity. 

Product Name: Countercept Agent for Windows – Sensor Component

Version: 2025.3.64

Pilot Availability: 07/01/2026

General Availability: 21/01/2026

Predecessor: 2025.3.54

Release Purpose:

• Generic maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
       for more details.
  Any endpoints which are not ACS-compliant will continue to run the previous production version of the sensor (2023.1.75).

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• fsatp.sys
• fsatpl.exe
• fsatpn.exe
• install.exe
• sensor_control.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Bug fixes and general maintenance

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Please note that Windows 7 and Windows Server 2008 (R2) are not supported. On endpoints where these operating systems are in use, the Countercept agent will not be updated, and the previous sensor version (2024.2.31) will continue to run. New Countercept agent installations to these operating systems are now impossible.

The update is related to the Countercept Agent’s Ultralight Core. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.21067

Pilot Availability: 03/12/2025

General Availability: 11/12/2025

Predecessor: 2.1.20934

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• fshoster64.exe
• FsPisces.exe
• fsulgk.sys
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025