The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20571

Pilot Availability: 06/08/2025

General Availability: 01/09/2025

Predecessor: 2.1.20470

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
              for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fshoster64.exe
• fsulgk.sys
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.0.3-3-0-hotfix1

Pilot Availability: 30/07/2025

General Availability: 11/08/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 3.0.30

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ResponseDotnet.dll

New Features and Enhancements:

• N/A

General Maintenance:

• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Countercept agent for macOS v25.1 will be released to general availability (GA) on the 23rd of June 2025.

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.0.30

Pilot Availability: 23/06/2025

General Availability: 07/07/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 2.24.16

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• Due to the restructured Response Engine, all files are updated, internal response engine libraries are moved to the _internal subdirectory, CPython files are added.
• fscram-response.exe is replaced with fscram-response.dll.
• No changes to service names.

Files Updated:

• install.exe
• ffind.exe
• fls.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• N/A

General Maintenance:

• The Response Engine is restructured as the first step toward using CPython.
• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Security Cloud Core component. The Security Cloud Core component provides means for accessing WithSecure’s Security Cloud functionalities utilized by the agent’s detection components.

Product Name: Countercept Agent for Windows – Security Cloud Core

Version: 2.1.20491

Pilot Availability: 18/06/2025

General Availability: 25/06/2025

Predecessor: 2.1.19071

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Updated the third-party curl library to the latest version.
• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20470

Pilot Availability: 16/06/2025

General Availability: 23/06/2025

Predecessor: 2.1.20390

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
             for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fsulgk.sys
• install.exe
• jsondump64.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

This is a notification that the update to the Countercept agent for macOS planned for a General Availability release on the 9th of June 2025 has been postponed. The update went to Pilot group endpoints on the 2nd of June 2025. Events received from the Pilot group identified the need to adjust sensor side filtering rules before going to General Availability.
The update includes general maintenance for various Mac Agent components.

We will advise on the release schedule for the new update shortly. As always, please don’t hesitate to contact us if you have any questions.

Countercept Agent for macOS 25.1 pilot release

Countercept Agent for macOS 25.1 has been released to our pilot customers on 2nd of June.

Release contents:

• Pre-Ventura code has been removed
• New sensor (2025.1.198.0) and response (25.15) versions
• The product no longer ships with initial SensorDB. As a result, sensor process will only start once the sensor database becomes available (affects initial installation cases).
• Fixes an issue when response would get stuck in case pinned-certificate get new context
• Removes unused OPSWAT SDK from MDR product

Installer can be downloaded from

https://download.withsecure.com/countercept/macos/latest/WithSecure-Countercept-Agent-54383.pkg

This is a notification that the update to our Windows agent’s Ultralight Core planned for the Pilot release today, 7th of May 2025, has been cancelled due to further issues found during the pre-Pilot phase. We apologize for the delays related to this particular Pilot release, but we are committed to making sure that we release content with the highest possible quality. We will advise on the release schedule for the new update.

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20390

Pilot Availability: 19/05/2025

General Availability: 26/05/2025

Predecessor: 2.1.20210

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
            for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

New service will be registered with this release:

• wsulavprothoster_mdr

New process will be added with this release:

• fsulprothoster.exe

More details can be found at Changes to the Windows EPP Scanning Components – May 2025

Files Updated:

• CapricornScanner.exe
• fsulgk.sys
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Fixes for issues identified during 2.1.20350 pre-Pilot.
• General maintenance of functionality not utilized by Countercept

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025