The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20648

Pilot Availability: 23/09/2025

General Availability: 30/09/2025

Predecessor: 2.1.20571

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
               for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fsulgk.sys

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

This is a notification that the minor update to our Windows agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components, originally scheduled for General Availability on Monday, 8 September 2025, has been postponed to Monday, 15 September 2025. The update went to Pilot group endpoints on the 1st of September 2025 and contains general maintenance improvements for the Response Engine (RE) and Common Response Actions Module (CRAM) components.

Due to insufficient telemetry collected during the past week we were not able to confirm if all components function correctly. As a result, we have decided to keep this update in Pilot for a further week.

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.1.33

Pilot Availability: 01/09/2025

General Availability: 08/09/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 3.0.3-3-0-hotfix1

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ffind.exe
• fls.exe
• fscram-response.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Third-party component is updated to address recently discovered vulnerabilities, including CVE-2024-45491.
• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity. 

Product Name: Countercept Agent for Windows – Sensor Component

Version: 2025.2.44

Pilot Availability: 13/08/2025

General Availability: 02/09/2025

Predecessor: 2025.1.89

Release Purpose:

• New Features and Enhancements
• Generic maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
     for more details.
  Any endpoints which are not ACS-compliant will continue to run the previous production version of the sensor (2023.1.75).

Name Changes :

• No changes to file, process, or service names.

Files Updated :

• fsatp.sys
• fsatpl.exe
• fsatpn.exe
• install.exe
• sensor_control.exe

New Features and Enhancements:

• New detections and detection improvements

General Maintenance:

• Bug fixes and dependency updates

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Please note that Windows 7 and Windows Server 2008 (R2) are not supported. On endpoints where these operating systems are in use, the Countercept agent will not be updated, and the previous sensor version (2024.2.31) will continue to run. New Countercept agent installations to these operating systems are now impossible.

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20571

Pilot Availability: 06/08/2025

General Availability: 01/09/2025

Predecessor: 2.1.20470

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
              for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fshoster64.exe
• fsulgk.sys
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.0.3-3-0-hotfix1

Pilot Availability: 30/07/2025

General Availability: 11/08/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 3.0.30

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ResponseDotnet.dll

New Features and Enhancements:

• N/A

General Maintenance:

• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.0.30

Pilot Availability: 23/06/2025

General Availability: 07/07/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 2.24.16

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• Due to the restructured Response Engine, all files are updated, internal response engine libraries are moved to the _internal subdirectory, CPython files are added.
• fscram-response.exe is replaced with fscram-response.dll.
• No changes to service names.

Files Updated:

• install.exe
• ffind.exe
• fls.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• N/A

General Maintenance:

• The Response Engine is restructured as the first step toward using CPython.
• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Security Cloud Core component. The Security Cloud Core component provides means for accessing WithSecure’s Security Cloud functionalities utilized by the agent’s detection components.

Product Name: Countercept Agent for Windows – Security Cloud Core

Version: 2.1.20491

Pilot Availability: 18/06/2025

General Availability: 25/06/2025

Predecessor: 2.1.19071

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• install.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Updated the third-party curl library to the latest version.
• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20470

Pilot Availability: 16/06/2025

General Availability: 23/06/2025

Predecessor: 2.1.20390

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
             for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fsulgk.sys
• install.exe
• jsondump64.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

This is a notification that the update to our Windows agent’s Ultralight Core planned for the Pilot release today, 7th of May 2025, has been cancelled due to further issues found during the pre-Pilot phase. We apologize for the delays related to this particular Pilot release, but we are committed to making sure that we release content with the highest possible quality. We will advise on the release schedule for the new update.