June 2026
Identifier Discovery Policies moved to the Policies tab
Release date: June 29, 2026
Identifiers Discovery Policies are now managed alongside all other policy types under the Policies tab on the Identifiers page. Previously, Discovery Policies were displayed in a separate tab.
This consolidation brings all policy management into a single location, so you can create and manage Identifier Matching Policies, Identifier Discovery Policies, Tenant Ignored Terms Policies, and Tenant Duplication Policies from one place.
Learn moreLearn more
Profile Page Redesign
Release date: June 29, 2026
The user Profile page has been updated with a cleaner layout, improved hierarchy, and a more cohesive design. No change in functionality, just a fresh new look.
Learn moreLearn more
Search and Switch Tenants
Release date: June 29, 2026
The Tenant navigator has been updated with two new capabilities. In addition to easily switching between Tenants, you can now search for a Tenant by name and create new Tenants directly from the navigator:
- Search: Use the search bar to quickly find a Tenant by name.
- Create Tenant: Create a new Tenant directly from the Tenant navigator without having to access the Settings menu.
Learn moreL
The Cyber Threat Intelligence (CTI) Module
Release date: June 24, 2026
The Cyber Threat Intelligence (CTI) Module brings threat intelligence research, reporting, operationalization, and analysis together in the Flare Platform, and offers the following capabilities:
- Intelligence Browser: Research threats, actors, campaigns, and indicators and follow the relationships between them to build a full picture of a threat.
- Threat Flow: Generate technical and executive-ready intelligence reports scoped to your organization's context, with the ability to pivot any named entity back into the Intelligence Browser.
- Enterprise IOC Feed: Deliver IOCs surfaced during research and reporting to your detection and response tools in STIX 2.1 format over the TAXII 2.1 protocol, compatible with SIEMs, SOARs, EDRs, TIPs, and firewalls.
- Sandbox and File Analysis (add-on): Investigate suspicious files and URLs discovered inside or outside Flare with enterprise-grade sandbox and analysis technology.
Learn moreLearn more | See how it works
Platform Navigation Updates
Release date: June 24, 2026
The Flare Platform navigation has been reorganized to make key features easier to find. Here's what has changed:
- There are dedicated sections in the left navigation for Identity Exposure and Threat Intelligence modules.
- Settings and Help menus have moved to the top right corner.
Click through the following product tour to learn more.
Okta Integration
Release date: June 24, 2026
As part of the Identity Exposure Management (IEM) module, you can now integrate with Okta to sync user identities as Identity Identifiers. With proper configuration, the Okta integration provides the following benefits:
- Identity Sync: Pulls users from your Okta directory and creates Identity Identifiers to match against leaked credentials.
- Identity Profiles: Each synced user gets an Identity Profile used for investigation following a credential exposure event.
- Automated Credential Validation: Leaked credentials can be automatically validated to determine whether they are still valid.
- Bulk Password Validation: Bulk password validation allows you to select leaked credentials and validate them all at once.
- Remediation Actions: When a credential is confirmed valid, manual or automated remidiation actions can be performed on it.
Learn moreLearn more
Domain Matching Policy for Identifiers
Release date: June 17, 2026
Domain Matching Policy for Identifiers is now available for ASTP subscribers. It monitors for compromised credentials associated with your domain and scopes detections to the user population most relevant to your threat model.
Compromised credentials are surfaced using two match modes:
- Email domain: Surfaces detections where the compromised credential includes an email address at your organization's domain.
- Authentication domain: Surfaces credentials that can potentially grant access to your platform, identifying any user who authenticates on your domain regardless of where their email is hosted.
This gives security teams precise visibility into credential exposures without noise from out-of-scope identities.
Learn moreLearn more
Usage Dashboard
Release date: June 17, 2026
The Usage Dashboard now includes an Overall Organization Usage section at the top of the page. It provides an at-a-glance view of how your organization is consuming key Flare resources for the current month, with a summary card for each of the following:
- Identifier Usage: Current Identifier count with your total allotment.
- IdP-Synced Identities: Total identities synced from your connected identity provider.
- Global Search Usage: Searches run against your quota, with a breakdown by module, member, and Tenant.
- Takedowns: Takedown Request usage when the service is enabled.
- Sandbox Usage: Sandbox quota consumption.
Learn moreLearn more
Audit Logs
Release date: June 12, 2026
The following enhancements have been made to Audit Logs:
- Filtering is now available to focus the view to the actions most relevant to your investigation.
- Active filters are reflected in the URL, making filtered views easy to share directly with others.
- Log entries are now retained for one year.
Learn moreLearn more
Identifier API Endpoints
Release date: June 9, 2026
Five new endpoints are now available in the public API for managing Identifiers:
These new endpoints follow a standardized request and response structure, with clearly defined payloads, parameters, and response schemas, improving on the previous assets-based format that caused inconsistencies for some users. The original endpoints remain available alongside the new ones to support current integrations. For new integrations, we recommend using the new endpoints.
The Breaches Directory
Release date: June 9, 2026
The Breaches Directory has been updated with the following changes:
- Breaches without credentials now appear in the directory alongside credential breaches.
- Three new columns (Verified, Credentials, and PII) support granular filtering and clearer at-a-glance context.
- Active filters are reflected in the URL, making it easy to share a filtered view directly with others.
- Breaches with credentials link directly to the Credentials Browser and Leaked Events. Breaches without credentials link directly to the Global Events feed.
Learn moreLearn more
Updates to Ransom Leak Events
Release date: Progressive rollout beginning June 9, 2026
Flare now detects when a ransomware blog post is updated after it has already been crawled and generates a new Ransom Leak Event. The update Event includes a structured view of what changed between the original and updated versions.
Learn moreLearn more
Jira Service Management Support in Jira Alert Channels
Release date: June 10, 2026
Jira Alert Channels now include custom fields which can be used to configure Jira Service Management (JSM) request types. This allows Flare alerts to be routed directly to JSM projects and tracked alongside existing service requests.
Learn moreLearn more
Sharing Events from The Events Feed
Release date: June 3, 2026
A new Share Event action is now available in the Event details -> Actions menu. Selecting it copies a link to the Event to your clipboard, which automatically routes recipients to the correct tenant context when opened.
Learn moreLearn more
