Product Updates - July 13, 2026

New Features & Enhancements

• Client Split Tunnel Policy Supports FQDN-Based Apps: We enhanced the Split Tunnel Policy to use FQDN-based apps that Cato dynamically updates, simplifying policy maintenance. Show me the Split Tunnel page.
  • Clients route matching traffic directly to the Internet or through Cato
  • Supported from Windows Client v6.4 and higher

• Manage Different Policy Changes in Separate Revisions: Admins can maintain multiple parallel policy revisions, allowing different policy changes to be developed independently. This enables smaller updates to be published while other changes remain in progress.
  • Switch between published and unpublished revisions
  • Initially available for Internet Firewall, WAN Firewall, and Private Access policies
     
• Notify Action Supported for Application Control Policy: Application and Data Control rules support a Notify action that lets you discourage user activity rather than block it. If a user takes an action that matches this rule, the Client displays a custom notification. Users can dismiss the notification and continue their activity.
  • Customize notification templates (show me the User Notification page)
  • CASB license required
     
• SNAT IP Range for Enterprise Browser and Browser Extension: Configure a dedicated SNAT IP range for Enterprise Browser and Browser Extension. This lets users access WAN applications that use existing IP-based ACLs, even when Cato is not the default gateway at the destination site.
  • Supported on all Enterprise Browser and Browser Extension versions

• Device Posture Checks Support Lower Than Operator: Device Posture checks that include a version number support the Lower Than operator. This provides more flexibility when applying rules to devices running versions below a specified threshold.

• Continuing Rollout for Near Real-Time Updates for Threat Prevention Stories: XOps Threat Prevention stories continue to be enhanced with near real-time updates, helping admins more quickly detect and respond to supported threat indications.
  • To see the list of enhanced story indications, see here
  • XOps license required

• Defender for Endpoint XOps Connector Supports Additional Licenses: The Microsoft Defender for Endpoint XOps connector supports these additional Microsoft licenses:
  • Now supported:
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft 365 E5 or Microsoft 365 E5 Security
    • Microsoft 365 A5 (Education) or Microsoft 365 G5 (Government)
    • Windows 11 Enterprise E5
  • Previously supported for Microsoft 365 E3 or higher
  • Cato XOps license required

• Simplified AI Gateway Integration: During the week of July 13, 2026, AI Gateway configuration will become part of the Guards page. Create a single AI Gateway Guard to generate the authorization key and configure your integration, instead of the previous two-step process.
  • AI Security Guards of type AI Gateway are now called Homegrown Apps
  • Existing AI Gateway configurations are migrated automatically
  • For more information about what has changed, see our FAQ
  • AI Security for Applications license required

• Granular Claude Plan Detection for User Interaction Policy: Apply different rules for the AI Security User Interaction Policy based on whether users access personal or enterprise Claude environments.
  • Use Claude Free and Claude for Business as separate applications
  • AI Security for Users license required

• Automatic Migration to Account-Level Bypass Policy: To help transition to the account-level Socket bypass policy, we are automatically migrating eligible site-level bypass policies to the account-level policy.
  • Applies to sites running Socket v26 and higher
  • Sites running earlier Socket versions are not eligible for automatic migration
  • The site-level bypass policy will be deprecated from accounts that migrate to the account-level policy

• Expanded Webhook Fields: Webhook notifications now include a significantly richer set of fields, giving security teams more data to build complete, actionable payloads for SIEM and SOAR platforms.
  • New security and network event fields follow the same naming conventions as the Events API, making correlation seamless
  • No impact on existing webhook integrations

• Updates for Cato Terraform Provider: We released new versions for the Cato Terraform module, including:
  • v0.0.90
    • Stabilized WAN interface hydration
  • v0.0.88
    • Support for Application Control and CASB resources for tenant restriction and application controls (e.g cato_app_tenant_restriction_rule)
  • v0.0.87
    • Support for global IP ranges (cato_global_ip_ranges)
    • Regression tests
  • Bug fixes and enhancements
  • Read more in the changelog

• Starting Rollout of Socket v26.0.23517: We are starting to gradually roll out Socket version 26.0.23517 to all customers, including enhancements and bug fixes. No customer action is required.

PoP Announcements

• Detroit, US: A new range (199.27.55.0/24) is now available for the Detroit PoP location.
• The following new ranges will soon be available:
  • Melbourne, AU: 113.30.140.0/24
  • Paris, FR: 159.117.247.0/24
  • Tel Aviv, IL: 159.117.246.0/24