Notes
What we shipped
Release notes and product notes. The opinions live on the Old Forge blog.
-
Eyewitness asks the customer for what the agent can't see
Eyewitness reads each new ticket, works out what a technician will need from the machine, and asks the customer's phone for it: a photo of the screen, a video of the power light, the beeps a PC makes when it won't start. It runs on our staging server and is coming to Wegweiser.
Read -
Probes now find files that no installer registered
Windows agents from 0.3.119 list the executables where software is installed, once a day, and the server keeps the history. A threat probe can name a file such as php8ts.dll or log4j-core and find it on machines that are switched off, and Stack has a Find a file search across every client.
Read -
Machines added mid-month now bring their Wegcoins with them
From today a machine that joins a plan during the month is charged pro rata the next morning, and its share of the plan's included Wegcoins arrives in the same pass, so onboarding a client on the 2nd no longer drains the allowance of the machines you already had. A machine that stops checking in leaves the bill after 31 days instead of 45.
Read -
A headline that names software now searches your estates
PHP's maintainers published fixes for two 9.8 remote-code flaws, and our briefing listed the headline and stopped there. From today a headline or a CVE that names software becomes a probe: the briefing searches every client's machines for it, names the versions against the fixed releases, and asks the machines themselves every six hours.
Read -
Six checks were claiming compliance controls they can't see
The compliance map tied six checks to controls their data can't evidence, among them MFA for remote access, restore testing and a deployed antivirus. From 12 October the chips on a finding, the onboarding report and the QBR list only what each check shows, and the macOS check claims the controls it was missing.
Read -
Your data is stored in the UK, and the AI that reads it can be yours
Wegweiser runs on a private cloud in the UK. Its analyses are written by Anthropic's Claude unless you choose another AI, and Claude may process them outside the UK and the EU. Claude on your own AWS Bedrock account, a provider in Germany or your own models keep the analyses and the chat where you choose. A case still runs on Claude at Anthropic, and from today it leaves your DocuVault documentation out.
Read -
wegweiser.tech is in Japanese now
The marketing page has a Japanese edition at wegweiser.tech/ja/, written for in-house IT departments as well as MSPs, with the Cases and Software Watch one-pagers in Japanese. The console and the analyses stay English or German, and the page says so. A globe in the header now opens every language.
Read -
A client's page now lists the tickets Wegweiser opened for it
Each client's page has a Tickets section when a ticketing integration is connected: what Wegweiser holds open in your helpdesk for that client, what it closed in the last 30 days, and one switch that keeps the client out of new tickets. Building it turned up two faults in the Zammad sync, and a help request sent at one client could bind another client's tickets to the machine it came from.
Read -
Agent release log
Every Wegweiser agent release, newest first, with the headline from its build. The milestones worth reading about are in the posts; this is the reference.
Read -
The chat asks before it accepts a finding, and you tick which ones
Asking the device chat to accept findings, or to remember what a machine is, now leaves a card under its answer with one row per finding and nothing ticked. Only what you tick and confirm is written. The chat reads text other people wrote, and a sentence in a runbook or a VSA notification could have made it accept findings by itself.
Read -
The device chat can read your Shell's screen, if you let it
Ask the device chat about the dialog or error on your own open Shell and it reads the screen instead of guessing. It's off until an admin or master switches it on, because a root shell's screen goes to your AI provider. Shell recordings are now kept for a year unless you choose another period.
Read -
A shell session is now kept, and a lost one comes back
What a Shell session showed is now recorded and replayed in the message centre, without the keystrokes. Connect returns you to a shell your browser left running, with any question still on screen, and debconf's dialogs draw the way they do over SSH.
Read -
An agent update now waits for the package manager
Agent 0.3.116 waits for another installer instead of failing at it, and a rollout a person has resumed is judged from the resume. The device page's guided tour is back, Claude Haiku 5.5 works in the chat, and the database now has a generated schema document and a command that proves a database matches it.
Read -
New scanner checks run on trial before you see them
Checks taken from the community rule sets now run on trial: what they find stays out of your Detections, health scores and bill until they have run clean for 14 days. You can ignore a single rule, for all your clients or one; a client's page lists the machines its VSA knows and no Wegweiser agent reports; and the Security briefing opens on what needs you now.
Read -
An MSP can buy a new-client audit for £249
Taking over a client? Put the agent on its machines and Wegweiser assesses every one of them, then binds them into one report in your branding: £249 for up to 30 machines, two full passes, paid once by card. Try it on three of your own machines first, free.
Read -
The onboarding report costs 10 Wegcoins a copy
The onboarding report, every machine's own assessment bound into one PDF for the client, isn't sold per machine any more. A copy costs 10 Wegcoins, charged when it's ready, and anyone in your tenant can draw it from the client's Onboarding Assessment page.
Read -
Wegweiser now needs a plan on every tenant after 14 days
From today a tenant needs a plan 14 days after sign-up, whatever AI it uses: the plan pays for the platform, and Wegcoins pay for use on top. Without one, Wegweiser does no new work for the tenant until a plan is active. Tenants that existed before today have until 5 November.
Read -
Website scans, uptime monitors and the AI buttons now cost Wegcoins
A full website security scan costs 50 Wegcoins and a passive check 5, an uptime monitor 1 a month, and the AI buttons on a page cost what a chat turn does. The Wegcoin Bazaar now lists every price.
Read -
Wegcoins now come in a £99 pack
The smallest Wegcoin pack was £399. There's now a Starter pack of 1,000 Wegcoins for £99, and the Wegcoin Bazaar's price list says what a Wegcoin costs in money.
Read -
An onboarding report binds every machine's assessment for the client
The Onboarding Assessment page now has the document an MSP hands a new client: a cover that names the machines to read first and the issues running across the fleet, then each machine's own report, worst first, with your logo and a bookmark per machine. Since 6 October a copy costs 10 Wegcoins.
Read -
Client analyses move to Claude Opus 5.5
Device checks, roll-ups and the Security Audit reading on Wegweiser's AI now run on Claude Opus 5.5. From 12 October an analysis on Opus costs one and a half times its standard wegcoin price, rounded up, and the Standard plan includes 90 wegcoins per endpoint instead of 60, so a full monthly pass still fits. Macs have their own checks again: security posture, hardware age and log health. Settings now describes and prices every check correctly.
Read -
Plans can be paid for in pounds or euros
A master can now choose a plan on the Wegcoin Bazaar and pay by card, or by SEPA direct debit in euros: £2, £4 or £12 per endpoint a month, or €2.50, €5 or €14. Billing is monthly on the 1st for the machines that checked in, and the first month is charged for the days left. A plan's included Wegcoins are spent first and expire at the end of their month; Wegcoins you buy don't. Macs get Time Machine in backup health and a weekly Lynis audit, and a fleet of thousands opens folded by client.
Read -
Every check now leads with what matters
Each analysis on a device's Findings page now opens with a one-sentence verdict, lists what to know worst first, says what it checked and found in order, and ends on one action. Listening ports, backup jobs, drives and sessions are shown as tables. The network check knows when a machine sits behind NAT, and the Security Audit reads like every other check, audited by Lynis.
Read -
Tell the scanner what you don't allow
You can now add your own software to the scanner without writing YARA: answer two questions, try the rule on a machine, save it. We also checked the scanner against its own description, found six detections switched off for every customer and a Windows sweep that skipped people's folders, and fixed both. The help button is on Linux desktops.
Read -
What your clients' websites expose to the internet
A website scan now also brings back the Shodan record of the server behind the site: the services it exposes, the software and version behind each, what is past its end of life, and the CVEs matched to those versions, with the actively exploited ones first. On your own Shodan key, and the card no longer hides a scan that failed.
Read -
MeshCentral, one click from the machine
Connect MeshCentral and every machine you link opens its remote desktop, terminal and files from its Wegweiser page. Wegweiser only reads: a fixed list of questions to what MeshCentral has already stored, and nothing sent to an agent. Linking now also weighs the system UUID, which for a virtual machine is often the only identity there is.
Read -
Wegweiser now audits what your VSA knows
Wegweiser no longer pairs VSA devices by name: a person links each one, with the evidence in front of them. A new audit reads what your VSA knows about the estate once, from the notification backlog and what it sends into Autotask to the agents that went quiet, and ends every chapter on what to change. Also: Wegweiser alerts in your Skald hall, and each machine's agent version in the device list.
Read -
Your n8n workflows, one click from the answer
Connect the n8n at a client's site and the device chat can suggest one of your own workflows for the machine it is looking at: patch it, restart a service, whatever you built. Nothing runs until a technician presses Run. Wegweiser is granted three permissions in n8n and asks for nothing else, and a workflow is only ever told about the machine the chat is about.
Read -
Tickets that know their machine
Wegweiser now reads the tickets in your Zammad, works out which machine each one is about, and says which are worth an investigation. A case started from a ticket reports back into that ticket. And a new help button on managed machines files a request that already knows its machine and what the machine was doing at the moment somebody asked.
Read -
Software its vendor no longer fixes
The Security briefing has a new chapter: every version on your clients' machines that its vendor has stopped fixing, or will stop fixing within six months. It also reads browser versions against the vendor's fixed release, so a flaw every machine already has the fix for stops being news. And every check on a device page now ends on what to do.
Read -
The week in security news, next to your own machines
The Security briefing now lists the week's security headlines from national CERTs and the security press, with those that name software on your clients' machines first. And on a wide screen, the portal finally uses all of it.
Read -
End of support, on every report
Whether an operating system, an application or a runtime such as .NET or Node.js still gets security fixes now comes from a catalogue updated every day, and every PDF report says it: an EOL badge beside each affected machine, and a section that says what ended, when, and what runs until when.
Read -
VirusTotal and MalwareBazaar, on your own keys
Malware lookups on scan findings now run on keys you connect under Integrations, count against your own accounts, and stay in your tenant. The shared keys they used to run on were free keys, and neither VirusTotal nor abuse.ch licenses those for a commercial service. Every match now also names the author of the rule that made it.
Read -
Website security with nothing to set up
Every tenant now has Website Security Light: a passive look at a client's public websites, running on an account of its own, with nothing to connect first. Advanced adds active tests and decisions that later scans respect. And the device, client and group pages now read in order, each analysis opening on its verdict and closing on what to do.
Read -
What is being exploited, and where it reaches
The tenant page is rebuilt around what your clients' machines already tell us. The Stack reads your RMM, remote access, endpoint protection, backup, monitoring and VPN tools off every machine and measures each client against your standard. The Security briefing matches the vulnerabilities attackers are exploiting this week against the software on those machines, and says how each one reaches them.
Read -
What only goes wrong the first time
A new machine's first day had faults an upgrade test can never see: event logs scored on nothing, a clock refusal nobody was told about, plans five minutes late. All of them are fixed, threat scans now reach the end of their file list, backup health finally reads the backups a machine records, a group has a report of its own, and a website finding shows where it was found.
Read -
A case found more in a crash problem than we had
We put yesterday's crash problem to a case in the MSP's own words, and it found more than we had. Crashes are now counted per program and named by where the program is installed, a busy machine's event history no longer stops uploading, and cases work on a whole group or client.
Read -
When the user calls, open a case
A problem you were told about on the phone now gets the same depth of investigation as one Wegweiser found itself: describe it in the device chat, attach the log, and the cause comes back into the thread. Plus remote control that reaches a locked machine, agents that keep themselves current, and investigations charged for what they cost.
Read -
A report you can hand to a client
The four PDF reports open on a cover, carry the device page's instruments, and every check on them now says its own name and what it actually looks at. In German too. Plus a settings page that tells you when an API key is about to die, instead of after.
Read -
Nobody's website gets scanned by accident
Wegweiser can now scan a client's public website for vulnerabilities and bring the findings back beside everything else it knows about them. The interesting part is not the scanner. It is what had to be true before we would let anyone press the button.
Read -
Twenty-six alerts, one locked door
Our own log triage filed twenty-six bug reports overnight, all of them the same fault, and the one that mattered most described it backwards. Here is what was actually wrong, and the two things it changed: an alert that names its cause, and an analysis that is allowed to finish.
Read -
Tell it what the machine is
Wegweiser can now be told the one thing it can never collect: what a machine is actually for. Plus bulk user import, so onboarding a customer with real staff no longer means inviting them one at a time.
Read -
The scanner does one thing now
We removed a feature this week: the scanner no longer generates detection rules from CVE feeds. Here is what it was doing, why it never worked, and what the scanner is for instead.
Read -
An investigation now stops in time to write it down
A device investigation could spend its whole budget gathering evidence and then have no time left to tell you what it meant. It now measures how long its own turns are taking and stops early enough to write the conclusion. When there is still no conclusion, the row says whether the evidence is there or not.
Read -
An investigation that runs out of time writes up what it found
A root-cause investigation now keeps its own clock instead of trusting the worker to stop it. It stops starting checks it has no time to finish, holds time back to write its conclusion, and when there is still nothing written the row tells you whether the evidence is there or the run gathered nothing.
Read -
A clipping becomes a ticket
Any scratchpad note can now be raised as a Zammad ticket in one press, filed under the client organisation the note came from. The preview shows where it will land before anything is written, and the note keeps the ticket number as a link.
Read -
When your machines are actually in use
Wegweiser now reads when each machine is on and when it is worked, from the CPU samples it was already collecting. Ask the chat when a PC is used, find the quiet window for a reboot, and let analyses judge a spike against the hour it happened in.
Read -
Priced in pounds, with the VAT worked out
Wegweiser bills in GBP now: packs at 399, 799 and 1,599 pounds, plans at 2, 4 and 12 pounds per endpoint per month, all net, with Stripe adding VAT from your billing address and zero-rating an EU business that supplies a VAT number. The checkout path was also rejecting Stripe's own confirmations, which is fixed.
Read -
The controls your client actually asks about
Compliance chips are now one per framework and open to show what they mean, three German frameworks are available - BSI IT-Grundschutz, NIS2 and the CyberRisikoCheck - and a tenant chooses which ones it is assessed against. Four analysers that had evidenced nothing now evidence something.
Read -
Findings that become tickets
Wegweiser now connects to Zammad: it reads your organisation list so you do not have to retype it, and files a ticket when it finds something a technician should actually do. Four conditions, one ticket per device per condition, and it never reopens work you have finished.
Read -
The audit that ran no tests
Nine machines were carrying a Linux hardening score built from zero measurements, and nothing failed. Wegweiser now checks whether its own readings mean anything, and can watch an account that exists only to never be used.
Read -
The halt that could not be cleared
An agent rollout stopped itself over a laptop that was switched off, a reprocess button offered work nothing could run, and the insights feed filed our own test traffic. Four false alarms, fixed.
Read -
Wegweiser spricht Deutsch
The pages in the language each person chooses, the analyses in the language the tenant chooses, and a German front door at wegweiser.tech/de/ with an Impressum. Nothing is re-run, and English stays the base.
Read -
The Windows package enrols by itself
Give the agent's MSI a token and a server on the msiexec command line and it registers the device, installs the service and starts it. No PowerShell, nothing to paste on the machine: the form a software distribution system or a golden image wants.
Read -
Which Windows is this? Agent 0.3.96 asks the kernel, not PowerShell
A Windows 11 PC spent six weeks listed as windows-Unknown-Unknown because the agent asked PowerShell for its identity and PowerShell would not answer. Agent 0.3.96 reads the edition, build, model, manufacturer and locale straight from the kernel and the registry, and the server no longer lets an unknown answer overwrite a known one.
Read -
One line installs the agent on Linux and macOS
The pasted install block for Linux and macOS is gone. In its place is a single command that downloads a readable installer script from your own Wegweiser server and runs it. It retires a failure where the paste stopped halfway and left the machine unenrolled.
Read -
Remote control on X11 desktops, and a Control button only where it works
Agent 0.3.95 takes the screen of any Linux desktop running X11, which is most of them: Mint, XFCE, MATE, KDE and GNOME on Xorg. It also asks the machine whether it has a screen at all, so the Control button stops appearing on headless servers.
Read -
Taking a Linux desktop, and the eleven things in the way
Remote control now works on Ubuntu, not just Windows. Agent 0.3.94. This is what it took, including the bug that let you watch a machine but never click on it.
Read -
Nobody else's code runs on your login page
Twenty-three front-end libraries were being fetched from two CDNs, two of them at whatever version was published that morning. They are all served from us now, and reCAPTCHA is gone because three months of logs showed it blocked our own test browser and nothing else.
Read -
Your findings are a document now, not fourteen modals
The device page held 28,206 characters of analysis and showed you 2,814 of them. The rest was behind fourteen cards you opened one at a time. It is one document with a reading rail now, and the hardware tables that were empty for a year are full.
Read -
Two kinds of problem, and only one of them is yours
Findings are now split by who can act on them. When the platform is the reason a check is wrong, it says so, tells you your half, and files the rest against itself.
Read -
Analyse what you need, as often as you need it
Per-device analysis policy and a collection cadence control, both asked for by name on a customer call. The same fleet that cost $110 a machine each month on the daily default costs about $5 on monthly.
Read -
We spent a day attacking ourselves
An adversarial review of Wegweiser, from the source and from the outside. Everything it found was fixed and shipped the same day. Agent 0.3.87 carries the endpoint half.
Read -
Three months of the agent, in nine releases
Eighty-nine agent builds since May. These are the ones where something actually changed: remote control, a scanner, code signing end to end, and the release where the fleet first updated itself.
Read -
Ask a machine how it feels, and watch it answer
Charts in chat, ten-second live sampling with per-process attribution, and a real bandwidth test. Every one of them reads. None of them write.
Read