Kaseya Release Notes

The new INKY dashboard introduces a unified Triage page and a new SaaS Alerts (and Kaseya SIEM) integration page. It also includes new capabilities such as fully configurable ATO detection without requiring a SIEM integration, outbound protection with Approve & Encrypt actions and image-based DLP scanning.

Triage page

A new Triage page brings detection review and message action together in one place.

• Each message opens a slide-out panel showing the full content, threat signals and approve/reject controls.
• The delivery timeline view makes it clear what happened to a message, when and why.
• Designed for daily review of suspicious mail without bouncing between pages.

Account takeover (ATO) detection

ATO detection and enforcement is now fully configurable from the dashboard with no SIEM integration required.

• Configure approvers, review detections with approve/reject per message and see exactly which rule and condition matched.
• Dangerous-link detection and rule trigger text are surfaced inline, so reviewers can act with full context.
• Enforcement history and delivery status are tracked alongside each detection.

Approve & Encrypt

Outbound workflows now support Approve & Encrypt actions.

• Quarantined outbound messages can be approved for delivery with message body encryption applied automatically.
• A new toggle on the outbound settings page controls availability.
• The workflow portal shows proper status for Approve-Encrypt actions end to end.

Integrations page with SaaS Alerts

A new Integrations page replaces the old Enterprise settings page and ships with a SaaS Alerts (and Kaseya SIEM) integration.

• Guided setup wizard with real-time connection verification via webhooks.
• Settings inheritance from parent organizations so partners can configure once and roll down.
• Gated behind Kaseya entitlements.

OCR in Outbound DLP scans

Outbound DLP scans can now read text inside images, catching sensitive data embedded in screenshots and attachments that may have previously slipped through.

Click here to discover more about new INKY dashboard capabilities plus additional enhancements and bug fixes.

Devices now retain their most recent patch status and patch data when a patch scan fails, eliminating scenarios where patch information is cleared and displayed as No Data. This ensures administrators maintain visibility into installed and missing patches, even when scan issues occur.

To further improve reporting accuracy, a new Last Successful Patch Audit Date field is now available on the Device Details page and as a sortable column in device lists. This makes it easier to identify stale patch data, assess reporting freshness and quickly pinpoint devices experiencing ongoing scan failures.

Click here to learn more about Datto RMM patch status reporting improvement and recent updates.

The Network Discovery page has been renamed to Network to better reflect its expanded role in managing network infrastructure. A new Network Nodes tab provides a centralized view for orchestrating network nodes, assigning discovery responsibilities and managing subnet configurations across sites.

The redesign introduces support for multiple network nodes per site, streamlined node management and a dedicated area for managing custom subnets. Administrators can nominate devices as network nodes, view node status and assignments at a glance, reassign managed devices and create or modify custom subnets with built-in validation — making network discovery and management more scalable and efficient.

Click her to learn more about network management in Datto RMM.

Administrators now receive proactive reminders to review variable license usage before month-end billing, helping avoid unexpected charges. Notifications include quick access to relevant licenses and settings, displayed only when variable usage exists.

This release also adds the ability to activate or deactivate Advanced Software Management and Ransomware Detection directly from the Licenses page, along with new policy-level visibility to help identify which policies are driving license consumption.

Click here to learn more about licences in Datto RMM.

Datto EDR now includes a Status Monitoring table directly on the Device Details page, so you can see when a device went online or offline without switching views.

The table logs every online/offline status change and retains up to 180 days of history. This makes it easier to identify patterns like daily dropouts, weekend outages or intermittent WAN issues.

With clearer status history in one place, your team can troubleshoot faster, confirm whether a “down” report is recurring and document trends before you escalate to clients or ISPs.

This update gives partners a more intuitive and secure foundation for managing Datto BCDR environments. A new dedicated Security and Compliance page in Remote Web centralizes key controls, including Local Access Control, Local Users, Datto Relay Forced Login, SMB Settings and the new FIPS Mode toggle. This makes security configuration faster and easier to manage at scale.

Partners can now enable FIPS 140-3 cryptography directly from the UI with built-in access to best-practice guidance, helping strengthen compliance posture, reduce manual effort and simplify deployment of hardened security settings across supported devices.

Learn more about security and compliance management for Datto BCDR.

BullPhish ID added 372 new content assets between January and April 2026 to help you keep simulations and training fresh without extra admin work.

This release includes 199 new phishing kits and 52 new or updated training courses (202 total when you include translations). Content is available in multiple languages, including English, Latin American Spanish, Canadian French, Dutch, Portuguese and German.

New topics cover everyday risk areas MSPs see in the wild, like phishing and impersonation, ransomware, modern workplace threats, AI basics for security awareness, GDPR updates, data protection and insider risk — so your campaigns stay aligned with what users are actually facing.

Device Insights introduces a conversational AI interface that brings together complete device context, enabling technicians to move from alert to root cause to remediation in seconds. This streamlined experience empowers faster decision-making and reduces the need to navigate across multiple tools or views.

With pre-built prompts for use cases like security alert triage, patch readiness, and endpoint protection, even L1 technicians can efficiently resolve common issues without escalation. By consolidating all relevant device data into one interface, Device Insights simplifies troubleshooting and improves overall service efficiency.

Learn more about the AI Device Insights and other Datto RMM updates here.

Activity Log Insights introduces conversational AI directly within Datto RMM, enabling technicians to quickly identify root causes, uncover trends across sites and receive automation recommendations from the ComStore. This reduces the need for manual log analysis and helps teams move faster from issue detection to resolution.

With this capability, technicians can significantly cut down time spent reviewing logs (from hours to minutes) while improving operational efficiency and policy compliance. By shifting from reactive troubleshooting to proactive insights, teams can identify and resolve issues earlier, improving overall service delivery.

Learn more about the AI Activity Log Insights and other Datto RMM updates here.