Globe view and clearer operation mapping
The threat map now has a globe view alongside the flat map, with true great-circle routes and a gentle idle rotation for wall displays. The operations view was rebuilt to stay readable at real scale: one point per country, one link per pair of countries weighted by how many operations share it, and the strongest evidence ranked first, with low-evidence groupings from shared hosting hidden by default. New views show which threats were weaponized fastest and, for teams that manage takedowns, where takedowns succeed. Also improved map contrast, keyboard and screen-reader support, and map data attribution.
A rebuilt global threat map console
The global threat map is now a full console organized around lenses: Threats, Operations, Movement, Hosting, Baseline, Campaigns, and Actors. Baseline compares where attacks concentrate against the typical internet attack baseline, alongside raw volume and bot share. Open any node or link for a detail drawer, search across the map, replay activity on a timeline, and watch live pings with smoother animation, including breathing nodes, impact rings, flowing links, and infrastructure migration trails. The camera frames your selection automatically, and phones get a compact peek sheet. Views are now shareable by link, legends explain what you are seeing, and the map is more accessible, with a light theme, tap and keyboard support, and animation that respects reduced-motion settings. New data includes links between operations across countries, detected infrastructure migrations, hosting provider trends with known bulletproof hosts, weaponization speed, and takedown outcome summaries. Also fixed threat counts drifting upward over time, corrected severity ranking, placed attack arcs on real brand headquarters, fixed coverage percentages, and improved input validation and data freshness.
Global bot-traffic intelligence
New platform intelligence on automated internet traffic, drawn from an industry-wide internet traffic dataset and refreshed daily. See the worldwide share of bot versus human traffic over 7, 30, or 90 days, the countries and networks where bot infrastructure is hosted, and the mix of well-known automated services. A new view also shows where application-layer attacks originate and which countries they target, along with a per-country bot density map where color shows bot share, size shows share of traffic, and a ring marks countries above the global average. Also fixed the map zoom control overlapping other controls, and improved layouts on phones for the bot density table and the Trends summary metrics.
Identity provider impersonation visibility
A new Identity Threats view measures phishing that abuses or imitates sign-in providers such as Okta, Microsoft Entra, OneLogin, and Auth0 across every monitored brand. See key figures, a breakdown by attack method and by provider, the most targeted brands, a MITRE ATT&CK mapping, and the latest detections. Detection of sign-in lures is also broader, with wider coverage of lookalike domains, newly registered domains, and certificates using terms like sso, helpdesk, and vpn. Attacks are credited to the brand being targeted, and identity provider impersonation is no longer automatically dismissed when a domain has a clean reputation.
A redesigned account experience
One Settings area for Profile, Security, Notifications, and Devices & App, with a side rail on desktop and a simple list on phones. A new avatar menu adds a built-in theme switch and Switch account. The notification bell and inbox are rebuilt, with day grouping, filters, and actions that are always visible on phones. Security now lets you see each signed-in session, sign out a single device, sign out other devices, or sign out everywhere, and sign-outs take effect immediately. Notification settings are organized into Channels, Events, Summary, and Quiet hours, and changes save instantly and undo themselves if saving fails. Fixed quiet hours using the wrong time zone, quiet hours not always turning off, and one notification toggle sometimes resetting others. Critical alerts still break through quiet hours. Also fixed notification preferences failing to load. Customers now get the same account area, with larger touch targets, more readable text, and keyboard-friendly menus in both light and dark themes.
More light-theme polish
Fixed remaining dark panels and improved contrast in light theme, and made selected menu items and filters stand out more. No changes to dark theme.
Light theme readability improvements
Improved text and badge contrast in light theme across the platform for easier reading. No changes to dark theme.
Executive impersonation monitoring
Register your executives and get alerted when someone impersonates them on social platforms.
Sharper threat-actor attribution
Improved threat-actor attribution — more detected infrastructure is now automatically linked to known, named actors instead of showing as unattributed.
Averrow v4 — redesigned console
A refreshed, more responsive interface: a unified security console, clearer navigation, and a mobile-ready layout.
Sign-in & login refresh
Faster, more reliable passkey sign-in and a refreshed, on-brand login experience.
Social Brand Monitoring
Monitor 6 social platforms (X, LinkedIn, Instagram, TikTok, GitHub and YouTube) for brand impersonation with confidence scoring.
Brand Exposure Report
Free public scan tool generates comprehensive brand threat assessment.
DKIM Selector Expansion
Expanded DKIM selector coverage across major enterprise email security providers.
Threat Summaries
Scoring and triage now produces multi-signal threat summaries connecting email, domain, and social findings.
Lookalike Domain Detection
Continuous lookalike-domain detection for monitored brands.
Scanner False Positive Reduction
Improved safe domain allowlisting and confidence thresholds.
Platform Launch
Averrow v2 with automated threat detection and an email security engine.
Domain Migration
Completed migration from legacy domain to averrow.com with updated CSP and CORS.