October 2026 Release Notes

← Back to the latest release

October 16, 2026: Financial disclosures, DNS Explorer, and Situation Room provenance

Cyber DNS Explorer

Look up a domain from Cyber → DNS Explorer to see its subdomains, mail servers, and name servers. The page also shows the addresses that each host resolves to and the networks that announce them. Y2 collects each answer from DNSDumpster and keeps it with the time that it arrived.

• A footprint map. The map shows the domain, one hub for each record type, each host, and each address. Addresses appear in groups under their network (ASN) with their netblock. Move the pointer over a host to see where it resolves. Tables list each record with reverse DNS and the HTTP and TLS banners seen on the address.
• Dated history. Each snapshot keeps its capture time. Open an earlier snapshot to compare it. A badge shows whether the records changed since the previous snapshot.
• One answer for 14 days. A domain that anyone looked up in the last 14 days opens from the saved snapshot. It does not use a lookup. Pro includes 5 new lookups a month. Elite includes 1,000.
• Mapped into the graph. The domain, hosts, addresses, and netblocks join the ontology. Network operators attach to companies that Y2 already tracks, such as Cloudflare. A company whose official website is the domain is linked as its operator. Each connection records when it was first and last seen. Open the domain in Explorer and add it to a Project.
• API, MCP, and Agent Y2. POST /api/v2/cyber/dns/lookups and GET /api/v2/cyber/dns/snapshots use the intel:cyber scope. The local MCP server calls them through y2_call_api. Agent Y2 can look up a domain or read its history in chat.

DNS Explorer requires a Pro or Elite workspace. Free-tier records include up to 50 A records for each domain. A larger domain is marked as truncated.

Look up a domain's DNS footprint → · DNS footprints in the graph → · API reference →

SEC filings, insider trades, and federal awards

Financial Intelligence now covers what public companies and the U.S. government disclose about themselves. Y2 reads SEC EDGAR twice a day and USAspending.gov once a day. Every company, insider, agency, and award recipient joins the same entity graph as the rest of your intelligence.

• Four new pages. Filings lists Form 8-K material events by their most material item. Insiders lists Forms 3, 4, and 5 from officers, directors, and 10% owners. Stakes lists Schedule 13D activist stakes. Awards lists federal contract actions of $5M or more and grant actions of $10M or more.
• Screening. Filter by category, severity, time window, and minimum amount, sort by size, and search by company, ticker, insider, agency, or recipient. Filters stay in the page URL, so you can share a screen.
• Primary records. Each row opens the full record: 8-K items, every insider transaction line, 13D reporting persons, or award details. Each row also links to the SEC filing or USAspending award page.
• One entity per company and person. Y2 matches issuers and insiders by SEC CIK and award recipients by Unique Entity ID. A new name is checked against existing entities before Y2 creates one. A contractor that also files with the SEC is one entity.
• A graph that builds over time. Officers and directors connect to their company. Contract and grant recipients connect to the awarding office. Each connection records when it was first and last evidenced. Explorer and entity profiles show each filing and award as an event tied to every party it names.
• Companies. Each company in Markets lists the disclosures that name it. The SEC filing import fills in the CIK that EDGAR recorded.
• API, MCP, and Agent Y2. GET /api/v2/disclosures returns the same records with ontology entity IDs. Integrate on each page shows the request for the rows you loaded, as curl, TypeScript, Python, or an MCP call. Agent Y2 can screen disclosures in chat.

Disclosures require a Pro or Elite workspace. API keys and MCP connections need the new intel:disclosures scope. Existing keys do not gain it automatically.

Screen disclosures with the Intel API → · API reference →

One record for each published article

• When Y2 collects the same article through more than one feed, it keeps one observation. That observation records each feed that collected the article.
• Map lists, incident counts, and API results count the article once.
• Existing duplicate copies are combined into the earliest record. Links to a combined copy still resolve to that record.

Corroboration counts publishers

• primarySourceCount on an incident now counts distinct publishers. Two outlets are two sources, even when Y2 collects both through the same feed service. One article from two Y2 feeds is one source.
• corroborationScore adds one quality weight for each publisher. Existing incidents are recalculated after the update, so these values can change.

Clearer Situation Room map

• Each place shows one badge with its total count and the mix of event layers.
• A report that names only a country appears at the country's center and is marked as country-level. It no longer appears at a point in the capital.
• When you view a region, a chip lists the country-level reports for the country in view.
• Report cards show the original source, how Y2 collected the report, and actions to ask Y2, open Explorer, or add the report to a Project.

More resilient report completion

• If one writing path cannot accept the report format, Y2 tries supported alternatives. The report can finish from the same collected evidence.
• This applies to reports generated after the update. Reports that already ended in failure remain unchanged and may still need to be retried.

More reliable report and signup delivery

• A report no longer repeats its full generation cycle when a saved delivery channel has no reachable contact details. Other recipients can continue receiving the report.
• Signup reminder emails can be prepared and queued without interrupting the scheduled reminder.
• An unreachable recipient still needs updated delivery details before they can receive a report. Earlier failed reports and reminders are not sent again automatically.

More dependable connected intelligence and Project Evidence

• Placeholder identifiers no longer interrupt connected-intelligence updates for unrelated products or assets.
• Project Evidence can show lineage details for linked reports and other supported records.
• Existing identity conflicts still require review and are not combined automatically.

October 15, 2026: One entity for each real-world thing

Name variants such as U.S. Department of Defense and US Department of Defense, or AU and Australia, now resolve to a single entity. Graphs, profiles, and connected intelligence no longer split the same organization, agency, or country across duplicate nodes.

Fewer duplicate entities

• Explorer graphs and entity profiles show one node after duplicates are combined. This includes duplicate country nodes that appeared in some graphs.
• New mentions from reports and enrichment attach to an existing entity when Y2 is confident they describe the same thing. People, organizations, threat actors, and other higher-risk kinds also need an independent second check before they attach.
• Uncertain matches stay separate and are held for review instead of being combined. Entities with conflicting identifiers, such as different registry or ISO codes, are never combined.
• CVEs and indicators continue to match only on their exact identifier.

Reviewed, reversible cleanup of existing duplicates

• Existing duplicates are combined in reviewed batches. The earlier entity stays as a redirect to the surviving one, so saved links and references keep working.
• Relations, incidents, and observations move to the surviving entity, and every combination can be reversed.

Read how Y2 resolves entity identity →