Reference

Agent release notes

Only stable releases are listed: the versions that the installation line installs and that agents update to. New versions are tried on the canary channel first. Agents update themselves; see Agent updates. Times are UTC.

#Current stable

Compare with the program on a host:

sec-agent --version
sudo sha256sum /opt/sec-agent/slot-*/sec-agent

Get-FileHash "C:\Program Files\SEC\slot-*\sec-agent.exe" -Algorithm SHA256

The authoritative checksums are in the signed update metadata, which the agent checks itself before it installs an update.

#2026-11-07

#0.3.63 (Windows)

• The update status is sent again every 6 hours, also when it did not change, so the console never shows a stale state.
• An installation without supervisor is reported as an error ("Self-update not possible … rerun the installer").

#0.3.60 (Windows)

The Windows counterpart of Linux 0.3.60; see below.

#2026-11-06

#0.3.60 (Linux)

• New action custombuild.update for DirectAdmin CustomBuild components (opt-in only, never in a profile).
• Fix all for hardening: all fixes of a host in one job.
• External checks by the SEK Systems probe.
• Agent keys sealed with the TPM on Linux too, where available.
• Optional mutual TLS with a short-lived client certificate per agent.

#0.3.52 (Windows)

• Fix: renewal of an agent identity whose key is sealed with the TPM.

#0.3.51 (Linux)

• Automatic renewal of the agent identity with new keys.
• For software outside the package manager: whether it is really in use (loaded or listening).

#0.3.43 (Linux), 0.3.45 (Windows)

• Detection of software outside the package manager follows the local policy ([collect] exec_version_probes).
• Windows: server roles and optional features in the inventory.

#0.3.42

• The account and privileges a service runs as are measured on the host.

#0.3.39

• Full Windows inventory: Store apps, features, per-user programs, MSI data.
• sec-agent role allow probe --cidr … to allow the probe role for specific segments.
• Local policy changes are reported, with their cause.
• Update checks try several mirrors and report why one fails (sec-agent update-check).

#0.3.36

• The update status is reported to the console.
• A corrected list of endpoints is taken over without enrolling again.

#0.3.35 (Linux), 0.3.33 (Windows)

• The network view of the host (neighbours, connected subnets) for discovering devices without an agent.

#0.3.32 (Linux)

• The public (WAN) address is asked from SEK Systems' own addresses ip4.sek.systems / ip6.sek.systems.

#0.3.31 (Linux)

• Discovery of the public (WAN) address of the host.

#2026-11-05

#0.3.30 (Linux)

• New action package.repair (for example after an interrupted dpkg).
• Health follow-up after an LVM rollback.
• Signed cancel of a job before it starts.
• The checksum of the running agent program is reported.
• Kill switch: waiting jobs are cancelled at safe points; no agent update while a job runs.