New Features - Device Security - October 2026

You can integrate Device Security with Belden macmon Network Access Control (NAC) to share device profile and risk information, closing visibility gaps for unmanaged, OT, and specialized devices that traffic monitoring alone cannot classify. This integration imports endpoint and network device details from macmon, such as device category, vendor, and network information, so that Device Security can apply access policies to identified devices, rather than leaving them unclassified and possibly unprotected.

When Device Security ingests endpoint and network device details from macmon, it can use that information to better identify and classify a compromised or non-compliant device. This lets Device Security raise alerts and trigger containment actions, such as applying security policies to the device's traffic. Through the integration with Belden macmon, you don't need to cross-reference devices in a separate NAC console or coordinate the containment action manually.

Combining Device Security 's device profiling with macmon's enforcement capabilities keeps inventory more accurate and keeps your network access policies and containment actions aligned.

You can now identify which firewall a device belongs to when several firewalls report traffic for it, because Device Security assigns a local firewall to each device based on traffic volume. The firewall that sees the most traffic from a device becomes that device's local firewall.

On the device inventory, the Firewall column lists the local firewall first, followed by a count of the other firewalls that report the device. Open the list of firewalls to see all of them, with a Local chip next to the local firewall. The Device Security Device Details Page shows the same local firewall in its header and attributes.

Use the local firewall to focus investigations and policy decisions when investigating alerts or applying security policies to a device.

You can now use tags and custom attributes in an Insights Center query to scope the dashboard to the devices your team owns, instead of viewing your entire inventory. With support for custom tags and custom attributes in the Insights Center query, you can build a query that matchings how your organization groups its devices.

You can also add Vulnerability as a second domain to an Insights Center query. This lets you limit the Insights Center inventory view to devices that match both your device criteria and your vulnerability criteria, such as CVE ID or severity.

The charts, metrics, and tables in the Insights Center refresh to show only the devices in your query. Each team sees the risk posture of its own devices instead of the whole fleet.

You can now upload firmware files to Device Security to identify the software components inside your devices and find the vulnerabilities that affect them, without waiting for network traffic or an integration to reveal that data. When you upload a firmware file, you can specify the vendor and model of devices that match the firmware file. Device Security analyzes the firmware file for vulnerabilities, and flags these risks on the devices that match the firmware file. Device Security does not overwrite a firmware version it already detected on a device.

The Firmware Analysis page lists each file you upload with its analysis status. For each file, you can review the software bill of materials (SBOM) components, the vulnerabilities found in those components, and the devices that match the firmware. Results from firmware you upload are visible only in your tenant.

Use these results to prioritize patching and virtual patching for the devices that carry the most risk. Results from firmware you upload are visible only in your tenant.

( October 2026 ) Device Security includes information about FDA recall classes (Class I, Class II, or Class III), and you can view the full recall details and affected device instances on a dedicated Recall Detail page. Device Security also extends recall tracking to Australia's Therapeutic Goods Administration (TGA), in addition to the existing FDA, BfArM, and EU MDR sources, and normalizes recall status across all sources so you can see at a glance whether a recall is open, suspended, or closed.

( January 2026 ) Device Security now includes information from the European Union’s Medical Device Regulation (EU MDR) for medical device recalls. In the Recalls table, view the Source column to see if the recall comes from EU MDR.

( December 2025 ) When the Medical Device Security vertical is enabled, you can filter the Recalls table by the Source attribute.

( October 2025 ) Device Security now includes information from Germany's Federal Institute for Drugs and Medical Devices (Bundesinstitut für Arzneimittel und Medizinprodukte, BfArM) for medical device recalls. In the Recalls table, view the Source column to see if the recall comes from BfArM.

Manually tracking medical device recalls across multiple regulatory bodies is often a complex, error-prone process that can compromise patient safety and regulatory compliance. Device Security includes a Medical Device Recalls page that helps you identify and respond to recalls for medical devices in your network.

The Medical Device Recalls page provides a centralized view of all recalls for medical devices in your network, including the recall identifier, the recall status, the recall source, and the recalled devices and profiles in your network. You can view the recall source file by clicking on the Recall ID.

This centralized view of recalls helps you maintain regulatory compliance, reduce the operational overhead of manual tracking, and proactively mitigate risks associated with compromised medical equipment.

You can now configure Device Security Action Center action sets to trigger on alert attribute changes, vulnerability attribute changes, or traffic patterns you define, so you can automate responses across an alert or vulnerability's full lifecycle and react to live traffic conditions, not just to newly created alerts, devices, or vulnerabilities.

An alert attribute change action happens when a watched attribute on an existing alert changes, such as a severity escalation or a status update. A vulnerability attribute change action works the same way for vulnerability tickets. Use these actions to automatically suppress an alert when it's resolved elsewhere, or notify your team when a vulnerability moves to remediation, without manually monitoring the alert or vulnerability for changes.

A traffic pattern action lets you author rules based on live network traffic, such as a printer communicating over an unexpected application, directly from Action Center, and apply the same automated actions you use for other triggers, such as raising an alert or restricting network access. Traffic-based action sets appear alongside your other action sets in the Action Center, giving you one place to review every automated action regardless of trigger type.

Device Security introduces Next-Gen Integration, an integration platform managed entirely in Device Security . You can integrate third-party systems and manage every integration from Device Security, without switching between tools to set up and troubleshoot them. Next-Gen Integration brings setup, scheduling, and monitoring together in Device Security . If you have existing integrations, you can migrate them manually or wait for the migration tool to be available.

Create integration profiles and instances, and connect them to on-premises engines that run them. Use profiles to control what each integration collects or sends, and set the schedule and scope for each integration use case. You can run a use case on demand or switch it to manual runs.

The Integration Activity tab shows every run with its status, data volume, and event log. Widgets for your instances and engines show health, load, and failed runs, and system events show which profile, user, and engine were involved. Your team can spot integration problems earlier and resolve them with less guesswork, making integrations easier to manage and troubleshoot.

( October 2026 enhancement ) For security policies created in PAN-OS 11.1 and later, you can review the Panorama-managed security policies from the Vulnerability Details page and from the Policies page in Device Security . When Device Security detects a security policy created in Panorama through the Policy Recommendation workflow for a device profile, you can confirm its Threat Prevention coverage and resolve CVE instances to adjust the device risk scores, using the same resolution workflow as Strata Cloud Manager-managed policies.

You can now create Virtual Patching policies directly from the Vulnerability Details page in Device Security, so your vulnerability management teams can act on a specific CVE without switching to the Profile Behavior page or Insights Center to start a policy workflow. This option is available only for CVEs that are covered by Threat Prevention signatures.