Introduction
2026 has already been an exciting year for VMRay, with three major releases delivered so far. We hope you have enjoyed the new capabilities introduced in recent months, including customizable IR Mailbox notifications, webhooks for IR Mailbox submissions, KnowBe4 alert filtering using custom tags, support for additional special characters in tags, and many other enhancements.
Alongside these product improvements, we continue to strengthen the Platform’s detection capabilities through regular signature and detection updates. You can explore some of the latest additions in our Detection Highlights blog series.
Now, without further ado, let’s take a closer look at what’s new in VMRay Platform 2026.4.0.
New Analysis Type: Investigative Analysis for Emails
A suspicious email is often only the starting point. To understand the full phishing path, analysts may need to inspect the message and its attachments, follow a relevant link, and examine the files or other artifacts encountered along the way. Managing each step through separate submissions can fragment and slow down the investigation.
VMRay’s new Investigative Analysis brings these steps together in a connected, analyst-driven workflow. The analysis starts with the analyst manually opening the suspicious email in a preconfigured email application during a Live Interaction session. This allows to experience and examine the message as its intended recipient would, while staying within the controlled VMRay analysis environment.
Analysts determine how the investigation proceeds. They can inspect the message and its attachments, identify suspicious elements, and click a relevant embedded link to start a Web Analysis of the selected URL. Related files and artifacts can be examined with the appropriate analysis engines, helping to trace the attack beyond its initial delivery stage without disrupting the investigative workflow.
This approach complements VMRay’s automated detection capabilities with the flexibility needed for complex cases and in-depth manual investigation. Note that email analysis through Live Interaction is available only in Windows 11 analysis environments and is included in product plans beyond the legacy Analyzer offering. Customers using Analyzer plans can upgrade to gain access to this capability.
Introducing Custom S3-Compatible Object Storage
Organizations running VMRay Platform On Premises often need to retain large volumes of analysis data while complying with internal infrastructure standards and storage policies. With VMRay Platform 2026.4, we’re addressing this demand by introducing support for custom S3-compatible object storage providers.
You can now connect the Platform to a wide range of S3-compatible storage solutions, including technologies such as Ceph, using a configurable endpoint URL. This gives Administrators greater freedom to choose the storage platform that best fits their environment. The feature also simplifies configuration by moving all object storage settings into VMRay Platform’s Global Configuration.
As an additional optimization, when external object storage is enabled, samples, prescripts, and analysis archives are automatically excluded from Platform backups, reducing backup size and avoiding duplication since these artifacts are already stored in the configured object storage backend.
New REST API Access to the User Audit Log
When security or compliance teams need to understand who accessed a system and when, they should be able to retrieve the right records easily.
The new User Audit Log gives our Cloud and On Premises customers greater visibility into authentication and user management activity. It records events such as successful and failed login attempts, user invitations, account creation and deletion, and role changes.
Authorized users can use the REST API to request records for a selected date range and download them as a compressed archive. With audit logs retained for at least 180 days, organizations can more easily investigate access-related events and provide evidence supporting their security and compliance processes.
This initial release introduces phase I of the User Audit Log and focuses on authentication and user management events. In a future phase, we plan to expand its coverage to include a broader range of Platform activities, such as changes to account, analysis, and profile settings, as well as sample submissions and access to samples and analysis reports. Stay tuned for further updates.
Faster SAML SSO Onboarding with Automatic User Provisioning
SOC teams already manage users and access centrally through their identity providers. Until now, however, teams had to create every SAML SSO user manually in the VMRay Platform and assign a role before their first login.
Automatic User Provisioning improves this process with Just-in-Time provisioning. When a new user successfully authenticates through SAML SSO for the first time, the VMRay Platform automatically creates their account. Permissions can then be assigned according to the configured SAML role mappings, helping organizations keep VMRay Platform access aligned with the access policies managed through their identity provider.
Final Thoughts
VMRay Platform 2026.4.0 is our final release of 2026, but we are already looking ahead. Our first release of 2027 is scheduled for January and will bring further enhancements across the Platform.
We will continue working on new phishing analysis capabilities, including the ability to report detection feedback directly from the VMRay Console and automatically fill in phishing forms during analysis. We’ll be back with more updates and developments next year. Until then, stay secure!
