What's new

2026.10.26 Current

Fixed

• Security update: the image library (Pillow) is updated to 13.0.0, which fixes 37 published vulnerabilities in 12.3.0.

2026.10.15

Fixed

• A page that doesn't exist now shows a proper Nebby page with links home, to your dashboard and to sign in, instead of a line of code ({"detail":"Not Found"}).

2026.10.13.4

New

• Gauges and charts on every page, not just the Overview. Domains: average grade, score by week, grade mix and the biggest changes. Each domain: a gauge per area (email, impersonation, website, domain), scored the same way as the overall grade, with the score history beside it. Microsoft 365: average, grade mix and a trend per tenant; each tenant shows MFA, Microsoft Secure Score and Entra Identity Secure Score as gauges, plus sign-in outcomes, sign-ins by country, license use, Secure Score by area and how devices are joined. Certificates: health, what expires in each of the next 12 months, and how they renew. Certificate agents: servers checking in and where each automated certificate stands. DMARC: pass rate, messages and failures per day, and pass rate by sender. AI readiness: a gauge for each assessment. Bulk scans: use in the last 30 days and how prospects scored.

Improved

• The Overview headline is now "At a glance" (it covers your own business too, not just clients), and the score trend shows whole numbers.
• Approving the new read-only Microsoft 365 access no longer loops. Nebby checks again right away and twice more over the next few minutes while Microsoft applies it. If Microsoft still won't grant something after that, the page says it's being handled on our side instead of asking you to approve again, and the Overview stops asking.

Fixed

• Bulk scan limits said "this month"; they're a rolling 30 days.

2026.10.13.3

New

• Overview: a new home page that pulls everything together. Gauges for domains, Microsoft 365, certificates and AI readiness (each opens its page), one ranked "Needs attention" list across all of them, the domain score trend over 8 weeks with the grade mix, the lowest scores and recent changes.
• The Overview also flags certificate agents: a failed or rolled-back renewal, an agent that stopped checking in, or a DNS record still to add. The Certificates gauge shows how many are automated.
• Charts you can hover: score trends, daily and weekly counts and grade mixes show the exact numbers on hover or keyboard focus. Domains show a small score trend next to each one.

Improved

• A simpler menu: Overview, then Monitoring (Domains, Microsoft 365, Certificates, DMARC reports), Assessments (AI readiness, Bulk scans, Security policies) and Settings (Alerts, Team, Report branding, API, Account and billing). Certificate agents sits under Monitoring next to Certificates. Page titles match the menu, and page intros are one or two short sentences.
• Domains has its own page (the domain list and Add a domain moved there from the home page).

2026.10.13.2

New

• Certificate agents (Nebby Pro): install the Yinzer IT agent on a Windows or Linux server and it renews that server's certificates with Let's Encrypt and installs them where they're used: the Windows certificate store, IIS bindings, RD Gateway, a Remote Desktop Services deployment, nginx, Apache, HAProxy, Proxmox, or plain files.
• After every install the agent checks the server is really serving the new certificate, and puts the previous one back if it isn't. Nebby then checks from the internet too and says so if something in front of the server still shows the old one.
• Private keys are made on the server and never leave it. Nebby never holds your DNS logins: each name is delegated once with a CNAME record, shown on the certificate's page with a Check button.
• Each automated certificate has a history (renewed, installed, failed, put back) for your client records. Failures and servers that stop checking in send an alert by email and to your channels and tickets.
• Automate any name from the Certificates page.

2026.10.13

New

• Certificates: every certificate on the domains you monitor, in one list. Nebby reads the public certificate logs for each domain and its subdomains, then checks what each name actually serves, so forgotten portals, gateways and vendor-hosted pages show up without installing anything.
• Each certificate is sorted by how it gets renewed (automatically, by a vendor such as Cloudflare or Microsoft, or by hand) and flagged when it needs a renewal soon, looks stuck, has expired or isn't trusted.
• Add names the logs can't show, like a firewall's SSL VPN portal on port 10443 or an RD Gateway behind a wildcard certificate.
• "What expires next": certificates and domain registrations on one list, with the registrar and whether the transfer lock is on.
• Warnings by email and your alert channels: hand-renewed certificates at 30, 14, 7, 3 and 1 days, automatic ones when renewal looks stuck, broken certificates right away, and new certificate names under your domains. Starter and Tenant Checkup plans now get domain registration reminders too.
• Download the certificate inventory as a spreadsheet (CSV).

2026.10.9.3

Fixed

• AI Readiness only states what the data supports: - Ideas that come only from the industry are labeled "Idea to confirm", with no people, hours or dollars counted, until staff or the owner describe the problem. Headline savings add up confirmed items only. - "Biggest drains on time" only appears when staff survey answers show it. - Readiness areas that couldn't be checked show "not checked yet" and are left out of the score instead of being guessed; the score is marked provisional. - Third-party AI apps are matched on whole words and Microsoft's own apps are excluded (Dynamics "Customer" apps were being flagged). - Microsoft 365 Business Standard is no longer mistaken for Business Premium. - The report says exactly why Microsoft 365 activity is missing (for example, the usage reports permission isn't approved yet). - Claude is told the same rules when it writes the tailored version.

2026.10.9.2

Improved

• AI Readiness: Analyze works as soon as the business details are saved; the staff survey is optional (the report says when it's based on the owner's description alone). A checklist above the button shows what's done and what's still needed, and the survey has Copy link and Open buttons so you can try it yourself.

2026.10.9

New

• AI Readiness: find where a business loses time and what AI can take off people's plates. Each assessment combines a short business intake, an anonymous five-minute staff survey (a shareable link, no sign-in) and, when a tenant is connected, Microsoft 365 work patterns by department (email, meetings, chat and files), Copilot licenses, AI apps that already have access to company data, and the oversharing and identity findings from Tenant Checkup.
• It produces pain points with the evidence behind each, ranked AI opportunities from a library of 37 proven uses (hours saved, people helped, yearly value, effort, risk, regulated-data limits), a readiness score across data protection, identity, tools, people and governance, a 90-day plan and a training plan.
• Two PDFs: a plain-English owner's report and a technical deep dive for IT with setup steps, controls, measures and ready-to-use prompts for each opportunity, plus a governance checklist.
• With an Anthropic API key (Admin > Settings > AI), Claude writes a tailored version. Only scrubbed survey text and department-level numbers are sent.

2026.10.7.7

Improved

• The tenant page refreshes by itself while a checkup is running, and says "Access approved" after a re-approval instead of "Connected".
• MFA coverage shows on tenants without Entra ID P1, from each person's sign-in methods, and the access policy tile says when security defaults are on instead.

Fixed

• The "Turn on the full dashboard" box kept product names' capitals (Secure Score, Intune, Entra), and "1 licensed user" reads right.

2026.10.7.6

New

• Tenant Checkup shows the Entra Identity Secure Score, the same number as Entra admin center, with each recommendation still open, its priority, points and the license it needs.
• Microsoft Secure Score broken down by area (Identity, Device, Apps, Data), like the Defender portal.
• How each device is joined: Entra joined, hybrid joined (on-premises AD and Entra) or registered personal devices.
• Whether accounts sync from on-premises Active Directory, when sync last ran (with a warning if it stopped), and a new check that admin accounts are cloud-only instead of synced from AD.

Fixed

• Sign-in activity and risky-user tables on the tenant page now match the other tables.

2026.10.7.5

New

• The Microsoft 365 PDF report now includes the full dashboard: headline numbers, every license with seats and cost, every conditional access policy and whether it's enforced, sign-in activity and risky accounts, Secure Score improvements, and usage, groups, devices and sharing.

Improved

• New report look in the Yinzer IT black and gold, with a black cover band; findings evidence is easier to read; long findings continue onto the next page instead of leaving big gaps.
• Policy Pack PDFs and Word files use the Yinzer IT gold when no branding is set.
• Approving Yinzer IT's own read-only apps (Tenant Checkup, ReddUp) no longer counts as a risky admin change.

Fixed

• The cover of a report could spill onto a second, nearly blank page. It now always fits on one page.
• A Microsoft 365 report could fail to build when Microsoft left out a user's name in the MFA report.
• Security hardening: separate sign-in email budgets for existing customers, per-network limits on sign-ins and scans, a separate scan budget for customers and the API, a limit on report PDFs per account, and phone numbers and web addresses removed from notes sent to a client's address. Team invitations no longer reveal whether an address uses Nebby.

2026.10.7.4

New

• Tenant Checkup now shows sign-in activity for the last 7 days: which countries people sign in from, successful sign-ins from unexpected countries, impossible travel, password guessing, sign-ins through old mail apps that skip MFA, and admins who signed in with just a password. Needs Microsoft Entra ID P1 (included in Business Premium).
• Accounts Microsoft flags as at risk, and what it saw (leaked passwords, anonymous IPs, impossible travel). Needs Microsoft Entra ID P2.

Improved

• "Turn on the full dashboard" now reads exactly which permissions the tenant approved, goes away by itself once they are, and names only what's still missing. Sections a tenant's plan doesn't include are explained as that instead.
• Approving the new access starts a fresh checkup right away.

2026.10.7.3

Fixed

• Recheck now on a Microsoft 365 tenant starts the checkup immediately instead of waiting for the background worker, and the page says when one is running.
• A Microsoft 365 checkup can't run long enough to be stopped partway: the optional dashboard reads stop after about two and a half minutes and the core checkup always finishes.

2026.10.7.2

Fixed

• Bulk scans has its own page, and the menu highlights it instead of Monitored domains.
• The Microsoft 365 dashboard shows each section even if Microsoft returns something unexpected for another one, and a checkup from before the dashboard existed says to choose Recheck now.

2026.10.7

New

• Tenant Checkup is now a full Microsoft 365 health dashboard, refreshed every week (or any time with Recheck now): - Headline numbers: people, guests, admins, MFA coverage, access policies and Microsoft Secure Score compared with similar organizations. - Every license with total, assigned and available seats, products assigned beyond what's paid for, and the monthly cost at list price. - Every conditional access policy with whether it's enforced, report-only or off, and what it does in plain English. - Secure Score's biggest improvement actions with points, effort and user impact. - Usage by app over 30 days, licensed people who don't use Microsoft 365, and mailboxes close to full. - Groups and Teams, with teams that have no owner and public teams. - Devices: unused devices, Intune compliance, encryption and compliance policies. - File sharing settings, including Anyone links and guest resharing. - Password expiry policy, federated domains, and open Microsoft service issues.
• Tenants connected before today show "Approve the new read-only access" for the new sections until an admin approves once.

2026.10.6.9

New

• Tenant Checkup digs deeper, with no new permissions to approve: - Conditional access: every policy listed in plain English (who it covers, which apps, what it requires, who's excluded), report-only policies that aren't protecting anything yet, whether admins always need MFA, and MFA policies with too many exclusions. - Admin accounts: who holds each powerful admin role, admins without MFA beyond Global Administrators, guest accounts with admin roles, disabled accounts still holding roles, and apps with admin roles. - Admin activity: the last 30 days of security-relevant admin changes (new admins, app approvals, policy changes, MFA turned off), with the high-impact ones flagged to confirm. - Licenses and subscriptions: what you pay for and what's assigned, more licenses assigned than paid for, lapsed or grace-period subscriptions, renewals and trials ending soon, people licensed twice, people signing in with no license, and the monthly cost of unused seats at list price. - Outside apps with access to company data: third-party apps that can read or change mail, files or the directory, with unverified publishers flagged.

2026.10.6.8

Improved

• Better on phones: a slim top bar with a menu button instead of the full menu at the top of every page, bigger tap targets, and lists that fit the screen (your domains show as cards).

2026.10.6.7

Improved

• Lookalike registration details (owner, registrar, dates, abuse contact) are part of Nebby Starter, Pro and Tenant Checkup: in the full report when you're signed in, and in the PDF. The free scan still lists the lookalike domains themselves.

2026.10.6.6

Improved

• Lookalike domains now show what the public registration record says about each one: when it was registered and with which registrar, the registrar's name and location, who it's registered to (name and organization, with city, state and country) whenever the public record shows it, or that a privacy service hides it, what it uses for email, whether it's parked for sale, and the registrar's abuse address for reporting it. Street addresses, postal codes, phone numbers and email addresses are never shown.

2026.10.6.5

Improved

• Stricter scoring: a protection that isn't set up at all (HSTS, clickjacking protection, MIME sniffing protection, HTTP to HTTPS redirect, DNSSEC, TLS reporting, MTA-STS) now earns no credit. A partial setup still earns half. A domain with several missing protections no longer scores close to one that has them. This rule change doesn't trigger "got worse" alerts.

2026.10.6.4

Improved

• New dashboard layout: a full-width workspace with a sidebar for your domains, Microsoft 365, documents and team, plus a summary row (domains monitored, average score, D and F grades, recent alerts). Domain pages put the report email and monthly scorecard side by side. Works on phones too.

2026.10.6.2

Improved

• MTA-STS in testing mode now counts as step 1 of 2 and earns half credit. Not set up at all earns none, and only enforce mode earns full credit. The report says which step you're on.
• A change to the scoring rules never triggers a "got worse" alert by itself.

2026.10.6

New

• Team invitations: people you add to a Pro team now get an invitation and choose Accept or Decline on their account page. Members can leave a team at any time.

Improved

• Connecting a Microsoft 365 tenant now includes a quick sign-in by an admin of that tenant, so only its own admins can connect it. A tenant can belong to one Nebby account.
• Client reports and scorecards can't be sent to shared mailbox providers like Gmail or Outlook.com, and links in your note to a client are removed.
• Scans have an overall time limit, and SPF records built to cause huge numbers of lookups are cut off past the limit of 10.
• The sign-in page shows which email address you're signing in as.
• Fix Kit "tell me when it's ready" requests join the launch list.
• Plan limits read correctly with Tenant Checkup ("one tenant", "one domain"), and having Tenant Checkup alongside Starter keeps your tenant.
• Policy Pack on Pro covers up to 25 client companies a year; deleting a pack no longer hands back its slot.
• Alert emails say "latest check" (some checks run daily, not weekly).

Fixed

• Bulk scans now say how many lines were skipped because they weren't domains.

2026.10.5.2

Fixed

• The "To me" and "To my client" choices when emailing a report were invisible. They now show.

2026.10.5

New

• Rescan now: rescan any monitored domain from its page, or all of them from the dashboard. Fresh results in about 2 minutes.
• DNSSEC is now validated, not just detected. A broken DNSSEC setup (common after moving DNS hosts) fails with step-by-step repair instructions, and Pro's daily watch alerts the day it breaks.
• Tenant Checkup plan for a single business: a monthly Microsoft 365 checkup plus your own domain watched weekly, $29 a month.
• Pro alerts can open tickets in ConnectWise PSA, Autotask and Zendesk.
• Pro processes DMARC aggregate reports: who sends as each domain, pass rates, and an alert when a new sender fails.
• Help and Status links on every page, and a public status page at status.yinzerit.com.

Improved

• A check that can't run during a scan (a timeout, a busy DNS server) keeps its last real result instead of moving the grade, and never triggers a "got worse" alert.
• Lookalike domains registered years before yours are flagged as a warning (most likely an unrelated business) rather than a fail. Newer ones still fail.
• Payment fraud exposure now follows whether DMARC actually blocks spoofed mail.
• Duplicate SPF or DMARC records explain why they happen and which one to delete.

2026.10.4

New

• Feedback link on every page, Terms, and getting-started emails on days 1, 3 and 7.
• FAQ page.

Fixed

• Microsoft 365 connect buttons now work in every browser.

2026.10.3

New

• Customer accounts with emailed sign-in links, and checkout through Lemon Squeezy.
• Nebby Starter and Pro: monitored domains, weekly rescans with alerts, bulk scans, white-label PDF reports.
• Pro: team members, monthly client scorecards, lookalike alerts, API, Teams, Slack and webhook alerts, daily DNS change and expiry watch.
• Tenant Checkup: a read-only monthly Microsoft 365 checkup for Pro.
• Policy Pack: about 20 questions turned into five security policies in Word and PDF.
• Full PDF reports with an action plan, attack scenarios and step-by-step fixes.

2026.10.2

New

• Fix Kit: the exact records and steps to fix your grade, written for your email provider and DNS host.