February release: Active Directory scanning and new integrations

Every organisation's attack surface keeps growing, and with it the need to keep assets, configurations and vulnerabilities in one central view. The February release is one of the largest blacklens.io updates so far. Sentry gains Active Directory scanning, two new cloud integrations extend coverage, and additional tool integrations complete the picture of your attack surface.

Sentry with Active Directory scanning

Active Directory sits at the heart of most corporate infrastructures. That makes it one of the most attractive targets for attackers. Misconfigurations, over-privileged accounts or outdated group policies often go unnoticed until it is too late.

From now on, the Sentry agent checks your Active Directory for vulnerabilities and misconfigurations. For the security analysis, Sentry connects over SMB on port 445 using a least-privilege user. A setup script helps with the configuration.

The results appear as findings among your internal vulnerabilities and go through the same workflow as every other finding. That way you can act before attackers exploit them.

New cloud integrations: Cloudflare and Hetzner Cloud

The attack surface does not end at the edge of your own data centre. That is why blacklens.io adds two much-requested platforms to its cloud integrations:

• Cloudflare: blacklens.io inventories the resources you manage through Cloudflare and audits their configuration. Discovered assets feed into the scope of the external attack surface analysis as suggestions.
• Hetzner Cloud: a popular infrastructure platform, especially in the DACH region. blacklens.io now inventories your Hetzner Cloud resources and includes them in the analysis of your attack surface.

Both integrations fit into the existing multi-cloud overview and allow a consolidated assessment of your external and cloud-based attack surface.

More tool integrations for end-to-end workflows

Security insights only deliver their value once they reach the place where decisions are made and measures are carried out. That is why four more integrations have been added:

• GitLab and GitHub: for new alerts, blacklens.io automatically creates an issue in GitLab or GitHub. Development teams handle security findings where they already work.
• ServiceNow: for new alerts, blacklens.io automatically creates an entry in ServiceNow, so your teams can respond within established IT service management workflows.
• Slack: notifications about critical findings land directly in your Slack channels. That shortens response times and makes sure no relevant finding is missed.

The big picture: your entire attack surface at a glance

blacklens.io now connects on-premises infrastructure (Active Directory), multi-cloud environments (Cloudflare, Hetzner Cloud) and the surrounding tool landscape (GitLab, GitHub, ServiceNow, Slack) into a single view of your attack surface.

For organisations, that means fewer blind spots, faster decisions and the certainty that security-relevant insights do not disappear into silos.

Correction of 20 October 2026: the GitLab and GitHub integration creates issues for new alerts; an earlier version described it as scanning code repositories for exposed secrets. The sections on Active Directory, Cloudflare and ServiceNow now describe only confirmed functions; an earlier version listed individual AD checks, WAF configurations and ServiceNow incidents or change requests.