What’s new
Recent improvements to SavvyShield
We ship updates to the browser extension and portals every few weeks. Portal changes go live for every customer right away, and extension updates roll out automatically through the Chrome Web Store and Firefox Add-ons. Questions about a release? Contact our team.
Block mode, AI agent protection, and sharper detection
Our biggest update yet: more scams caught with fewer false alarms, new controls for administrators, and more realistic simulations.
- Every check now looks at a link’s real registered domain, recognizes look-alikes of well-known brands, and unwraps links rewritten by email security tools such as Microsoft Safe Links.
- The AI Certainty Threshold now takes effect, so administrators can tune how readily borderline pages are flagged.
- Protection against fake “verify you’re human” pages that ask people to paste a command into the Run box or a terminal, and warnings on pages that turn out to be dangerous after they open.
- Block mode: administrators can remove the Proceed button from warnings. Users can ask for a review, and an approved site is allowed for everyone.
- Protection for AI browsing agents, off by default: it flags instructions hidden for AI agents, applies a stricter policy in automated sessions, and checks sign-ins and program downloads.
- A Report to SavvyShield button in Gmail and Outlook on the web for practice simulation emails.
- The Savvy Score now counts real threats: heeding a warning costs nothing, proceeding past one costs 5 points, and scores carry over from month to month.
- Simulations come in three styles (pop-ups, notification toasts, and full-page takeovers) and show the signs a user could have spotted after a miss. Security tools that open links automatically no longer count as clicks.
- For administrators: a Protection column showing whose extension is running, a fuller weekly report, optional simulation failure alerts, CSV exports, and reorganized settings.
- Extension 1.3.0 rolls out automatically, and our privacy policy now describes the new checks.
Strict privacy mode
New controls for organizations that want to limit what is sent for analysis.
- Strict privacy mode lets administrators send only the link, mask every value in link parameters, or mask page addresses, including pages opened from email or chat apps.
- More kinds of secrets in web addresses, such as sign-in and password-reset tokens in the page path, are now masked before analysis for every customer.
- Extension 1.2.0 applies the new masking in the browser, before anything leaves it.
Secrets in web addresses are masked
Passwords, sign-in codes, and tokens in links stay out of what SavvyShield analyzes and stores.
- Values that look like credentials are replaced with “[redacted]” before analysis, whatever your scan settings.
- Simulation countdown timers now tick like the real thing.
- Reporting a simulation with right-click, then Scan, now works on web apps that replace the browser’s menu, such as Microsoft Teams.
A rewritten privacy policy, built into the product
A plain-language privacy policy, a public subprocessor list, and clear limits on how long we keep data.
- Scan details are deleted after 90 days, removed users’ personal information within 30 days, and closed accounts’ data within 90 days.
- Link-only mode now masks page addresses as well.
- Simulation emails contain no open-tracking pixels or click tracking.
- The extension’s welcome reminder includes a short privacy disclosure and a language picker.
Link-only scanning and a smoother first sign-in
More control over what is sent for analysis, and a gentler start for new users.
- Administrators can limit automatic checks to the link and the page it appears on.
- New installs start with a friendly welcome reminder for three days before asking users to sign in on every page.
- Security improvements across our backend, including tighter access controls and reduced data retention.
Easier ways to join
Invitation links, emailed invitations, and auto-enroll are clearer for invitees and admins.
- Invitation links show which organization the invite is from and guide people to single sign-on or a password.
- People can ask for a lost invitation email to be sent again.
- Invitation expiry follows the setting you choose, and each email domain can be used for auto-enroll by only one organization.
Clearer user management and more reliable simulations
Pending invitations in the user list, signed invitation links, and simulations that wait for the user.
- Invited users appear in the user list right away, marked “Invite pending.”
- Invitation links are signed to protect against tampering.
- Allow list entries explain exactly what each domain covers.
- Simulations appear only on the tab the user is viewing, and their time limit pauses when the user switches tabs.
Deeper visibility for administrators
Every user’s Savvy Score journey, training assignments, and a security posture radar.
- Reports now include a Users tab with each person’s Savvy Score over time and the events behind it.
- A User Assignments view shows who has active and overdue training.
- The Security Posture Radar compares departments, offices, and teams across five dimensions.
Firefox support and adaptive simulations
SavvyShield for Firefox, simulations that generate themselves, and stronger SSO.
- SavvyShield is available for Firefox with the same protection, simulations, and training as Chrome.
- Adaptive auto-generation creates fresh simulation batches on a schedule, aimed at each team’s weakest areas.
- Overdue training reminders by email, in the browser, or both.
- Directory groups from Okta and Microsoft Entra ID can be mapped to labels, and admins can manage single sign-on.
Regional scanning and onboarding videos
Faster checks for teams in Europe and Asia, and new training content.
- Real-time checks now run in five regions, including Europe and Southeast Asia.
- A new onboarding video series, which administrators can assign directly.
- The extension prompts signed-out users to sign in as soon as they start browsing, so protection gaps are visible.
