OctoXLabs has released version 6.9.1 of its CAASM (Cyber Asset Attack Surface Management) platform. The headline feature is the MCP Server, which exposes asset intelligence data to any LLM client that supports the Model Context Protocol and runs fully on-premises. The release also brings more than 100 new adapters and new automated actions in the Action Center.
OctoXLabs aggregates, normalizes, and deduplicates asset data from every source in the environment, from cloud platforms and IAM through EDR, MDM, and vulnerability scanners to CMDB and ITSM. Security and IT teams get a single source of truth on their assets, their security posture, and coverage gaps, such as devices without an EDR agent or outside patch management.
MCP Server: asset intelligence in natural language
The OctoXLabs MCP Server exposes Asset Intelligence data as MCP tools to any LLM client that supports the Model Context Protocol. It is also compatible with local and self-hosted enterprise LLMs deployed within the organization’s own infrastructure.
Analysts no longer need to know the platform’s query syntax. A prompt is all it takes, and through the MCP Server the LLM can:
- run natural language queries against any inventory (devices, users, software, cloud resources, and more),
- aggregate and group assets by attributes,
- store saved queries for reuse,
- create and customize dashboards and widgets directly from a prompt.
Crucially, the MCP Server runs fully on-premises. An asset inventory is a valuable map of the attack surface for an attacker, so it matters that the data never leaves the organization’s perimeter or goes to an external LLM provider. This will be especially valued by regulated industries with data residency requirements and NIS2 or DORA compliance obligations.
More than 100 new adapters
The value of CAASM grows with the number of sources the platform correlates data from. Release 6.9.1 therefore significantly expands integration coverage across cloud, IAM, the security stack, and IT management. Highlights among the new adapters include:
| Area | New adapters |
|---|---|
| Cloud and data | Databricks, Google BigQuery, Microsoft Power BI |
| Collaboration and identity | Google Workspace, CyberArk |
| Network and cloud security | Palo Alto Networks Strata and Prisma, Zscaler, Cisco Secure Access |
| Infrastructure | Cisco Intersight, a broad set of IBM integrations |
| Universal sources | generic file-based adapters for CSV, JSON, XML, XLSX, and SQLite |
The generic file-based adapters support every inventory type. This makes it possible to ingest data from systems without an API, such as exports from legacy applications, OT environments, or manually maintained XLSX records, and to eliminate blind spots in the inventory.
Expanded Action Center: from visibility to remediation
OctoXLabs no longer provides just visibility into the attack surface. The Action Center lets teams trigger response and remediation actions directly from the platform, without switching between the consoles of individual tools. Release 6.9.1 adds new automated actions for:
- AWS, including IAM, EC2, S3, RDS, Lambda, and other services,
- VMware Carbon Black for EDR,
- Zscaler for SSE and cloud security,
- BMC Helix ITSM and Ivanti Cherwell for ITSM and ticketing workflows.
In practice, this reduces MTTR, the time from detecting an issue to fixing it. When the platform identifies, for example, an endpoint without an EDR agent or a misconfigured cloud resource, the team can immediately trigger a remediation action or automatically open a ticket in the ITSM.
Final thoughts
OctoXLabs 6.9.1 takes CAASM to the next level. It extends asset visibility with more than 100 new sources, connects findings directly to remediation, and brings AI-driven data work through the MCP Server, all while sensitive attack surface information stays on-premises.
Want to see the MCP Server or the new adapters in action? Get in touch, and we’ll be happy to set up an OctoXLabs demo for you.
