Arctic Wolf incident

Third party EDR tools flagging Risk Scan Utility

Minor Resolved View vendor source →

Arctic Wolf experienced a minor incident on October 8, 2026 affecting Managed Risk/ Aurora Vulnerability Management-Agent Infrastructure and Managed Risk/ Aurora Vulnerability Management-Agent Infrastructure and 1 more component, lasting 4d 20h. The incident has been resolved; the full update timeline is below.

Started
Oct 08, 2026, 07:53 PM UTC
Resolved
Oct 13, 2026, 04:46 PM UTC
Duration
4d 20h
Detected by Pingoru
Oct 08, 2026, 07:53 PM UTC

Affected components

Managed Risk/ Aurora Vulnerability Management-Agent InfrastructureManaged Risk/ Aurora Vulnerability Management-Agent InfrastructureManaged Risk/ Aurora Vulnerability Management-Agent InfrastructureManaged Risk/ Aurora Vulnerability Management-Agent Infrastructure

Update timeline

  1. investigating Oct 08, 2026, 07:53 PM UTC

    We are aware of an issue affecting Third Party EDR Solutions. Users may experience EDR solutions alerting on Arctic Wolf Risk Scan Utility. Our team has been alerted and is investigating. Next Update: 10/08/26 21:00 UTC

  2. investigating Oct 08, 2026, 09:16 PM UTC

    Our team is continuing to investigate an issue affecting Third Party EDR Solutions. Users may experience EDR solutions alerting on Arctic Wolf Risk Scan Utility. Next Update: 10/08/26 23:00 UTC

  3. monitoring Oct 08, 2026, 11:28 PM UTC

    After investigating this issue Arctic Wolf determined that this issue, which causes third party EDR tools to flag risk scan utilities is impacting customers who are not utilizing signed script mode. Impacted customers have been directly notified and Signed Script Mode has been enabled in their environment. We believe that this change will mitigate the improper flagging of risk scan utilities. We are currently monitoring these changes Next Update: 10/09/26 16:00 UTC

  4. monitoring Oct 09, 2026, 04:05 PM UTC

    Arctic Wolf continues to monitor Customers who have had Signed Script Mode enabled in their environment Next Update: 10/12/26 16:00 UTC

  5. monitoring Oct 12, 2026, 02:41 PM UTC

    Arctic Wolf continues to monitor Customers who have had Signed Script Mode enabled in their environment Next Update: 10/13/26 16:00 UTC

  6. resolved Oct 13, 2026, 04:46 PM UTC

    The incident impacting Arctic Wolf Risk scan utilities being flagged by Third Party EDR tools has been resolved. Teams traced the issue to Third Party EDR tools flagging environments using legacy mode, Arctic Wolf upgraded Customers still utilizing this method to Signed Script mode. The move to Signed Script mode has no impact on Arctic Wolf agents functionality or Customer environments but rather changes how Third Party EDR tools recognize the Risk Scan Utility scans. Customers may still need to complete allowlisting within their Third Party EDR tools to ensure that Arctic Wolf risk scan utilities are not flagged by third party EDR tools. For more information please login and use this article: https://docs.arcticwolf.com/en/arctic-wolf-agent/arctic-wolf-agent/manage-agent/trust-agent-scanner-signed-files-on-windows