Stable releases of IDPS-ESCAPE and SATRAP-DL, and alpha release of VECTOR from PQC-MAT

We are happy to announce new open-source releases: IDPS-ESCAPE has reached its first stable version and has since been upgraded to v2.1.0, SATRAP-DL has reached its first stable version (v1.0), and we introduce VECTOR from project PQC-MAT, a new toolkit to prepare the migration to post-quantum cryptography.

IDPS-ESCAPE (v1.0 → v2.1.0) has moved from research prototype to production-ready platform:

• v1.0 – stable release — the RADAR web control panel, Ruleset-as-Code (version-controlled detection rules deployed through a GitHub Actions pipeline), new GeoIP and off-hour login detection, and hardened RADAR container images

• v1.1 — a new web scanning detection scenario for Apache and Nginx access logs

• v2.0 — a redesigned RADAR deployment: enrichment moved to the Wazuh manager, one-step endpoint enrolment with short-lived tokens, reversible deployment steps, and no more Ansible requirement

• v2.1.0 — RADAR is now deployable on existing Wazuh installations and hardened for production use (authenticated control panel, per-deployment credentials, trusted alert sources, protected critical addresses and services), with a more robust DECIPHER integration: RADAR keeps detecting and responding even when CTI enrichment is unavailable

IDPS-ESCAPE product page

IDPS-ESCAPE on GitHub

IDPS-ESCAPE v1.0 blog post

IDPS-ESCAPE v2.1.0 blog post

SATRAP-DL (v1.0) reaches its first stable version, following its alpha (March 2025) and beta (March 2026) releases:

• Flowintel template repository integration — incident templates are now managed centrally in Flowintel (v3.1.0 and later) instead of within DECIPHER, giving organisations a single source of templates

• Extended testing and complete documentation — new unit and integration tests covering the Flowintel integration points, full user manuals for SATRAP and DECIPHER, and updated technical specifications

• Stability and maintenance — bug fixes and code quality improvements for a stable and extensible core

SATRAP-DL product page

SATRAP-DL on GitHub

SATRAP-DL blog post

VECTOR (VErified Cryptography and Transition via Observable Registry) is the first release (v0.1) of PQC-MAT, a new CyFORT sub-project carried out under the EU IPCEI-CIS initiative. With NIST’s first post-quantum standards (FIPS 203, 204 and 205) published and “Harvest Now, Decrypt Later” threats in mind, it helps organisations take the first step of any post-quantum migration: knowing where their cryptography is.

• TOR (Transition via Observable Registry) — the cryptographic inventory engine, generating standardised CycloneDX 1.6 Cryptographic Bills of Materials (CBOM) through a unified vector CLI

• VECTOR-Code — static analysis of Python, C and C++ source code with CodeQL, cloc and cryptobom-forge

• VECTOR-Network — conversion of testssl.sh and ZGrab2 scans into CBOMs, including detection of standalone and hybrid post-quantum KEMs such as X25519MLKEM768

• VECTOR-Score — quantum risk classification of every algorithm against a catalogue aligned with NIST FIPS 203/204/205, BSI TR-02102-1 and ANSSI, with an annotated CBOM and a Markdown risk report

• Verified cryptography — a demonstration of mathematically verified implementations with F*

VECTOR product page

PQC-MAT on GitHub

PQC-MAT blog post

Together, IDPS-ESCAPE and SATRAP-DL now run the full loop on existing Wazuh deployments: RADAR detects a threat → DECIPHER enriches it with live CTI → a risk score drives the automated response → a prioritised Flowintel incident case lands in the analyst’s queue. VECTOR extends our open-source offering to post-quantum readiness. Entirely open-source.