Third party EDR tools flagging Risk Scan Utility

Final update

The incident impacting Arctic Wolf Risk scan utilities being flagged by Third Party EDR tools has been resolved. Teams traced the issue to Third Party EDR tools flagging environments using legacy mode, Arctic Wolf upgraded Customers still utilizing this method to Signed Script mode. The move to Signed Script mode has no impact on Arctic Wolf agents functionality or Customer environments but rather changes how Third Party EDR tools recognize the Risk Scan Utility scans. Customers may still need to complete allowlisting within their Third Party EDR tools to ensure that Arctic Wolf risk scan utilities are not flagged by third party EDR tools. For more information please login and use this article: https://docs.arcticwolf.com/en/arctic-wolf-agent/arctic-wolf-agent/manage-agent/trust-agent-scanner-signed-files-on-windows

1. Resolved · Oct 13, 16:46 UTC
   The incident impacting Arctic Wolf Risk scan utilities being flagged by Third Party EDR tools has been resolved. Teams traced the issue to Third Party EDR tools flagging environments using legacy mode, Arctic Wolf upgraded Customers still utilizing this method to Signed Script mode. The move to Signed Script mode has no impact on Arctic Wolf agents functionality or Customer environments but rather changes how Third Party EDR tools recognize the Risk Scan Utility scans. Customers may still need to complete allowlisting within their Third Party EDR tools to ensure that Arctic Wolf risk scan utilities are not flagged by third party EDR tools. For more information please login and use this article: https://docs.arcticwolf.com/en/arctic-wolf-agent/arctic-wolf-agent/manage-agent/trust-agent-scanner-signed-files-on-windows
2. Monitoring · Oct 12, 14:41 UTC
   Arctic Wolf continues to monitor Customers who have had Signed Script Mode enabled in their environment Next Update: 10/13/26 16:00 UTC
3. Monitoring · Oct 9, 16:05 UTC
   Arctic Wolf continues to monitor Customers who have had Signed Script Mode enabled in their environment Next Update: 10/12/26 16:00 UTC
4. Monitoring · Oct 8, 23:28 UTC
   After investigating this issue Arctic Wolf determined that this issue, which causes third party EDR tools to flag risk scan utilities is impacting customers who are not utilizing signed script mode. Impacted customers have been directly notified and Signed Script Mode has been enabled in their environment. We believe that this change will mitigate the improper flagging of risk scan utilities. We are currently monitoring these changes Next Update: 10/09/26 16:00 UTC
5. Investigating · Oct 8, 21:16 UTC
   Our team is continuing to investigate an issue affecting Third Party EDR Solutions. Users may experience EDR solutions alerting on Arctic Wolf Risk Scan Utility. Next Update: 10/08/26 23:00 UTC
6. Investigating · Oct 8, 19:53 UTC
   We are aware of an issue affecting Third Party EDR Solutions. Users may experience EDR solutions alerting on Arctic Wolf Risk Scan Utility. Our team has been alerted and is investigating. Next Update: 10/08/26 21:00 UTC