Windows Agent Upgrade – Troubleshooting Guide

Last updated: October 23, 2026

Following the September 9 platform release, most agents have upgraded automatically to the new Next Generation Agent and are reporting normally.

The dashboard only counts agents that have upgraded to the Next Generation Agent, so that number should climb to match the number of machines successfully migrated. If it has stalled or is close to zero, your agents are not upgrading automatically. See below to help identify and resolve any condition that may cause this.

Each scenario below explains what to check and how to bring endpoints that did not upgrade onto the new agent. If you have any questions, contact support@cyrisma.com or open a ticket here.

Changes in Agent Operation

Related articles:

1. What Changed with the Next Generation Agent

The September release changes how the agent works. Agents no longer run scans on a schedule that someone has to maintain. Vulnerability management and baseline comparison (checking machine configurations against known baselines) are now continuous. As soon as the Next Generation Agent is installed or upgraded, it starts collecting vulnerability and baseline data.

What this means for you

Area

What changed

Scheduling

You no longer need to schedule or maintain vulnerability or baseline scans.

Vulnerability detail

Vulnerability detail is more intuitive and gives you more visibility.

Remediation

The actions needed to reduce or remove a vulnerability are clearer.

Install location

The agent now installs in C:\Program Files\CyrismaAgent instead of C:\CYRISMA_Agent, for consistency and compatibility with the rest of the operating system.

EDR policies

Because the agent moved to Program Files, you'll likely need to update EDR rules and policies to allow the new location.

Footprint

The agent is much lighter. It no longer needs large amounts of Java memory or large disk space for scan output.

Resource use

Data collection runs quietly in the background, with no scheduled scans that tie up resources while they run.

Network traffic

Traffic is lower because the agent sends only changes to vulnerabilities or machine configurations.

Network allow lists

Agents still report to your tenant's own Tenant URL, but they're now centrally managed. You need to add allow-list rules for the management endpoint (see Section 3).

2. Troubleshooting Table

Find the row that matches the endpoint's state.

Agent state

Cause

How to resolve

Legacy agent was not checking in

Because it wasn't checking in, the agent never received the upgrade instruction.

Remove the legacy agent and install the latest agent from Agent Setup. See Section 4.

Legacy agent is older than version 473

Only version 473 agents were eligible for the automatic upgrade.

Remove the old agent and install the latest agent from Agent Setup. See Section 4.

Version 473 agent can't reach dl.cyrisma.com

The agent must reach dl.cyrisma.com to download the Next Generation Agent.

Add dl.cyrisma.com to your allow list.

Version 473 agent was checking in and can reach dl.cyrisma.com, but didn't upgrade

EDR may be blocking the new agent in its new location.

Make sure your EDR allows the agent to run from C:\Program Files\CyrismaAgent. If it still doesn't upgrade, collect the logs and send them to Cyrisma Support. See Section 6.

Next Generation Agent is installed but is blocked or not working correctly

EDR policies or network allow lists are blocking the new agent.

Update EDR rules or policies to allow C:\Program Files\CyrismaAgent. Update network allow lists so the agent can reach dl.cyrisma.com and your regional management endpoint (Section 3).

3. Network Allow-List Requirements

Allow each endpoint to reach the following:

  1. dl.cyrisma.com. Used to download and update the agent.

  2. The management (auth) endpoint for your region. Used for centralized agent management.

Region

Management endpoint

United States

auth.production-north-virginia.cyrisma.com

Australia

auth.production-sydney.cyrisma.com

European Union

auth.production-ireland.cyrisma.com

United Kingdom

auth.production-london.cyrisma.com

Africa

auth.production-africa.cyrisma.com

For the full list of network requirements, including your Tenant URL, see Global Agent Requirements.

4. Installing the Latest Agent

Use these steps for agents that weren't checking in or were older than version 473.

Step 1: Remove the legacy agent

Choose one method.

Manual uninstall

  1. Open Command Prompt as Administrator.

  2. Go to C:\CYRISMA_Agent\.

  3. Run unins000.exe.

  4. Follow the uninstall prompts.

Silent uninstall

  1. Open Command Prompt as Administrator.

  2. Run:

    C:\CYRISMA_Agent\unins000.exe /verysilent

Step 2: Prepare the endpoint

The Next Generation Agent installs in C:\Program Files\CyrismaAgent. Before you install:

Step 3: Install the agent

  1. In the Cyrisma tenant web interface, go to Agent Setup.

  2. Select the operating system for the endpoint.

  3. Download and install the latest agent using the Tenant URL and Installation Key shown on the page.

For step-by-step installer instructions, see Deploying the Cyrisma Agent on Windows.

Deployment scripts: Agent Setup also has sample deployment scripts. They're examples to help you build your own scripts. Add any changes or functions your environment needs for the agent to run.

5. EDR Compatibility

EDR tools often use DLL injection to watch programs for suspicious activity. Malware can use the same technique to do harm. To guard against this, the Cyrisma agent allows DLL injection and monitoring only from recognized, legitimate EDR suites.

See the Recognized EDR Suites list at the end of this article. If your EDR isn't listed and uses DLL injection to monitor, contact Cyrisma Support with the details of your EDR suite.

6. Send Logs to Cyrisma Support

Collect logs if all of the following are true but the upgrade still didn't finish:

  • The legacy agent was version 473.

  • It was checking in.

  • The endpoint can reach dl.cyrisma.com and your regional management endpoint.

Log

Location

Legacy agent logs

C:\CYRISMA_Agent\Logs

Next Generation Agent logs (if present)

C:\ProgramData\CyrismaAgent\Logs

  1. Add the available logs to a ZIP file.

  2. Send the ZIP file to Cyrisma Support at support@cyrisma.com or attach it to a support ticket.

Recognized EDR Suites

The Cyrisma agent recognizes the following EDR suites and allows them to monitor it through DLL injection.

Avast

Cylance

PC Matic

AVG

Cynet

Proofpoint

Avira

Elastic

SentinelOne

Binary Defense

ESET

SentryBay

Bitdefender

F-Secure

SonicWall

Broadcom

FireEye

Sophos

BullGuard

Fortinet

Symantec

Carbon Black

Huntress

Trellix

Check Point

Kaspersky

Trend Micro

Cisco AMP

Malwarebytes

VIPRE

ClamAV

Microsoft Defender

VMware Carbon Black

CrowdStrike

Panda

Webroot

If your EDR isn't listed, contact Cyrisma Support for guidance.