What Tartan changed

• Added "Threat Manager and Automated Removal" to delete reported threats from all inboxes in minutes.
• Added Google Workspace Audits that run 100+ automated security checks.
• Added Breach Notifications that alert IT teams every 15 minutes if school accounts are exposed.
• Updated pricing model to a flat fee per school for public districts, rather than per-user pricing.
• Added a "Before and After" comparison section highlighting the manual work saved for IT directors.
• Increased the "Trusted by" count to 1,000+ schools and 300,000+ inboxes.

The product is moving from a training-only tool to an active security platform. It now automatically deletes phishing emails from all inboxes once one person reports them, which directly competes with more expensive email security suites.

• Added a Google Workspace Audit feature that scans school security settings against industry benchmarks.
• Introduced "Direct Message Injection" (DMI) for both Microsoft 365 and Google Workspace to deliver simulations and remediate threats directly in mailboxes.
• Launched a "Breach Notifications" service that monitors school domains for leaked credentials using Have I Been Pwned.
• Updated the Privacy Policy to include a detailed list of subprocessors (AWS, Stripe, Mailgun, etc.) and specific data handling rules for Google and Microsoft APIs.
• Replaced the marketing-heavy homepage content with a comprehensive legal and privacy framework.

Tartan App is moving beyond simple training into active security infrastructure. By adding technical audits and direct message injection, they are becoming a more deeply integrated security tool for school IT directors, rather than just a learning platform.

• Added a Google Workspace Audit feature that scans directory settings, mobile device status, and external sharing risks.
• Introduced "Enhanced Collection" mode to monitor third-party app grants, ChromeOS inventory, and Shared Drive permissions.
• Added Microsoft Direct Message Injection (DMI) to allow administrators to delete or move reported threats directly within the school's tenant.
• Updated the privacy policy to include a list of subprocessors like AWS, Stripe, Anthropic (Claude AI), and Mailgun.
• Replaced the marketing-heavy homepage content with a detailed legal and privacy framework.

The product is expanding from a training tool into a technical security scanner. By requesting "read-only" access to school Google Workspace configurations, they can now identify technical vulnerabilities in addition to training staff.