11 posts tagged with "AI Pentest"

Release date: October 23rd, 2026

Key Benefits​

• AI Pentest Assisted;
• SSL Certificate Automation with ACME;
• More Flexible Security Gate Policies;
• Azure DevOps Service Principal Authentication;
• Access Control and Default Profiles;
• Trust Center Administration;
• DAST Configuration;
• Integrations and Scan Management;

Introduction​

Release 4.27 expands control over application security workflows, access governance, and integrations. It introduces AI Pentest Assisted, improves certificate automation and Security Gate configuration, and brings a more flexible experience to Trust Center and DAST management.

Release date: August 28th, 2026

Key Benefits​

• A Major Release for Security Operations;
• SSL Certificate Management;
• Tag-Driven Risk Score Policies;
• Pull Request Scans and Security Gate;
• GitLab, Bitbucket, and Developer Ecosystem Integrations;
• Practical API Documentation by Language;
• SBOM Visibility;
• AI Pentest Evolution;
• Advanced Vulnerability Filters;
• A New List, Filter, and Navigation Experience;
• Asset and FQDN Management Improvements;

Introduction​

Release 4.26 is an important Conviso Platform release. It brings together a broad set of capabilities delivered over an extended period, with a shared goal: helping security and development teams make faster, more confident decisions from a single AppSec platform.

This release expands security operations across the full workflow—from repository and pull request scanning to remediation, risk management, SBOM analysis, AI-assisted pentesting, and developer tooling. It also delivers a more consistent experience across the Platform's main lists, filters, and navigation.

---

Highlights

A Major Release for Security Operations​

• Strengthens the connection between security findings, source-code workflows, and developer tools.
• Expands risk management with tag-driven policies and more granular Auto-Fix controls.
• Improves visibility into pull request scans, Security Gate verdicts, SBOMs, and AI Pentest executions.
• Unifies the Platform experience with modern filters, clearer navigation, and more consistent list actions.

---

New Feature

SSL Certificate Management​

• Introduced a dedicated SSL Certificate module for managing certificate operations in the Platform.
• Supports SSL credit purchase flows and access controls aligned with user profiles.
• Gives teams a centralized place to manage certificate-related activities alongside their AppSec operations.

Learn more in the SSL Certificates documentation.

---

New Feature

Tag-Driven Risk Score Policies​

• Create Risk Score Policies that automatically apply risk parameters to assets based on their tags.
• Policies can define Business Impact, Attack Surface, and Data Classification while preserving asset values that are not configured by the policy.
• Supports policy activation, editing, deletion, and bulk asset tagging.
• When an asset matches more than one policy, the user can select the applicable policy and persist that choice on the asset.

Learn more in the Risk Score documentation.

---

New Feature

Pull Request Scans and Security Gate​

• Added a Pull Requests view for repository assets, with search, filters, run details, branches, commits, duration, and finding summaries.
• Pull Request Scan runs now show their Security Gate outcome directly in the workflow.
• Security Gate policies can evaluate only vulnerabilities introduced by a pull request or include pre-existing vulnerabilities from the target branch.
• Improved Security Gate visibility with scan-to-gate links, severity-level verdict details, scan filters, and results on the asset view.
• Security Gate surfaces are now aligned with the company's contracted plan.

Learn more in the Pull Request Scans documentation and Security Gate documentation.

---

New Feature

GitLab, Bitbucket, and Developer Ecosystem Integrations​

• Added complete GitLab and Bitbucket repository integration flows, including OAuth connection, scope and repository selection, project import, and configuration in the Platform.
• Azure DevOps, GitLab, and Bitbucket integrations now provide repository scan visibility.
• The Conviso AST task is available in the Visual Studio Marketplace for Azure DevOps pipelines. Learn more in the Azure Pipelines documentation.
• The Conviso GitHub Sync Task is available in GitHub Marketplace to import and synchronize assets from external scanners. Learn more in the GitHub Actions documentation.
• Conviso plugins for Visual Studio Code, Visual Studio, and IntelliJ IDEs bring platform capabilities into the development environment, including AI-assisted security guidance, vulnerability remediation support, secure-code suggestions, and access to security requirements without leaving the IDE.

Learn more in the GitLab Repositories documentation and Bitbucket documentation.

---

Improvements

Practical API Documentation by Language​

• Improved the GraphQL API documentation with practical, operation-level examples.
• Examples are available in multiple programming languages, making it easier for development teams to understand request structure, context, identifiers, and expected usage.
• Reduces the effort required to integrate Conviso Platform capabilities into internal tools, automations, and development workflows.

Learn more in the GraphQL API context and identifiers documentation.

---

New Feature

SBOM Visibility​

• Introduced an improved SBOM visualization experience for clearer component and vulnerability analysis.
• Helps development and security teams understand the software inventory behind a finding and remediate with greater confidence, speed, and precision.

Learn more in the SBOM Management documentation.

---

New Feature

AI Pentest Evolution​

• AI Pentest is now organized around reusable artifacts that centralize scope, authentication, documentation, scheduling, and execution settings.
• Added credit-based assessment settings, allowing teams to estimate the credits required for each assessment according to size and depth.
• Added a retest flow for completed AI Pentest projects, with progress and completion feedback in the project view.
• Added guidance to allow traffic from the AI Pentest Agent when configuring a target.

Learn more in the AI Pentest documentation.

---

Improvements

Advanced Vulnerability Filters​

• Added an advanced query builder for Assets and Vulnerabilities, supporting logical AND and OR groups.
• Redesigned the Vulnerabilities filtering experience with quick presets, a filter dropdown, and a side panel for reviewing and applying complex criteria.
• Added support for filtering Vulnerabilities by multiple branches at once.
• Improved filter state, URL persistence, and bulk actions, making investigation and remediation workflows more efficient.

Learn more in the Vulnerability Management documentation.

---

Improvements

A New List, Filter, and Navigation Experience​

• Modernized the filtering experience across Vulnerabilities, Assets, Projects, Scans, Security Gate, Applications, and Threat Modeling artifacts.
• Search and filters now live in the table toolbar, with grouped fields, active-filter indicators, quick presets, and side panels where applicable.
• Reorganized bulk actions, column settings, and exports to keep list actions close to the data they affect.
• Improved side-menu flyout navigation so submenus remain open while users move the pointer toward them, preventing accidental closures.
• Enhanced multi-select controls with clearer search behavior, loading feedback, and compact handling for long selections.

Learn more in the Asset Management documentation and Vulnerabilities documentation.

---

Improvements

Asset and FQDN Management Improvements​

• Improved FQDN creation and editing with the full asset form, including required domain URLs, classifications, teams, and tags.
• Expanded Auto-Fix configuration so policies can be tailored by asset and vulnerability severity.
• Improved asset management flows with clearer forms and more consistent routing between repository and domain experiences.

Learn more in the Asset Management documentation.

---

👉 Access the Conviso Platform to explore these updates in action.

Refactored the AI Pentest creation screen for a clearer, more guided setup experience.

• Reorganized the form so configuring a new AI Pentest is more intuitive.
• A smoother setup flow that makes it easier to launch well-scoped autonomous tests.

👉 Access the Conviso Docs to experience these updates.

Introduced a new Tickets module, bringing support requests directly into the Conviso Platform.

• Open and track support tickets without leaving the platform, no need to switch to email or external channels.
• Centralized history: all your support interactions live in one place.
• A more fluid, transparent support experience, fully integrated into your application security workflow.

Expanded the AI Pentest flow with new white-box capabilities and documentation.

• Azure integration for white-box pentest scenarios.
• Privacy by design: source code is never sent to the LLM a key differentiator of the approach.
• Expanded official documentation for the AI Pentest workflow.

Watch: Pentest Autônomo: Como Ganhar Escala em Segurança Ofensiva com IA.

Added configuration levels and scheduling to the AI Pentest, giving teams more control over how and when automated tests run.

• Define configuration levels to tailor the depth and scope of each AI Pentest.
• Set automated schedules, moving away from manual triggers toward continuous offensive validation.

Watch: Exploração de Vulnerabilidades: o que é e como a IA faz diferente.

Performed a complete refactor of our technical documentation, making it more intuitive and better aligned with the platform's processes and offerings.

• Reorganized content and navigation for an easier reading experience.
• Updated a large amount of content, addressing multiple support tickets and update requests.

👉 Access the Conviso Docs to experience these updates.

Introduced a new policy framework specifically for automated pentests, mirroring the Security Gate logic but optimized for offensive security workflows.

• Define specific goals for an asset, set request limits to ensure safety during execution, and define automated schedules.
• Moves teams away from manual testing triggers, ensuring assets are continuously validated against offensive scenarios.

Release date: April 20th, 2026

Key Benefits​

• AI Pentest Policy;
• Asset Filter Standardization;
• Projects and Jira Integration;

Introduction​

Release 4.25 improved the governance of automated testing, the consistency of DAST data, and the connection between security projects and engineering backlogs.

---

New Feature

AI Pentest Policy​

• Added policies for automated AI Pentest execution, including safety request limits and custom scheduling.
• Gives teams more control over how offensive testing is executed across their assets.

Learn more in the AI Pentest documentation.

---

Improvements

Asset Filter Standardization​

• Standardized Conviso DAST as a scanner source in filters and metrics.
• Improves consistency between scan coverage, dashboards, and asset filtering.

---

Improvements

Projects and Jira Integration​

• Improved the flow between Platform project requirements, activities, and Jira.
• Helps turn Secure by Design requirements into actionable engineering backlog items.

Introduced the AI Autonomous Pentest, an autonomous offensive security engine that combines Large Language Models with professional security tools to reduce manual toil and scale testing.

• Tool Orchestration: automatically triggers and correlates data from tools and findings.
• Offensive Reasoning: decides the best attack path, identifies vulnerability chains, and executes controlled Proof of Concepts (PoCs).
• Attack Chain Visualization: a real-time interactive graph shows the AI's reasoning from reconnaissance to successful exploit validation.

Watch the launch webinar: AI Autonomous Pentest.

Release date: April 6th, 2026

Key Benefits​

• AI Autonomous Pentest;
• Conviso MCP Server;
• Full-Snapshot DAST Reporting;

Introduction​

Release 4.24 expanded autonomous security operations, AI ecosystem connectivity, and the completeness of DAST reporting.

---

New Feature

AI Autonomous Pentest​

• Introduced an autonomous offensive-security engine that orchestrates tools and validates attack paths.
• Added attack-chain visualization to provide transparency from reconnaissance through exploit validation.

Learn more in the AI Pentest documentation.

---

New Feature

Conviso MCP Server​

• Made the Conviso MCP Server available for secure AI-assisted access to Platform context.
• Enables approved AI tools to use vulnerability, asset, and project context in remediation and review workflows.

---

Improvements

Full-Snapshot DAST Reporting​

• Changed DAST reports from a delta-only view to a full snapshot of the application's security posture for each execution.
• Provides an auditable, self-contained record of vulnerabilities identified at scan time.