19 posts tagged with "Compliance & Governance"

Release date: October 23rd, 2026

Key Benefits​

• AI Pentest Assisted;
• SSL Certificate Automation with ACME;
• More Flexible Security Gate Policies;
• Azure DevOps Service Principal Authentication;
• Access Control and Default Profiles;
• Trust Center Administration;
• DAST Configuration;
• Integrations and Scan Management;

Introduction​

Release 4.27 expands control over application security workflows, access governance, and integrations. It introduces AI Pentest Assisted, improves certificate automation and Security Gate configuration, and brings a more flexible experience to Trust Center and DAST management.

Launched the PCI GAP Analysis feature as part of the Offensive & Audit Manager product, enabling teams to run and document the full set of PCI assessments natively in the platform.

• Supports assessments across PCI DSS, PIN and SSF.
• Covers Gap Analysis, SAQ and the evaluation of the secure software development process, all performed and documented inside the Conviso Platform.
• Each control includes a clickable Guidance area with filling instructions, reducing the need for external consulting during self-assessments.

Watch how PCI DSS fits application security: O Papel do PCI DSS na Segurança de Aplicações.

Published the Compliance area on the Conviso Platform, starting with a PCI overview that centralizes how the platform supports PCI programs.

• Documents how PCI assessments, evidence, and controls are handled within the platform.
• Serves as the entry point for the broader Compliance & Governance capabilities (GAP Analysis, SAQ, SLA, retention).

Learn more in the PCI overview documentation.

Introduced Remediation SLA for vulnerabilities, giving teams managerial control over remediation deadlines.

• Real-time deadline states based on severity and the asset's business impact: on-time, near-due (75% of time elapsed), breached, and resolved.
• Dashboard & filters: SLA states are visible in the dashboard and issue filters, so teams can prioritize what is about to breach or already breached.
• Proactive notifications (email/platform) alert the asset's responsible teams as deadlines approach or are exceeded.
• Purely managerial and monitoring-focused, it does not block deploys/builds/merges, does not change vulnerability status automatically, and does not trigger the Security Gate (which remains the independent enforcement mechanism).

Learn more in the Remediation SLA documentation. Watch: Como priorizar vulnerabilidades baseado em riscos reais.

Officially launched the AppSec Program. Offering assessment, roadmap, and monitoring of an application security program, natively in the platform.

• Maturity Assessment: measure the current maturity of the program (e.g. OWASP SAMM streams) and produce a baseline score.
• Roadmap & Initiatives: set a target score and link project templates and initiatives to drive the strategy, tracking maturity evolution per topic.
• Continuous Monitoring: follow the program's progress over time inside the platform, connecting sprint projects to strategic goals.

Watch: Como implementar um programa de AppSec sem fricção.

Shipped several improvements across vulnerability visualization, retest projects, and evidence handling.

• Vulnerability details & timeline: clearer visualization of a vulnerability's details and history.
• Retest projects: status changes for vulnerabilities associated with retest-type projects.
• Projects Calendar: a new calendar tab on the projects page, improving planning and visibility of project schedules.
• Evidence on status change: attach evidence files when changing a vulnerability's status — including use cases such as associating a file with a risk acceptance — strengthening auditability and traceability across the lifecycle.

Watch: Como elevar a maturidade da gestão de vulnerabilidades com foco no risco.

Introduced a new policy framework specifically for automated pentests, mirroring the Security Gate logic but optimized for offensive security workflows.

• Define specific goals for an asset, set request limits to ensure safety during execution, and define automated schedules.
• Moves teams away from manual testing triggers, ensuring assets are continuously validated against offensive scenarios.

Refactored DAST reporting logic for better visibility and compliance readiness.

• From Delta to Snapshot: reports moved from a "change-only" view to a Full-Snapshot format. Every DAST execution now reports the complete security posture, including all vulnerabilities.
• Audit Readiness: every scan provides a standalone, auditable record of the application's health, simplifying work for security leaders and compliance officers.

The Threat Modeling module now functions as a living record of your application's security design — a persistent artifact that evolves throughout the software lifecycle instead of a project that "closes".

• Persistent Architecture-as-Code: use visual diagrams as the primary driver to update your living security model without starting from scratch.
• Automated Requirement Sync: instantly translate architectural changes into actionable security controls.
• Historical Traceability: native versioning provides a complete audit trail of every design shift, ensuring full compliance and governance.

Release date: March 23rd, 2026

Key Benefits​

• Continuous Living Threat Modeling;
• Defect Tracker Recent Deliveries;

Introduction​

Release 4.23 made Secure by Design workflows more continuous and improved visibility into the delivery of findings to engineering backlogs.

---

New Feature

Continuous Living Threat Modeling​

• Introduced living, versioned threat-modeling artifacts driven by architecture diagrams.
• Keeps security requirements synchronized with architectural changes and preserves their evolution as an auditable history.

---

New Feature

Defect Tracker Recent Deliveries​

• Added visibility into recent synchronization events for defect trackers such as Jira, ClickUp, and ServiceNow.
• Helps teams troubleshoot delivery issues with detailed context and status information.

Custom Project Requirements lets teams tailor security activities within each project without affecting global organization templates.

• Customize Activities: edit descriptions and steps of an activity to match the project's tech stack.
• Refine the Scope: ensure stakeholders only see activities relevant to their specific project.
• Preserve Templates: all changes are local to the project, keeping organizational "Golden Templates" consistent.

Release date: March 12th, 2026

Key Benefits​

• Custom Project Requirements;
• Enhanced Data Classification;

Introduction​

Release 4.22 delivered more flexibility for project-level security work and more precise risk intelligence for assets.

---

New Feature

Custom Project Requirements​

• Allows teams to tailor activities and descriptions within a project without changing the organization-wide template.
• Keeps governance templates consistent while making project backlogs relevant to each technical context.

---

Improvements

Enhanced Data Classification​

• Expanded Asset data-classification tiers from Public to Critical.
• Uses data sensitivity to improve risk prioritization for affected assets and vulnerabilities.

Learn more in the Risk Score documentation.

Release date: March 9th, 2026

Key Benefits​

• Security Gate in the Platform;
• Dark Mode;
• Activity Evidence Navigation;

Introduction​

Release 4.21 focused on visibility, usability, and governance across security workflows.

---

New Feature

Security Gate in the Platform​

• Made Security Gate configuration and monitoring available directly in the Platform.
• Supports global and asset-specific policies, severity thresholds, remediation time limits, and multiple vulnerability sources.
• Improves visibility into gate outcomes and the conditions that block a pipeline.

Learn more in the Security Gate documentation.

---

Improvements

Dark Mode​

• Added Dark Mode across the Platform for a more comfortable, consistent experience during extended use.

---

Improvements

Activity Evidence Navigation​

• Simplified access to screenshots, documents, and other evidence attached to activity records.
• Reduces friction during validation, remediation, and compliance review workflows.

Improved the experience of reviewing attachments associated with activities.

• Navigate screenshots, documents, and supporting files more intuitively while analyzing activity history.
• Reduces friction during validation processes and helps teams quickly locate evidence needed to confirm remediation or compliance steps.

Security Gate configuration and monitoring are now available directly inside the Conviso Platform interface, without relying on CLI configuration.

• Configure Security Gates directly within the CI/CD section of assets.
• Support for multiple vulnerability sources (Conviso AST, Dependency Track, Fortify, SonarQube, SonarCloud, Checkmarx, GitHub, Snyk, Veracode, and MobSF).
• Define severity thresholds per source and optional maximum days to remediate.
• Support for asset-specific policies that override global company rules.

Learn more in the Security Gate documentation.

Improved the requirements and project workflows.

• Introduced Project Templates, enabling standardized project creation at scale.
• Added filter by Activity in project requirements, improving navigation and prioritization.
• Improved the requirements table to support searching by activity name.

Added support for running OWASP SAMM assessments directly inside Conviso Platform.

• Evaluate AppSec maturity, track progress over time, and compare assessments.
• Improves visibility for customer maturity programs and structured AppSec evolution.

Expanded and stabilized Badge (Seal) workflows.

• Domain field support in badge creation/editing.
• Badge deletion support and improved scope isolation.
• Audit validation improvements through Conviso Seal API routing.

New Security Gate experience in the platform to monitor and manage gate runs.

• Centralizes visibility into Security Gate executions under CI/CD > Security Gate.
• Helps teams standardize quality gates and governance across development pipelines.