26 posts tagged with "New"

Introduced a new integration with SALT Security, one of the leading API Security solutions globally, bringing API discovery and inventory directly into the Conviso Platform.

• Imports the API inventory discovered by SALT and maps it to the platform's asset model.
• FQDN-based grouping: APIs and endpoints can be associated to a FQDN, so a single domain can aggregate a set of related APIs (the relationship is optional, not mandatory).
• Strengthens API visibility across the application security lifecycle and consolidates third-party API security data in a single platform.

👉 Access the Conviso Docs to experience these updates.

Launched the PCI GAP Analysis feature as part of the Offensive & Audit Manager product, enabling teams to run and document the full set of PCI assessments natively in the platform.

• Supports assessments across PCI DSS, PIN and SSF.
• Covers Gap Analysis, SAQ and the evaluation of the secure software development process, all performed and documented inside the Conviso Platform.
• Each control includes a clickable Guidance area with filling instructions, reducing the need for external consulting during self-assessments.

Watch how PCI DSS fits application security: O Papel do PCI DSS na Segurança de Aplicações.

Introduced a new Tickets module, bringing support requests directly into the Conviso Platform.

• Open and track support tickets without leaving the platform, no need to switch to email or external channels.
• Centralized history: all your support interactions live in one place.
• A more fluid, transparent support experience, fully integrated into your application security workflow.

Published the Compliance area on the Conviso Platform, starting with a PCI overview that centralizes how the platform supports PCI programs.

• Documents how PCI assessments, evidence, and controls are handled within the platform.
• Serves as the entry point for the broader Compliance & Governance capabilities (GAP Analysis, SAQ, SLA, retention).

Learn more in the PCI overview documentation.

Introduced Remediation SLA for vulnerabilities, giving teams managerial control over remediation deadlines.

• Real-time deadline states based on severity and the asset's business impact: on-time, near-due (75% of time elapsed), breached, and resolved.
• Dashboard & filters: SLA states are visible in the dashboard and issue filters, so teams can prioritize what is about to breach or already breached.
• Proactive notifications (email/platform) alert the asset's responsible teams as deadlines approach or are exceeded.
• Purely managerial and monitoring-focused, it does not block deploys/builds/merges, does not change vulnerability status automatically, and does not trigger the Security Gate (which remains the independent enforcement mechanism).

Learn more in the Remediation SLA documentation. Watch: Como priorizar vulnerabilidades baseado em riscos reais.

Introduced a new integration between the Conviso Platform and Tenable, bringing external scan results into the platform's vulnerability model.

• Ingests Tenable scan data so findings are managed alongside other sources in the platform.
• Particularly valuable for environments that require auditing and PCI (e.g. ASV scans).
• Documentation is available directly from the platform.

👉 Access the Conviso Docs to experience these updates.

Officially launched the AppSec Program. Offering assessment, roadmap, and monitoring of an application security program, natively in the platform.

• Maturity Assessment: measure the current maturity of the program (e.g. OWASP SAMM streams) and produce a baseline score.
• Roadmap & Initiatives: set a target score and link project templates and initiatives to drive the strategy, tracking maturity evolution per topic.
• Continuous Monitoring: follow the program's progress over time inside the platform, connecting sprint projects to strategic goals.

Watch: Como implementar um programa de AppSec sem fricção.

Expanded the AI Pentest flow with new white-box capabilities and documentation.

• Azure integration for white-box pentest scenarios.
• Privacy by design: source code is never sent to the LLM a key differentiator of the approach.
• Expanded official documentation for the AI Pentest workflow.

Watch: Pentest Autônomo: Como Ganhar Escala em Segurança Ofensiva com IA.

Added configuration levels and scheduling to the AI Pentest, giving teams more control over how and when automated tests run.

• Define configuration levels to tailor the depth and scope of each AI Pentest.
• Set automated schedules, moving away from manual triggers toward continuous offensive validation.

Watch: Exploração de Vulnerabilidades: o que é e como a IA faz diferente.

Introduced a new policy framework specifically for automated pentests, mirroring the Security Gate logic but optimized for offensive security workflows.

• Define specific goals for an asset, set request limits to ensure safety during execution, and define automated schedules.
• Moves teams away from manual testing triggers, ensuring assets are continuously validated against offensive scenarios.

Improved the integration between Platform Project Requirements and Jira.

• More seamless flow of security requirements into the developer's native backlog.
• UI improvements for integration consistency, syncing project requirements and activities with Jira.
• Ensures "Secure by Design" principles become actionable tasks rather than static documentation.

Introduced the AI Autonomous Pentest, an autonomous offensive security engine that combines Large Language Models with professional security tools to reduce manual toil and scale testing.

• Tool Orchestration: automatically triggers and correlates data from tools and findings.
• Offensive Reasoning: decides the best attack path, identifies vulnerability chains, and executes controlled Proof of Concepts (PoCs).
• Attack Chain Visualization: a real-time interactive graph shows the AI's reasoning from reconnaissance to successful exploit validation.

Watch the launch webinar: AI Autonomous Pentest.

Officially launched the Conviso MCP (Model Context Protocol) Server, available on the Anthropic MCP-Market, allowing external AI models to interact securely with your Conviso Platform data.

• Query assets, vulnerability status, and project updates directly within the chat interface.
• Brings Conviso's security intelligence into the developer's AI workspace, enabling faster remediation suggestions and architectural reviews without leaving the LLM environment.

The Threat Modeling module now functions as a living record of your application's security design — a persistent artifact that evolves throughout the software lifecycle instead of a project that "closes".

• Persistent Architecture-as-Code: use visual diagrams as the primary driver to update your living security model without starting from scratch.
• Automated Requirement Sync: instantly translate architectural changes into actionable security controls.
• Historical Traceability: native versioning provides a complete audit trail of every design shift, ensuring full compliance and governance.

Custom Project Requirements lets teams tailor security activities within each project without affecting global organization templates.

• Customize Activities: edit descriptions and steps of an activity to match the project's tech stack.
• Refine the Scope: ensure stakeholders only see activities relevant to their specific project.
• Preserve Templates: all changes are local to the project, keeping organizational "Golden Templates" consistent.

Security Gate configuration and monitoring are now available directly inside the Conviso Platform interface, without relying on CLI configuration.

• Configure Security Gates directly within the CI/CD section of assets.
• Support for multiple vulnerability sources (Conviso AST, Dependency Track, Fortify, SonarQube, SonarCloud, Checkmarx, GitHub, Snyk, Veracode, and MobSF).
• Define severity thresholds per source and optional maximum days to remediate.
• Support for asset-specific policies that override global company rules.

Learn more in the Security Gate documentation.

Expanded the AI Agents operations across the platform.

• Introduced Auto-Fix, which can be triggered directly from vulnerability context.
• Expanded False Positive review support to DAST issues, increasing consistency across scanning sources.
• Improved AI Agent chat usability with Start new conversation to reset context and return to quick actions.
• Multiple stability and quality improvements across agent execution and recurring runs.

Introduced SBOM correlation to improve consistency between Conviso AST and platform monitoring.

• Reduces “blinking” findings (open/close/reopen) caused by data source mismatches.
• Expands advisory coverage and increases trust in the supply-chain vulnerability lifecycle.
• Provides a more reliable foundation for continuous dependency monitoring at scale.

Restored and strengthened DAST API support.

• Added support for GraphQL and SOAP scanning scenarios.
• Improved API schema import workflow: Swagger import via upload and URL.
• Enhanced DAST execution controls, including timeouts and configuration reliability.
• Improved scan lifecycle consistency and operational readiness.

Added support for automatically running Conviso AST on open Pull Requests.

• Security feedback is produced directly in GitHub through checks and annotations.
• Enables a true shift-left workflow by detecting issues while code is being reviewed, without requiring additional configuration.

Enhanced CLI experience with new capabilities aimed at operational workflows.

• Added a new sub-command to list project requirements.
• Improved packaging and consistency for AST distribution.
• Strengthens automation workflows and enables scalable operational usage by AppSec teams.

Introduced a new Security Feed page to display alerts, notifications, and updates more clearly.

• Improves real-time visibility into security-related activity across the platform.
• Complements existing workflows with a stronger “single place to monitor what’s happening”.

Improved the requirements and project workflows.

• Introduced Project Templates, enabling standardized project creation at scale.
• Added filter by Activity in project requirements, improving navigation and prioritization.
• Improved the requirements table to support searching by activity name.

Added support for running OWASP SAMM assessments directly inside Conviso Platform.

• Evaluate AppSec maturity, track progress over time, and compare assessments.
• Improves visibility for customer maturity programs and structured AppSec evolution.

New Security Gate experience in the platform to monitor and manage gate runs.

• Centralizes visibility into Security Gate executions under CI/CD > Security Gate.
• Helps teams standardize quality gates and governance across development pipelines.

Introduced native ServiceNow ITSM integration to create and update incidents from Conviso Platform findings.

• Enables security and engineering teams to operationalize remediation via ServiceNow workflows.
• Designed for enterprise environments where ITSM processes drive remediation execution and tracking.