28 posts tagged with "Threat and Program Management"

Release date: August 28th, 2026

Key Benefits​

• A Major Release for Security Operations;
• SSL Certificate Management;
• Tag-Driven Risk Score Policies;
• Pull Request Scans and Security Gate;
• GitLab, Bitbucket, and Developer Ecosystem Integrations;
• Practical API Documentation by Language;
• SBOM Visibility;
• AI Pentest Evolution;
• Advanced Vulnerability Filters;
• A New List, Filter, and Navigation Experience;
• Asset and FQDN Management Improvements;

Introduction​

Release 4.26 is an important Conviso Platform release. It brings together a broad set of capabilities delivered over an extended period, with a shared goal: helping security and development teams make faster, more confident decisions from a single AppSec platform.

This release expands security operations across the full workflow—from repository and pull request scanning to remediation, risk management, SBOM analysis, AI-assisted pentesting, and developer tooling. It also delivers a more consistent experience across the Platform's main lists, filters, and navigation.

---

Highlights

A Major Release for Security Operations​

• Strengthens the connection between security findings, source-code workflows, and developer tools.
• Expands risk management with tag-driven policies and more granular Auto-Fix controls.
• Improves visibility into pull request scans, Security Gate verdicts, SBOMs, and AI Pentest executions.
• Unifies the Platform experience with modern filters, clearer navigation, and more consistent list actions.

---

New Feature

SSL Certificate Management​

• Introduced a dedicated SSL Certificate module for managing certificate operations in the Platform.
• Supports SSL credit purchase flows and access controls aligned with user profiles.
• Gives teams a centralized place to manage certificate-related activities alongside their AppSec operations.

Learn more in the SSL Certificates documentation.

---

New Feature

Tag-Driven Risk Score Policies​

• Create Risk Score Policies that automatically apply risk parameters to assets based on their tags.
• Policies can define Business Impact, Attack Surface, and Data Classification while preserving asset values that are not configured by the policy.
• Supports policy activation, editing, deletion, and bulk asset tagging.
• When an asset matches more than one policy, the user can select the applicable policy and persist that choice on the asset.

Learn more in the Risk Score documentation.

---

New Feature

Pull Request Scans and Security Gate​

• Added a Pull Requests view for repository assets, with search, filters, run details, branches, commits, duration, and finding summaries.
• Pull Request Scan runs now show their Security Gate outcome directly in the workflow.
• Security Gate policies can evaluate only vulnerabilities introduced by a pull request or include pre-existing vulnerabilities from the target branch.
• Improved Security Gate visibility with scan-to-gate links, severity-level verdict details, scan filters, and results on the asset view.
• Security Gate surfaces are now aligned with the company's contracted plan.

Learn more in the Pull Request Scans documentation and Security Gate documentation.

---

New Feature

GitLab, Bitbucket, and Developer Ecosystem Integrations​

• Added complete GitLab and Bitbucket repository integration flows, including OAuth connection, scope and repository selection, project import, and configuration in the Platform.
• Azure DevOps, GitLab, and Bitbucket integrations now provide repository scan visibility.
• The Conviso AST task is available in the Visual Studio Marketplace for Azure DevOps pipelines. Learn more in the Azure Pipelines documentation.
• The Conviso GitHub Sync Task is available in GitHub Marketplace to import and synchronize assets from external scanners. Learn more in the GitHub Actions documentation.
• Conviso plugins for Visual Studio Code, Visual Studio, and IntelliJ IDEs bring platform capabilities into the development environment, including AI-assisted security guidance, vulnerability remediation support, secure-code suggestions, and access to security requirements without leaving the IDE.

Learn more in the GitLab Repositories documentation and Bitbucket documentation.

---

Improvements

Practical API Documentation by Language​

• Improved the GraphQL API documentation with practical, operation-level examples.
• Examples are available in multiple programming languages, making it easier for development teams to understand request structure, context, identifiers, and expected usage.
• Reduces the effort required to integrate Conviso Platform capabilities into internal tools, automations, and development workflows.

Learn more in the GraphQL API context and identifiers documentation.

---

New Feature

SBOM Visibility​

• Introduced an improved SBOM visualization experience for clearer component and vulnerability analysis.
• Helps development and security teams understand the software inventory behind a finding and remediate with greater confidence, speed, and precision.

Learn more in the SBOM Management documentation.

---

New Feature

AI Pentest Evolution​

• AI Pentest is now organized around reusable artifacts that centralize scope, authentication, documentation, scheduling, and execution settings.
• Added credit-based assessment settings, allowing teams to estimate the credits required for each assessment according to size and depth.
• Added a retest flow for completed AI Pentest projects, with progress and completion feedback in the project view.
• Added guidance to allow traffic from the AI Pentest Agent when configuring a target.

Learn more in the AI Pentest documentation.

---

Improvements

Advanced Vulnerability Filters​

• Added an advanced query builder for Assets and Vulnerabilities, supporting logical AND and OR groups.
• Redesigned the Vulnerabilities filtering experience with quick presets, a filter dropdown, and a side panel for reviewing and applying complex criteria.
• Added support for filtering Vulnerabilities by multiple branches at once.
• Improved filter state, URL persistence, and bulk actions, making investigation and remediation workflows more efficient.

Learn more in the Vulnerability Management documentation.

---

Improvements

A New List, Filter, and Navigation Experience​

• Modernized the filtering experience across Vulnerabilities, Assets, Projects, Scans, Security Gate, Applications, and Threat Modeling artifacts.
• Search and filters now live in the table toolbar, with grouped fields, active-filter indicators, quick presets, and side panels where applicable.
• Reorganized bulk actions, column settings, and exports to keep list actions close to the data they affect.
• Improved side-menu flyout navigation so submenus remain open while users move the pointer toward them, preventing accidental closures.
• Enhanced multi-select controls with clearer search behavior, loading feedback, and compact handling for long selections.

Learn more in the Asset Management documentation and Vulnerabilities documentation.

---

Improvements

Asset and FQDN Management Improvements​

• Improved FQDN creation and editing with the full asset form, including required domain URLs, classifications, teams, and tags.
• Expanded Auto-Fix configuration so policies can be tailored by asset and vulnerability severity.
• Improved asset management flows with clearer forms and more consistent routing between repository and domain experiences.

Learn more in the Asset Management documentation.

---

👉 Access the Conviso Platform to explore these updates in action.

Improved the Security Gate response to give you more visibility into why a build was blocked.

• The Security Gate now reports how many and which vulnerabilities triggered the block.
• Available in the API endpoint response and in the ConvisoAST output, so this detail is delivered straight into your pipeline.
• Faster triage and remediation, with clear, actionable feedback at the moment the gate fails.

👉 Access the Conviso Docs to experience these updates.

Introduced a new integration with SALT Security, one of the leading API Security solutions globally, bringing API discovery and inventory directly into the Conviso Platform.

• Imports the API inventory discovered by SALT and maps it to the platform's asset model.
• FQDN-based grouping: APIs and endpoints can be associated to a FQDN, so a single domain can aggregate a set of related APIs (the relationship is optional, not mandatory).
• Strengthens API visibility across the application security lifecycle and consolidates third-party API security data in a single platform.

👉 Access the Conviso Docs to experience these updates.

Introduced a new Tickets module, bringing support requests directly into the Conviso Platform.

• Open and track support tickets without leaving the platform, no need to switch to email or external channels.
• Centralized history: all your support interactions live in one place.
• A more fluid, transparent support experience, fully integrated into your application security workflow.

Introduced Remediation SLA for vulnerabilities, giving teams managerial control over remediation deadlines.

• Real-time deadline states based on severity and the asset's business impact: on-time, near-due (75% of time elapsed), breached, and resolved.
• Dashboard & filters: SLA states are visible in the dashboard and issue filters, so teams can prioritize what is about to breach or already breached.
• Proactive notifications (email/platform) alert the asset's responsible teams as deadlines approach or are exceeded.
• Purely managerial and monitoring-focused, it does not block deploys/builds/merges, does not change vulnerability status automatically, and does not trigger the Security Gate (which remains the independent enforcement mechanism).

Learn more in the Remediation SLA documentation. Watch: Como priorizar vulnerabilidades baseado em riscos reais.

Improved the ClickUp defect-tracker integration to save time for teams that need to create configurations for many different assets.

• Reuse and replicate ClickUp configurations across multiple assets instead of setting up each one manually.
• Significantly reduces effort for operations mapping hundreds of assets, removing the need for custom scripting.

Redesigned the manual vulnerability registration flow for simplicity and better usability.

• Creating a vulnerability manually is now much simpler, with the full process on a single page.
• The same usability improvements apply to editing, making it easier to update details such as a vulnerability's severity.
• A meaningful UI/UX optimization for anyone who registers vulnerabilities at scale.

Introduced a new integration between the Conviso Platform and Tenable, bringing external scan results into the platform's vulnerability model.

• Ingests Tenable scan data so findings are managed alongside other sources in the platform.
• Particularly valuable for environments that require auditing and PCI (e.g. ASV scans).
• Documentation is available directly from the platform.

👉 Access the Conviso Docs to experience these updates.

Officially launched the AppSec Program. Offering assessment, roadmap, and monitoring of an application security program, natively in the platform.

• Maturity Assessment: measure the current maturity of the program (e.g. OWASP SAMM streams) and produce a baseline score.
• Roadmap & Initiatives: set a target score and link project templates and initiatives to drive the strategy, tracking maturity evolution per topic.
• Continuous Monitoring: follow the program's progress over time inside the platform, connecting sprint projects to strategic goals.

Watch: Como implementar um programa de AppSec sem fricção.

Performed a complete refactor of our technical documentation, making it more intuitive and better aligned with the platform's processes and offerings.

• Reorganized content and navigation for an easier reading experience.
• Updated a large amount of content, addressing multiple support tickets and update requests.

👉 Access the Conviso Docs to experience these updates.

Shipped several improvements across vulnerability visualization, retest projects, and evidence handling.

• Vulnerability details & timeline: clearer visualization of a vulnerability's details and history.
• Retest projects: status changes for vulnerabilities associated with retest-type projects.
• Projects Calendar: a new calendar tab on the projects page, improving planning and visibility of project schedules.
• Evidence on status change: attach evidence files when changing a vulnerability's status — including use cases such as associating a file with a risk acceptance — strengthening auditability and traceability across the lifecycle.

Watch: Como elevar a maturidade da gestão de vulnerabilidades com foco no risco.

Improved the Conviso MCP Server and published new governance documentation.

• Broader compatibility: the MCP now works across all Claude products — Desktop, Cowork/Projects, and CLI.
• Improved MCP documentation for easier setup and usage.
• New Skills documentation.
• Documented data retention policy.

👉 Access the Conviso Platform to experience these updates.

Improved the integration between Platform Project Requirements and Jira.

• More seamless flow of security requirements into the developer's native backlog.
• UI improvements for integration consistency, syncing project requirements and activities with Jira.
• Ensures "Secure by Design" principles become actionable tasks rather than static documentation.

Release date: April 20th, 2026

Key Benefits​

• AI Pentest Policy;
• Asset Filter Standardization;
• Projects and Jira Integration;

Introduction​

Release 4.25 improved the governance of automated testing, the consistency of DAST data, and the connection between security projects and engineering backlogs.

---

New Feature

AI Pentest Policy​

• Added policies for automated AI Pentest execution, including safety request limits and custom scheduling.
• Gives teams more control over how offensive testing is executed across their assets.

Learn more in the AI Pentest documentation.

---

Improvements

Asset Filter Standardization​

• Standardized Conviso DAST as a scanner source in filters and metrics.
• Improves consistency between scan coverage, dashboards, and asset filtering.

---

Improvements

Projects and Jira Integration​

• Improved the flow between Platform project requirements, activities, and Jira.
• Helps turn Secure by Design requirements into actionable engineering backlog items.

Officially launched the Conviso MCP (Model Context Protocol) Server, available on the Anthropic MCP-Market, allowing external AI models to interact securely with your Conviso Platform data.

• Query assets, vulnerability status, and project updates directly within the chat interface.
• Brings Conviso's security intelligence into the developer's AI workspace, enabling faster remediation suggestions and architectural reviews without leaving the LLM environment.

The Threat Modeling module now functions as a living record of your application's security design — a persistent artifact that evolves throughout the software lifecycle instead of a project that "closes".

• Persistent Architecture-as-Code: use visual diagrams as the primary driver to update your living security model without starting from scratch.
• Automated Requirement Sync: instantly translate architectural changes into actionable security controls.
• Historical Traceability: native versioning provides a complete audit trail of every design shift, ensuring full compliance and governance.

Release date: March 23rd, 2026

Key Benefits​

• Continuous Living Threat Modeling;
• Defect Tracker Recent Deliveries;

Introduction​

Release 4.23 made Secure by Design workflows more continuous and improved visibility into the delivery of findings to engineering backlogs.

---

New Feature

Continuous Living Threat Modeling​

• Introduced living, versioned threat-modeling artifacts driven by architecture diagrams.
• Keeps security requirements synchronized with architectural changes and preserves their evolution as an auditable history.

---

New Feature

Defect Tracker Recent Deliveries​

• Added visibility into recent synchronization events for defect trackers such as Jira, ClickUp, and ServiceNow.
• Helps teams troubleshoot delivery issues with detailed context and status information.

Custom Project Requirements lets teams tailor security activities within each project without affecting global organization templates.

• Customize Activities: edit descriptions and steps of an activity to match the project's tech stack.
• Refine the Scope: ensure stakeholders only see activities relevant to their specific project.
• Preserve Templates: all changes are local to the project, keeping organizational "Golden Templates" consistent.

Upgraded the risk calculation within Asset Management so the risk of a vulnerability is now intrinsically linked to the sensitivity of the data the asset handles.

• New Data Classification tiers — Public, Internal, Restricted, Confidential, and Critical — automatically adjust the asset's risk priority.
• Ensures security teams are alerted first to threats affecting their most sensitive data environments.

Release date: March 12th, 2026

Key Benefits​

• Custom Project Requirements;
• Enhanced Data Classification;

Introduction​

Release 4.22 delivered more flexibility for project-level security work and more precise risk intelligence for assets.

---

New Feature

Custom Project Requirements​

• Allows teams to tailor activities and descriptions within a project without changing the organization-wide template.
• Keeps governance templates consistent while making project backlogs relevant to each technical context.

---

Improvements

Enhanced Data Classification​

• Expanded Asset data-classification tiers from Public to Critical.
• Uses data sensitivity to improve risk prioritization for affected assets and vulnerabilities.

Learn more in the Risk Score documentation.

Release date: March 9th, 2026

Key Benefits​

• Security Gate in the Platform;
• Dark Mode;
• Activity Evidence Navigation;

Introduction​

Release 4.21 focused on visibility, usability, and governance across security workflows.

---

New Feature

Security Gate in the Platform​

• Made Security Gate configuration and monitoring available directly in the Platform.
• Supports global and asset-specific policies, severity thresholds, remediation time limits, and multiple vulnerability sources.
• Improves visibility into gate outcomes and the conditions that block a pipeline.

Learn more in the Security Gate documentation.

---

Improvements

Dark Mode​

• Added Dark Mode across the Platform for a more comfortable, consistent experience during extended use.

---

Improvements

Activity Evidence Navigation​

• Simplified access to screenshots, documents, and other evidence attached to activity records.
• Reduces friction during validation, remediation, and compliance review workflows.

Improved the experience of reviewing attachments associated with activities.

• Navigate screenshots, documents, and supporting files more intuitively while analyzing activity history.
• Reduces friction during validation processes and helps teams quickly locate evidence needed to confirm remediation or compliance steps.

Security Gate configuration and monitoring are now available directly inside the Conviso Platform interface, without relying on CLI configuration.

• Configure Security Gates directly within the CI/CD section of assets.
• Support for multiple vulnerability sources (Conviso AST, Dependency Track, Fortify, SonarQube, SonarCloud, Checkmarx, GitHub, Snyk, Veracode, and MobSF).
• Define severity thresholds per source and optional maximum days to remediate.
• Support for asset-specific policies that override global company rules.

Learn more in the Security Gate documentation.

Release date: February 2026

Key Benefits​

• ServiceNow Integration;
• Security Gate and GitHub Pull Request Scanning;
• Continuous SBOM Monitoring;
• DAST and AI Agent Improvements;
• Vulnerability Management and Platform Reliability;

Introduction​

Release 4.20 strengthened Conviso Platform as a unified AppSec hub, expanding enterprise integrations, developer workflows, security monitoring, and supply-chain visibility.

---

New Feature

ServiceNow Integration​

• Added native ServiceNow ITSM integration to create and update incidents from Conviso findings.
• Helps security and engineering teams operationalize remediation through established ITSM workflows.

---

New Feature

Security Gate and GitHub Pull Request Scanning​

• Introduced an in-platform Security Gate experience for monitoring and managing gate runs.
• Added Conviso AST checks and annotations for open GitHub pull requests, moving security feedback earlier into code review.

Learn more in the Security Gate documentation and GitHub Pull Request Scans documentation.

---

New Feature

Continuous SBOM Monitoring​

• Introduced SBOM correlation to improve consistency between Conviso AST and Platform monitoring.
• Expanded advisory coverage and reduced inconsistent finding lifecycle changes.

Learn more in the SBOM documentation.

---

Improvements

DAST and AI Agent Improvements​

• Expanded DAST API support for Swagger, GraphQL, and SOAP scenarios.
• Added Auto-Fix capabilities, DAST false-positive review support, and chat usability improvements for AI Agents.

---

Improvements

Vulnerability Management and Platform Reliability​

• Added bulk actions and improved filtering and navigation in vulnerability workflows.
• Improved scan lifecycle robustness, dashboard reliability, observability, and defect-tracker synchronization visibility.

👉 Access the Conviso Platform to explore these updates.

Improved the requirements and project workflows.

• Introduced Project Templates, enabling standardized project creation at scale.
• Added filter by Activity in project requirements, improving navigation and prioritization.
• Improved the requirements table to support searching by activity name.

Added support for running OWASP SAMM assessments directly inside Conviso Platform.

• Evaluate AppSec maturity, track progress over time, and compare assessments.
• Improves visibility for customer maturity programs and structured AppSec evolution.

New Security Gate experience in the platform to monitor and manage gate runs.

• Centralizes visibility into Security Gate executions under CI/CD > Security Gate.
• Helps teams standardize quality gates and governance across development pipelines.

Release date: December 2025

Key Benefits​

• Snyk Integration;
• Backstage Integration;
• Mobile Security Import (MobSF);
• Platform Stability & Reliability;
• Scanner Configuration & Execution Improvements;
• Remediation Prioritization Funnel;
• Vulnerability Management Enhancements;
• Improved User Experience & Navigation;
• Reporting & Data Consistency Improvements;

Introduction​

Release 4.19 delivers a major step forward in platform robustness, integration maturity, and ecosystem expansion.

In addition to a broad set of stability and usability improvements, this release introduces four strategic new features that significantly expand Conviso Platform’s integration capabilities—covering cloud security, SAST modernization, developer portals, and mobile security workflows.

Together, these updates reinforce Conviso Platform as a centralized, scalable, and integration-ready AppSec hub for modern security teams.

---

New Feature

Snyk Integration​

• Introduced native integration with Snyk Cloud, enabling visibility into cloud-native security findings directly within Conviso Platform.
• Expands coverage beyond traditional application scanning to include cloud posture and runtime-related insights.
• Strengthens Conviso’s role as a unified security aggregation layer across application and cloud security tools.

---

New Feature

Backstage Integration​

• Introduced a Backstage plugin to synchronize developer components as security assets in Conviso Platform.
• Supports both manual and automated imports, with background processing to avoid performance impact.
• Enables organizations to align AppSec visibility with their internal developer portals and service catalogs.
• Strengthens collaboration between security and engineering teams by integrating AppSec into existing developer workflows.

---

New Feature

Mobile Security Import (MobSF)​

• Added support for importing MobSF reports directly into Conviso Platform.
• Mobile security findings are processed asynchronously and appear in the platform using the same Scans and Vulnerability UI as native Conviso AST scans.
• Expands Conviso Platform’s coverage to mobile application security without requiring custom tooling.

---

Improvements

Platform Stability & Reliability​

• Improved overall platform resilience across core modules.
• Fixed multiple edge cases that could cause unexpected UI behavior or incomplete data loading.
• Reduced intermittent errors observed in long-running sessions and complex projects.

---

Improvements

Scanner Configuration & Execution Improvements​

• Increased reliability of scanner configuration screens, ensuring all options load correctly on first access.
• Fixed issues affecting scan scheduling, execution status visibility, and configuration persistence.
• Improved handling of scanner execution history and metadata.

---

Improvements

Remediation Prioritization Funnel​

• Updated the remediation funnel to reflect risk-based priority levels.
• Funnel stages were relabeled as Priority 0–4, focusing on what should be fixed first.
• False Positive and Fixed vulnerabilities are excluded, while Risk Accepted is now included.
• Provides a clearer and more actionable view for remediation planning.

Improvements

Vulnerability Management Enhancements​

• Improved consistency in vulnerability detail pages, including source code and file rendering.
• Fixed scenarios where vulnerability evidence or contextual data was not fully displayed.
• Enhanced reliability of vulnerability state transitions and associations with projects and assets.
• Improved handling of duplicated or correlated findings across scans.

---

Improvements

Improved User Experience & Navigation​

• Resolved UI inconsistencies affecting navigation between assets, projects, and vulnerabilities.
• Improved filter behavior and state persistence across sessions.
• Reduced cases of disappearing actions, buttons, or empty states during navigation.
• Overall smoother and more predictable interaction with the platform.

---

Improvements

Reporting & Data Consistency Improvements​

• Increased stability in report generation workflows.
• Fixed inconsistencies between platform data and exported reports.
• Improved handling of edge cases during report rendering, ensuring reliable output even for complex projects.
• Strengthened alignment between vulnerability data, timelines, and report content.

---

👉 Access the Conviso Platform to experience these updates.