Apiiro

No entries match these filters. Clear filters

1. 🚀 Asynchronous Explorer queries is now generally available Sep 28, 2026 · release notes

   Explorer now supports asynchronous background queries with no result limit and in-app notifications.

   • Adds the ability to run Explorer queries asynchronously in the background so users can continue working
   • Removes the previous 10,000-result limit for supported queries
   • Adds automatic in-app notifications when an asynchronous query finishes
   • Retains query results for 48 hours accessible via Recent explorations on the Explorer home page

   4 details in Everything

2. 🔍 Apiiro Feed is now generally available Sep 15, 2026 · release notes

   Apiiro Feed GA enables curated threat-intel posts mapped to inventory with workflow triggers

   • Adds Apiiro Feed as a generally available feature providing curated posts for emerging risks, inventory changes, posture shifts, and threat-intel incidents.
   • Enables following or dismissing Feed items and triggering workflows on new Feed items directly from the feed interface.
   • Displays Feed content on repository, application, and team profiles within Apiiro Explorer.

   3 details in Everything

3. 🔐 Workflows Updates: Exclude Repos, More Webhook Trigger Conditions, and Build Scan Enhancements Sep 6, 2026 · release notes

   New workflow scoping excludes repos/teams, webhook triggers for risk events, and build scan policy tags and failure actions.

   • Scopes workflows to exclude specific repositories, applications, or teams without rebuilding conditions
   • Adds policy tag scoping and Build Failure action triggers for Build Scan workflows

   2 details in Everything

4. 🔠 Language visibility for SAST risks Aug 3, 2026 · release notes

   Apiiro adds programming language visibility and filtering for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. risks

   • Adds a Language column to the SAST risks table in SAST security > Risks
   • Adds a new Language filter to the SAST risks UI
   • Adds Language as a queryable field in ApiiroQL for Risk Graph Explorer

   3 details in Everything

5. 📦 Container security & artifacts, leveled up Jun 28, 2026 · release notes

   New preview features for container security include dedicated risks dashboards, revived inventory filters, and automatic ownership mapping.

   • Adds dedicated container risks & dashboards with a funnel and filters for artifact version, scan origin, vulnerability identifier, and package manager
   • Revamps the Artifacts inventory to allow filtering by specific version and instantly viewing mapped repositories, applications, and teams
   • Enables automatic ownership linking of artifacts to their repository's application and team

   3 details in Everything

6. 🔒 New secret types detected - expect new findings in existing code Jun 22, 2026 · release notes

   Apiiro expands secrets detection to include Azure SAS, GCP service accounts, PuTTY keys and more.

   • Detects newly supported secret types including Azure Storage SAS tokens, GCP service account credentials, PuTTY private keys, Twilio Account SIDs, and Samsara API tokens.
   • Improves detection for Slack incoming webhooks, high-entropy KEY=value pairs, and passwords in IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. template defaults.

   2 details in Everything

7. 👁 Preview code snippets directly in risk pane Jun 16, 2026 · release notes

   New inline code preview capability in the risk pane for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., API security, pipeline misconfiguration, pipeline dependency, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. risks.

   • Adds inline code preview in the risk pane via the eye icon for Path or Introduced through fields
   • Enables global configuration of code snippet preview under Settings > Global

   2 details in Everything

8. 🔍 Monitor your repositories from application inventory Jun 14, 2026 · release notes

   Apiiro vMonitor repos: New UI allows toggling monitor status per repo/project in Application Inventory with bulk actions and pre-filtered views.

   • Adds View repos and View projects CTAs on the Application page that jump to the inventory, pre-filtered to repositories not monitored
   • Adds a monitoring toggle and row-level status indicators (Active, Archived, Inactive) for individual repositories in the Inventory table
   • Adds bulk select/deselect capability for repository monitoring controls in the Inventory table
   • Expands Connectors + Applications permission scope to include access to Monitor All functionality, previously locked to Global admins

   4 details in Everything

9. 🔐 Simplified permissions management for roles - Now in GA! May 10, 2026 · release notes

   Apiiro GA adds category-level role permissions with auto-updating sub-permissions and default read access.

   • Adds category-level control to roles for Risk, Inventory Management, User Management, Reports, and Governance, removing manual sub-permission configuration.

   1 detail in Everything

10. 🎯 Jira scoped token support Apr 19, 2026 · release notes

    Apiiro adds support for Jira API tokens scoped to specific permissions

    • Adds JIRA_API_TOKEN support with Jira scope restrictions for least-privilege integration

    1 detail in Everything

11. 🔗 Bi-Directional Jira Enhancements - Now in GA! Mar 2, 2026 · release notes

    Apiiro GA release adds automatic risk updates, custom closed statuses, Data Center support, and manual unlinking to its bi-directional Jira integration.

    • Adds automatic risk updates in Jira by allowing users to choose between adding a comment or fully updating the ticket description when risk attributes change
    • Adds ability to define custom closed status on risk resolution by configuring preferred Jira statuses for resolved, accepted, or ignored risks with built-in fallbacks
    • Adds Jira Data Center (On-Prem) support for the bi-directional Jira integration for versions v9.12 or later
    • Adds manual unlinking of Jira tickets from Apiiro risks

    4 details in Everything

12. 🚀 Introducing OSS Package Health Feb 24, 2026 · release notes

    Apiiro introduces OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Package Health SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. risk category with OpenSSF Scorecard and release recency analysis

    • Adds OSS Package Health as a new SCA risk category to triage dependencies based on operational health signals.
    • Enriches package insights with OpenSSF Scorecard metrics, release recency labels (Outdated, Stale, Mature), and popularity signals (GitHub stars, weekly downloads).

    2 details in Everything

13. ℹ️ Introducing the Informational risk level Feb 1, 2026 · release notes

    Apiiro adds an Informational risk level, excluding related risks from default score calculations.

    • New Informational risk level allows classifying risks that do not require immediate action
    • Risks can be classified as Informational via dedicated policies, manual update, or API

    2 details in Everything

14. 🚀 Org level API Inventory is now GA – Know Your API Attack Surface Jan 26, 2026 · release notes

    Apiiro org-level API Inventory is GA: central view of APIs linked to runtime endpoints with filtering by method, language, app, repo, insights, or team.

    • Introduces the Org level API Inventory feature for a centralized view of all detected APIs across the organization.
    • Enables mapping the real API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. by linking detected APIs to runtime endpoints from integrations like Akamai API Security or Salt Security.
    • Allows filtering and drilling down the inventory by HTTP method, language, app, repo, insights, or team for focused triage.

    3 details in Everything

15. 🚦 On-demand differential scanning via API is now available! Jan 26, 2026 · release notes

    Apiiro introduces on-demand differential scanning via API to evaluate code differences between commits or branches in CI/CD workflows.

    • Adds the ability to trigger on-demand diff scans via the Apiiro API, specifying targets by SHA, branch, or tag
    • Enables inclusion of third-party security findings in diff scans through the Apiiro Upload Findings API
    • Provides a dedicated Diff Scan Experience for tracking manual release risk assessments and scan results

    3 details in Everything

16. ✨ New experience for SCA security risks (OSS vulnerabilities) Dec 24, 2025 · release notes

    Apiiro introduces unified SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. deduplication, CVE pane with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. triage hints, and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4 support.

    • Adds automatic deduplication of vulnerability identifiers across multiple SCA vendors, consolidating them into a single view
    • Adds CVSS v4 support alongside existing CVSS v2 and v3 for severity scoring

    2 details in Everything

17. Manage compliance risk with Apiiro’s OSS licenses experience Dec 14, 2025 · release notes

    New default OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. license policies and detailed license inventory views.

    • Adds ability to view complete license details including type, terms of use, and OSI/FSF approval for each dependency.
    • Adds detection for edge cases such as missing, unknown, or multi-license packages within the license inventory.

    2 details in Everything

18. Now in GA – Stop PR Scans Instantly Dec 10, 2025 · release notes

    Apiiro GA introduces Killswitch to instantly stop PR scans across GitHub, GitLab, and Azure DevOps

    • Adds Global Stop killswitch to end validation for all active PRs in one click
    • Adds Selective Stop killswitch to unblock specific PRs via multi-select
    • Extends killswitch cross-platform support to GitHub, GitLab, and Azure DevOps

    3 details in Everything

19. 🚀 Know Your OSS Attack Surface: The Org-level dependencies Inventory is now in GA! Dec 4, 2025 · release notes

    Org-level dependencies Inventory is now GA with filtering by vulnerabilities, licenses, apps, repos, and teams.

    • Adds Org-level dependencies Inventory for a centralized view of all detected dependencies across repositories
    • Adds filtering capabilities to drill down dependencies by vulnerabilities, licenses, applications, repositories, or teams

    2 details in Everything

20. 💎 Now in GA: A new Network Broker is now available! Dec 3, 2025 · release notes

    Apiiro GA Network Broker introduces Connector experience, multi-agent deployment, wildcard support, and high availability.

    • Introduces the Connector experience for streamlined, self-service setup of the Network Broker
    • Adds support for multiple Broker Agents to manage several network environments simultaneously
    • Enables high availability and scalability by allowing deployment of multiple active instances
    • Adds wildcard host support (*.<domain>) to register a host and all its subdomains in one step
    • Allows side-by-side deployment with the legacy Broker for gradual transition

    5 details in Everything

21. 🔌 Connector health at a glance Nov 26, 2025 · release notes

    Track connector health directly from the Apiiro Dashboard with a new Connection status panel.

    • Adds a Connection status panel to the top left of the Dashboard showing connector health states: Partially functional or Non-functional.

    1 detail in Everything

22. ✨ Now in GA: Enhance Your SLA Policies with Apiiro's New Granular Control Nov 5, 2025 · release notes

    Apiiro introduces granular SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policies allowing specific per-team or per-application settings that override global defaults.

    • Adds the ability to create Specific SLA policies that automatically override Global SLA policies for a team or application
    • Enables setting specific SLA policies for each severity level via Granular Control
    • Allows targeting SLAs to specific assets using an explicit asset list or Application tags
    • Introduces an SLA Dashboard to track compliance levels by risk severity

    4 details in Everything

23. 🚀 Now in GA: Enhanced Developer Experience in PR Scans Nov 2, 2025 · release notes

    Apiiro GA enhanced PR scan UX with collapsible risk views and standardized finding formats

    • Adds collapsible risk views to pull request scans for a distraction-free review experience
    • Standardizes risk titles and templates across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Secrets, and API findings in PR scans

    2 details in Everything

24. 🛡 New Supply Chain Attack: Worm Malware in npm Packages Sep 17, 2025 · release notes

    New npm supply chain worm detection insights and remediation tools

    • Adds Malicious package insight filter in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. > Risks for detecting compromised dependencies.
    • Updates Risk Graph Explorer to support tracing dependency trees for affected services or repos.
    • Provides Malicious Code Ruleset for securing CI/CD stages against malicious payloads.
    • Introduces PRevent app to block malicious commits from being added to repositories.

    4 details in Everything

25. 📝 Manual findings entry is here! Sep 2, 2025 · release notes

    Apiiro adds manual findings entry via web UI form and CSV bulk upload for non-automated assessments.

    • Adds a new UI section to create, view, and manage manual findings directly in the Apiiro platform
    • Enables bulk uploading of manual findings using a CSV template alongside single-finding entry via a simple form

    2 details in Everything

26. 🔎 Connect your Bug bounty programs to Apiiro! Aug 7, 2025 · release notes

    Adds native integrations for HackerOne and Bugcrowd bug bounty programs to centralize findings

    • Integrates bug bounty findings from HackerOne into Apiiro
    • Integrates bug bounty findings from Bugcrowd into Apiiro

    2 details in Everything

27. 🎯 Enhanced Inventory Dashboard for Better Oversight Jul 14, 2025 · release notes

    Enhanced inventory dashboard adds overview tiles for repositories, APIs, and OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. packages with trend analysis and anomaly-highlighting treemap.

    • Adds Inventory at a Glance overview tiles for Repositories, APIs, OSS Packages, Technologies with growth trends.
    • Adds an interactive treemap to the Inventory Dashboard that breaks down technologies by type (e.g., GenAI, Logging) and highlights anomalies.
    • Enables tracking of trends in sensitive APIs, inactive contributors, and data exposure within the Inventory Dashboard.

    3 details in Everything

28. 🎛 Take Charge with Custom SAST Risk Policies Jul 13, 2025 · release notes

    Apiiro adds Custom SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. Risk Policies in Explorer to filter findings, assign risk levels, and flag toxic combos

    • Adds ability to create and manage custom SAST risk policies directly in the Apiiro Explorer UI.
    • Introduces filtering capabilities to exclude non-security findings (bugs, performance issues) from SAST results.
    • Enables assignment of risk levels based on finding likelihood or OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 classification.
    • Adds detection logic to highlight toxic combos where SAST findings are in applicative code, API-related, and internet-exposed.

    4 details in Everything

29. 💡 Govern your code: enforce branch protection with Apiiro Jul 9, 2025 · release notes

    Apiiro now monitors minimum code reviewers and GitHub's Require Approval of the Most Recent Reviewable Push branch protection setting via Apiiro Explorer.

    • Adds monitoring for minimum required code reviewers per branch to generate risk alerts when policies are violated
    • Adds detection of the GitHub Require Approval of the Most Recent Reviewable Push rule status in Apiiro Explorer

    2 details in Everything

30. 📦 Now in GA: Enhanced vulnerability detection & insights for unmanaged packages with Apiiro’s SCA! Jul 8, 2025 · release notes

    GA: enhanced vulnerability detection & insights for unmanaged packages in Apiiro's SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.

    • Adds support for scanning unmanaged package artifacts (.jar, .dll, .war, .ear) via Apiiro's SCA.
    • Adds the packageOrigin property to the Explorer view for locating bundled packages across your organization.
    • Expands supported dependency formats to include deps.json and pnpm in the support matrix.

    3 details in Everything

31. ✨ Supercharge Your Risk Detection with Explorer Policies Jul 8, 2025 · release notes

    Adds Explorer Policies in Risk Graph Explorer for custom risk detection, classification, and automated mitigation workflows.

    • Adds Explorer Policies created via the Risk Graph Explorer to identify and classify complex risk scenarios
    • Allows assigning clear risk levels, categories, and dynamic descriptions through new policy conditions
    • Enables triggering automated workflows and threat mitigation actions based on Explorer Policies

    3 details in Everything

32. 🏰 Secure your code: Malicious package detection Jun 5, 2025 · release notes

    Apiiro adds malicious open-source package detection with automated PR blocking

    • Adds detection of malicious open-source packages with detailed malware information in Apiiro’s SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. solution
    • Enables automatic safeguard workflows to block malicious packages in pull requests

    2 details in Everything

33. 👥📊 Introducing the Custom Reports workspace! Apr 7, 2025 · release notes

    Apiiro vIntroducing adds the Custom Reports workspace with query builder, multi-filter selection, and saved personal collections

    • Adds Custom Reports Workspace providing an intuitive query builder for tailored report creation
    • Adds ability to save pre-filtered reports into personal collections for organization and quick access
    • Adds multi-filter selection capability across reports in the Custom Reports Workspace

    3 details in Everything

34. 🔧 Effortless Managed Semgrep configuration: Now in your Settings Mar 3, 2025 · release notes

    New Settings UI for Managed Semgrep configuration (scan toggle, ruleset customization) without API calls

    • Adds Managed Semgrep settings page in the app UI enabling on/off toggle and ruleset customization via intuitive interface
    • Removes requirement for manual API calls to configure Managed Semgrep scanner settings

    2 details in Everything

35. ⛓ ✨ Native Software Supply Chain Security is GA! Mar 3, 2025 · release notes

    Apiiro GA adds native Software Supply Chain Security with new dashboard and risk detection for CI/CD pipelines and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. repos

    • Adds Supply Chain Security Dashboard and Supply Chain Security Risks pages to view supply chain coverage and risks in the context of application risk landscape.
    • Enables detection of risks in GitHub & GitLab, including weak branch protection rules and permissions.
    • Detects pipeline misconfigurations and dependency vulnerabilities within CI/CD pipelines and SCM repositories.
    • Adds workflow triggers for SSCS risks, abnormal commit activity, and pipeline config file changes.

    4 details in Everything

36. 🚥 Introducing Asset-based Risk Scores: Track, compare, and prioritize Risk Feb 25, 2025 · release notes

    Apiiro introduces Asset-based Risk Scores with numeric scores, percentile ranks, and configurable severity weighting.

    • Adds Asset-based Risk Scores that provide a daily numeric risk score for assets.
    • Enables cross-asset comparison using a daily calculated percentile rank.
    • Introduces risk score settings to configure adjustable weighting factors per severity level.

    3 details in Everything

37. 🧑‍💻📂 Enhanced Application Creation Form! Jan 27, 2025 · release notes

    Apiiro GA's enhanced application creation form with tag-based asset allocation

    • General availability of the new application creation form UI for smoother setup

    1 detail in Everything

38. 🌪️ Prioritize OSS risks with the Used in code insight, now GA Jan 20, 2025 · release notes

    GA release of Used in code insight to filter dormant vs. active SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. risks via UI

39. 🚀 New Reports & Daily Trend Monitoring Jan 7, 2025 · release notes

    Apiiro adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., API Security, and SSCS reports with daily open risk trend tiles for remediation tracking.

    • Adds SAST Report to track SAST risks and their remediation progress
    • Adds API Security Report to gain insights into API risks and monitor remediation efforts
    • Adds SSCS Report to track supply chain risks and their mitigation trends

    3 details in Everything

40. 🧠 Enhanced Generative AI Discovery & Governance Jan 6, 2025 · release notes

    Adds Inventory > Technologies view for GenAI models/datasets and Risk Graph Explorer for sensitive data tracing

    └──▷ HOW TO FIND IT
    Navigate to the new inventory view to audit all detected GenAI assets.
    📍Inventory › Technologies
    Use the risk graph to map code modules that expose sensitive data via GenAI interfaces.
    📍Risk Graph Explorer
    • Adds Inventory > Technologies page to identify Generative AI models and datasets
    • Adds Risk Graph Explorer to trace sensitive data usage within code modules leveraging GenAI

    2 details in Everything

41. 👥 Introducing Teams: Align with your organizational structure Dec 23, 2024 · release notes

    Apiiro introduces Teams feature with hierarchical structure support, tag-based asset allocation, and per-team dashboard filtering.

    • Adds Teams as a new organizational unit supporting unlimited hierarchical layers for aligning with company structure
    • Enables automated asset allocation using GitHub/GitLab topics or custom-created tags within Teams
    • Allows filtering data per team in dashboards and coverage views to report on risk remediation trends by teams

    3 details in Everything

42. 📊📢 Unlock Insights with the New Apiiro Licensing Report Oct 30, 2024 · release notes

    New Apiiro Licensing Report adds Active Developer Monitoring, Developer Activity Trends, and Detailed Developer Insights

    • Adds a new Licensing Report for monitoring active developer counts against license limits
    • Adds Developer Activity Trends analysis over the last 180 days to understand engagement patterns
    • Adds access to a complete list of active developers with their last activity date and commit count

    3 details in Everything

43. 🚦 Improved granularity for Risk Status and Risk Level management Oct 15, 2024 · release notes

    Apiiro v2 decouples Risk Status from Risk Level with new management via the Risk pane and All-Risks tables.

    • Adds independent management of Risk Status and Risk Level via the Risk pane and All-Risks tables
    • Retains Risk Level when dismissing a risk (accept/ignore)
    • Tracks all changes in the Risk Timeline and Audit log

    3 details in Everything

44. ♾️ 🚀 Managed Semgrep is now in GA! Sep 8, 2024 · release notes

    Apiiro introduces GA for Managed Semgrep to orchestrate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. across applications with deep context enrichment.

    • Adds the ability to centrally execute and configure Semgrep analysis for all applications within a single pane of glass.
    • Enables automatic enrichment of Semgrep findings with Apiiro's deep application context, including code ownership, business impact, and internet exposure.
    • Supports running Semgrep scans in pull requests via the Apiiro platform's workflow integration.

    3 details in Everything

45. ASPM 🤝secure code training Aug 19, 2024 · release notes

    Apiiro adds Secure Code Warrior integration for just-in-time secure code training within AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. workflows.

46. 🏷️ Elevate your security management with custom tagging Aug 15, 2024 · release notes

    Apiiro adds custom tagging for applications and repositories with UI/API support and tag-based filtering

    • Adds Repository Tags that accept imported tags from GitHub topics, GitLab topics, and GitLab CI/CD variables.
    • Adds Application Tags within the app profile and during application creation.
    • Enables Flexible Tag Management through the UI with continued API support.
    • Enhances Filtering to use tags on dashboards, risk tables, and coverage tables.
    • Allows Tag-Based Explorer Query and Policy Creation using app-repo tags.

    5 details in Everything

47. 🔌 Explore the new Connectors Page Jul 31, 2024 · release notes

    Apiiro introduces a revamped Connectors Page UI for managing and previewing integrations.

    • Adds a new Connectors Page in the UI to browse integrations by category, check connector health status, and view upcoming integration previews.
    • Enables users to request new integrations directly from the Connectors Page interface.

    2 details in Everything

48. 🔍 New SAST experience Jul 15, 2024 · release notes

    Apiiro adds new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. dashboard/risk page and a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to export findings, moving API code risks out of the API security table.

    • Adds a new SAST dashboard and risks page in the sidebar for better visibility, prioritization, and remediation guidance of source code findings
    • Adds filtering by compliance standard on the SAST risk views to support audit assurance workflows
    • Introduces a new REST API endpoint to export SAST findings for broader extensibility
    • Moves risks in APIs detected in code to the new SAST experience instead of listing them in the API security table

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The component field now contains the code file where the finding was identified, instead of the previous value
    • !SAST risks related to APIs will no longer be listed in the API security table
49. 📄Unlock vulnerability insights with the new CVE report! Jul 15, 2024 · release notes

    Apiiro adds a new CVE report with remediation trends, reachability insights, and risk charts.

    • Introduces the CVE report to track vulnerability remediation trends including open vs resolved risks by criticality and Mean Time to Remediate (MTTR)
    • Adds deep insights on vulnerabilities leveraging unique reachability insights for crucial applications and packages
    • Provides a vulnerability risk chart identifying top vulnerabilities by EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., and risk mass metrics
    • Enhances filtering capabilities to drill down into specific CVEs using exploitability and reachability insights

    4 details in Everything

50. 🌎❗Visualize risk exposure Jun 3, 2024 · release notes

    Apiiro adds visual exposure path tracking for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., Secrets, SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and API risks across SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after..

    • Adds visual exposure path tracing for SCA, Secrets, SAST and API risks to map risk from code to runtime
    • Enables visualization of risk exposure using insights from K8s, cloud and API security tools

    2 details in Everything

51. 🎯 You’re in control with risk-level overrides and custom SLAs May 15, 2024 · release notes

    Adds custom SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policies, risk-level overrides, MTTR dashboard tiles, and risk comments.

    • Enforces remediation timelines with new custom SLA policies that administrators can define and filter by due date
    • Allows adjustment of a specific issue's risk level via risk-level overrides to align with organizational needs
    • Displays new MTTR and Risks by Age tiles on the dashboard for benchmarking against SLAs
    • Enables adding comments to risks for team triage and tracking changes in the audit log

    4 details in Everything

52. 🛡️🔌 Connect your on-premise resources to Apiiro! May 2, 2024 · release notes

    Apiiro introduces a new Network Broker to connect on-premise resources for enhanced attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility

    • Adds the Network Broker capability to securely connect on-premise resources to Apiiro SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..
    • Enables comprehensive visibility and coverage across the entire attack surface, including internal-only network resources.

    2 details in Everything

53. 🔐 Secrets detection enhancements Mar 20, 2024 · release notes

    Apiiro adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. parsing, XML/JSON tuning, and 20+ new secret detectors.

    • Adds a new parser for JWT (JSON Web Tokens) with insights into payload sensitivity, expiration status, and hashing algorithm
    • Fines tunes parsing algorithms for XML and JSON files to detect previously overlooked secrets
    • Releases 20+ new secrets detectors including Atlassian access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., Adobe client ID, PagerDuty API key, Travis CI access token, and Flickr API Key

    3 details in Everything

54. 💣💥 New EPSS and Exploit POC Insights Mar 17, 2024 · release notes

    Apiiro enriches open source vulnerability findings with exploitability context to improve prioritization.

55. 📃🪵 Audit log is now available! Mar 12, 2024 · release notes

    Apiiro adds an Audit Log feature accessible via Settings with CSV export and Splunk integration.

    • Adds Settings > Audit log UI page to view user and system activity events
    • Enables exporting audit log events as a CSV file
    • Supports pushing audit log events to a Splunk environment

    3 details in Everything

56. 🔇🙈🙊 Introducing Secrets Exclusion Jan 30, 2024 · release notes

    Apiiro introduces secrets exclusion to filter test tokens by path or pattern

    • Allows excluding specific secrets from generating alerts and dashboard risks based on file paths, patterns, applications, or repositories.

    1 detail in Everything

57. 🌲 Dependency path view for clearer visibility Jan 30, 2024 · release notes

    Apiiro adds dependency path visibility and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. access for transitive vulnerabilities

    • Adds a new UI view showing all dependency paths to a vulnerable package and which top-level dependencies contain vulnerable sub-dependencies.

    1 detail in Everything

58. 💡 Meet the new Explorer! Jan 4, 2024 · release notes

    Introduces the Apiiro Risk Graph Explorer for querying attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. risk via a new interface.

    • Adds the Apiiro Risk Graph Explorer interface to ask and answer complex security questions about contributors, behavior, and risk.

    1 detail in Everything

59. 🧠💻 Apiiro now detects shadow GenAI Dec 7, 2023 · release notes

    Apiiro adds automatic detection of GenAI frameworks to help identify shadow GenAI risk in codebases.

    • Adds automatic identification of GenAI frameworks used across your codebase
    • Enables filtering inventory by GenerativeAI under Inventory > Applications/Repos > Technologies
    • Enables filtering the Explorer by GenAI technologies

    3 details in Everything

60. Get alerted when valid secrets are detected and revoked 🛎️ Dec 5, 2023 · release notes

    Apiiro now supports targeted alerts for detected and revoked valid secrets

    • Adds the ability to set alerts exclusively when valid secrets are detected and revoked.
    • Enables blocking PR merge requests that contain valid secrets.
    • Prioritizes valid secrets as having critical risk in the detection engine.
    • Notifies users when a secret transitions from valid to invalid or revoked status.
    • Tracks valid status change events in the timeline.

    5 details in Everything

61. Maximize coverage via API 🛡️ Nov 27, 2023 · release notes

    Apiiro introduces a new API to list security tool projects and their repository mappings for coverage tracking.

    • Adds a new API endpoint allowing retrieval of all security tool projects mapped to repositories, mirroring Connectors page data with additional matched applications.

    1 detail in Everything

62. 🚗💎🚗 SCA support for Cargo and Gemfile Sep 21, 2023 · release notes

    Apiiro adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. support for Ruby (Gemfile.lock) and Rust (Cargo.toml/lock) with development dependency detection

    • Adds SCA analysis for gemfile.lock to detect vulnerabilities and licenses in Ruby projects
    • Adds SCA analysis for Cargo.toml and Cargo.lock to detect vulnerabilities, licenses, and package insights in Rust projects
    • Introduces development environment identification to deprioritize risk for packages that do not reach production

    3 details in Everything

63. 📦⚠️ Package risk change alerts Sep 18, 2023 · release notes

    Apiiro adds alerts for risk changes in OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. dependencies including new CVEs and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score updates.

    • Alerts the team when a new vulnerability is detected in an open source dependency
    • Alerts when the CVSS score changes on a known CVE related to an open source package
    • Provides actionable remediation and mitigation steps based on updated severity assessments

    3 details in Everything

64. 💻❗Deprecation of Secrets v1 API Sep 13, 2023 · release notes

    Apiiro introduces Secrets REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. (v2) with broader fields.

    • Introduces Secrets REST API (v2) for access to broader fields and functionalities including secretType and secretDigest.
    • Refines secrets property terminology in the new API response to be more intuitive.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Secrets REST API (v1) is deprecated and will stop functioning within 90 days; users must migrate to v2.
65. 🦊 Integrate your GitLab Dependency Scanning (SCA), SAST and DAST findings Sep 10, 2023 · release notes

    Apiiro adds native integration for GitLab Dependency Scanning (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.), SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings with code-to-runtime context.

    • Adds integration for GitLab Dependency Scanning (SCA) findings into All Risks, SCA Risks, and Coverage pages
    • Adds integration for GitLab SAST findings into All Risks and Coverage pages
    • Adds integration for GitLab DAST findings into All Risks, API Security, and Coverage pages
    • Enriches connected GitLab findings with code-to-runtime context including code ownership, business impact, and internet exposure

    4 details in Everything

66. 👯 👊 Fight secret sprawl with secrets grouping Sep 10, 2023 · release notes

    Apiiro adds secrets grouping to reduce sprawl and streamline remediation.

    • Groups multiple occurrences of the same secret together for bulk management.

    1 detail in Everything

67. 🦈 Hunt known exploitable vulnerabilities in your code Jul 26, 2023 · release notes

    Apiiro integrates CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. catalog for exploit prioritization

    • Adds ability to use CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. insights as filters in the risk page.
    • Adds ability to use CISA KEV insights as filters in governance rules.

    2 details in Everything

68. 🤝 Better together: Your CodeQL results in Apiiro Jun 12, 2023 · release notes

    Apiiro integrates with GitHub CodeQL to automatically ingest vulnerability findings.

    • Ingests GitHub CodeQL results into the Apiiro platform

    1 detail in Everything

69. 🚀 Extended context for tickets, alerts, and notifications Jun 12, 2023 · release notes

    Enhanced ticket and alert context capabilities. No new detection rules or integrations added.

    • Context auto-population for tickets and alerts.

    1 detail in Everything

70. 🧠 Smart tables are here! Jun 5, 2023 · release notes

    Apiiro introduces Smart tables with interactive column management capabilities

    • Adds the ability to sort columns within Apiiro tables
    • Allows users to add and remove specific columns in table views
    • Enables pinning of columns to keep them visible during scrolling
    • Supports resizing columns for better data readability
    • Permits dragging and reordering columns to customize table layout

    5 details in Everything

71. 🛡️ Introducing the API Security page May 24, 2023 · release notes

    Apiiro adds an API Security page for holistic API risk view and prioritization