Checkmarx

No entries match these filters. Clear filters

1. What the PHP Patch Scramble Reveals About Remediation (2026-10-29) Oct 29, 2026 · issue 125

   Checkmarx adds AI-assisted triage, automated remediation suggestions, and a Fusion SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine that combines rule-based analysis with frontier-model reasoning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   After enabling automated remediation, configure scope so fixes are queued the moment a scan finishes — no manual request per finding.
   📍In Checkmarx One, go to Settings › Automated AI Remediation, set the target projects, branches, scanners, and severity thresholds, then enable Generate fix after scan completes.
   • Checkmarx adds Fusion SAST, combining established security analysis with frontier-model reasoning and a Findings Analysis Engine that consolidates results to reduce false positives and duplicate findings, reaching an F1 score of 0.74 versus 0.64 for the Next-Gen SAST foundation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Checkmarx adds Triage Assist (AI Triage) to evaluate whether a finding is reachable and exploitable, automatically setting a finding's state to Confirmed or Proposed Not Exploitable with reasoning visible in Risk Orchestration.
   • Checkmarx adds automated AI remediation support via Remediation Assist, letting admins define the projects, branches, scanners, and severity thresholds in scope so suggested fixes are generated automatically after a scan or automated triage completes.
   • Checkmarx adds project overrides so individual teams can adapt automated remediation settings where permitted.
   • Checkmarx adds Developer Assist to bring security analysis and remediation guidance into IDE and AI coding workflows, including supported autonomous workflows where it works with the coding agent to repeat remediation and rescanning.

   5 details in Everything

2. docs update Sep 30, 2026 · issue 090

   Checkmarx One 3.67 adds automated AI remediation, bulk triage, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. API Security support, and async CSV export for imports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Configure Auto Remediation so Checkmarx One automatically generates AI fixes and opens GitHub PRs for high-and-above SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings on your main branch after each scan.
   📍In Checkmarx One, go to Account Settings › AI Assist › Auto Remediation. Select the target projects and branches, enable SAST and SCA scanners, set the severity threshold, and save. Checkmarx One will open pull requests with AI-suggested fixes on GitHub after each qualifying scan completes.
   • Adds projects.delete event logging to the Audit Trail API, so project deletions are now captured in audit records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Auto Remediation configuration under Account Settings > AI Assist, where you define projects, branches, scanners (SAST and SCA), and severity thresholds — once enabled, Checkmarx One automatically generates AI fix suggestions and, for GitHub Code Repository Integration projects, opens a pull request with the fix after each scan.
   • Adds bulk triage in Risk Orchestration, letting you select multiple risks via checkboxes in the risk table and apply severity, state, change log, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. parameter updates across all selected risks — including risks from different scanners — in a single Triage action.
   • Extends Exemption Rules to scans triggered via the CLI in Azure DevOps pipelines, so break-build policy evaluation honors exempt-state configuration from Policy Management regardless of trigger method.
   • Extends break-build Exemption Rules to CLI-triggered scans across all SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. platforms, not just the pull request decoration flow.

   +6 more show less

   • Adds asynchronous CSV export for the imports table in Bring Your Own Results, allowing large exports to be processed in the background and downloaded once ready.
   • Adds an Internet-Facing badge in the Risk Orchestration unified project table for projects identified as publicly accessible, sourced from Cloud Insights (requires a configured Cloud Insights integration).
   • Extends the Checkmarx MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. to support API Security, enabling AI coding assistants and chat clients (Claude Code, Cursor, Windsurf, Copilot CLI) to query API risks, exposed APIs, and shadow/zombie/undocumented APIs.
   • Expands MCP Server triage tool support to IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Security and Secrets scanners, bringing them to parity with existing SAST and SCA triage support.
   • Extends Scheduled Scans to cover all Code Repository Integration projects, enabling consistent automated scan coverage across the full project portfolio.
   • Improves repository URL synchronization for Code Repository Integration Projects so the URL is automatically reflected in both Project and Project Settings API responses on create or update, with no manual sync needed.
   • Adds projects.delete event logging to the Audit Trail API, so project deletions are now captured in audit records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Auto Remediation configuration under Account Settings > AI Assist, where you define projects, branches, scanners (SAST and SCA), and severity thresholds — once enabled, Checkmarx One automatically generates AI fix suggestions and, for GitHub Code Repository Integration projects, opens a pull request with the fix after each scan.
   • Adds bulk triage in Risk Orchestration, letting you select multiple risks via checkboxes in the risk table and apply severity, state, change log, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. parameter updates across all selected risks — including risks from different scanners — in a single Triage action.
   • Adds asynchronous CSV export for the imports table in Bring Your Own Results, allowing large exports to be processed in the background and downloaded once ready.
   • Adds an Internet-Facing badge in the Risk Orchestration unified project table for projects identified as publicly accessible, sourced from Cloud Insights (requires a configured Cloud Insights integration).

   6 more in Everything

3. docs update Sep 24, 2026 · issue 084

   Checkmarx 3.66 adds Global Inventory API, native SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reachability, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. triage, manual test result import, and UV package manager support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a public Global Inventory API that retrieves packages, risks, and license data aggregated across an account, filtered by project, application, severity, or exploitability, with pagination; authenticated via platform API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --skip-default-filter CLI flag to bypass default file-inclusion filters and include all files in the scanned .zip archive.
   • Adds *.tfvars and *.tfbacken file extensions to the list of supported files included in scanned .zip archives.
   • Adds Risk Triage via MCP Server, allowing developers to change a risk's state and severity directly from an AI assistant without opening Checkmarx One, across all major scan engines.
   • Adds a setting for admins to hide the raw API key in copy-command outputs, replacing it with CLIENT_ID/CLIENT_SECRET placeholders for OAuth-authenticated teams.
   • Adds a public Global Inventory API that retrieves packages, risks, and license data aggregated across an account, filtered by project, application, severity, or exploitability, with pagination; authenticated via platform API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --skip-default-filter CLI flag to bypass default file-inclusion filters and include all files in the scanned .zip archive.
   • Adds Risk Triage via MCP Server, allowing developers to change a risk's state and severity directly from an AI assistant without opening Checkmarx One, across all major scan engines.
   • Adds a setting for admins to hide the raw API key in copy-command outputs, replacing it with CLIENT_ID/CLIENT_SECRET placeholders for OAuth-authenticated teams.

   1 more in Everything

4. docs update Sep 24, 2026 · issue 084

   Checkmarx adds AI Auto Remediation, bulk triage, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. API Security support, async CSV export, and broader Exemption Rules coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Triage a large backlog of mixed SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. risks in one pass — select all and apply state, severity, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. updates simultaneously.
   📍In Risk Orchestration, check the boxes next to all target risks in the risk table (across scanner types as needed), then select Triage from the bulk action toolbar and apply severity, state, change log, and VEX parameters in the single editor.
   Enable AI Auto Remediation for high-severity SAST and SCA findings on a specific project and branch so pull requests are opened automatically after each scan.
   📍In Account Settings › AI Assist › Auto Remediation, define the target projects and branches, select SAST and SCA as the enabled scanners, set the severity threshold, and optionally allow project-level overrides.
   • Adds automated AI Remediation configured in Account Settings under AI Assist, with controls for projects, branches, scanners (SAST and SCA), severity thresholds, and project-level override permissions; for supported GitHub Code Repository Integration projects, opens a pull request with the suggested fix automatically after a scan completes.
   • Expands MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. triage tools support to IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Security and Secrets scanners, bringing them to parity with existing SCA and SAST triage support.
   • Adds an Internet-Facing badge in the Risk Orchestration unified project table for projects identified as publicly accessible, sourced from Cloud Insights integration data.
   • Adds automated AI Remediation configured in Account Settings under AI Assist, with controls for projects, branches, scanners (SAST and SCA), severity thresholds, and project-level override permissions; for supported GitHub Code Repository Integration projects, opens a pull request with the suggested fix automatically after a scan completes.
   • Adds an Internet-Facing badge in the Risk Orchestration unified project table for projects identified as publicly accessible, sourced from Cloud Insights integration data.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The /presets API has reached end-of-life and will be removed entirely soon; migrate all workflows to the /preset-manager API.
5. docs update Sep 23, 2026 · issue 083

   Checkmarx One adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. risk triage, UVUVA Python package and project manager written in Rust, maintained by Astral, that resolves and installs dependencies far faster than pip, making it attractive for cyber tools with heavy Python dependency trees. Python resolver, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine 9.7.7 rollout⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds UV Resolution setting at the tenant or project level to use UV for resolving Python projects, with pip remaining the default; results including vulnerabilities, license findings, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports display consistently with other supported Python package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables changing a risk's state and severity directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server — marking findings such as Not Exploitable or Confirmed from an AI assistant using natural language, spanning all major scan engines.
   • Upgrades the SAST engine to version 9.7.7, rolling out gradually.
   • Upgrades AI Triage and AI Remediation agents for improved accuracy and performance, applied automatically.
   • Adds UV Resolution setting at the tenant or project level to use UV for resolving Python projects, with pip remaining the default; results including vulnerabilities, license findings, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports display consistently with other supported Python package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables changing a risk's state and severity directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server — marking findings such as Not Exploitable or Confirmed from an AI assistant using natural language, spanning all major scan engines.

   2 more in Everything

6. docs update Sep 23, 2026 · issue 083

   Checkmarx One adds bulk triage, automated AI remediation, API Security in MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., and Codex/Gemini CLI dependency scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Clear a large triage backlog by bulk-updating severity, state, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. parameters across multiple risks at once in Risk Orchestration.
   📍In Checkmarx One, go to Risk Orchestration › select risks using checkboxes in the risk table (across any scanners) › click Triage in the bulk action toolbar › set severity, state, change log, and any VEX parameters for SCA risks › apply.
   • Adds projects.delete event logging to the Audit Trail API, tracking project deletion actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends Exemption Rules support to CLI-triggered scans in Azure DevOps pipelines, so break-build policy evaluation honors exempt-state configuration from Policy Management for CLI workflows.
   • Extends break-build Exemption Rules to CLI scans across all SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. platforms, ensuring exempted findings are excluded from break-build results regardless of SCM platform or evaluation flow.
   • Adds API Security support to the Checkmarx MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, letting AI coding assistants (Claude Code, Cursor, Windsurf, Copilot) query API risks including undocumented, shadow, and zombie APIs.
   • Adds manifest and lockfile change gate for Codex CLI and Gemini CLI via Dev Assist, scanning dependency changes for vulnerable and malicious packages before they are written to the file system.

   +6 more show less

   • Adds asynchronous CSV export for the imports table in Bring Your Own Results, processing large exports in the background and making the file downloadable from the imports table when ready.
   • Adds automated AI-driven remediation via Remediation Assist across all risks in Checkmarx One as part of Risk Orchestrator, expanding beyond pull request-triggered scans.
   • Adds an Internet-Facing badge to risks in Risk Prioritization, indicating when the affected asset is exposed to the internet.
   • Adds bulk triage to Risk Orchestration, letting you apply severity, state, change log, and VEX parameter updates to multiple risks (including across different scanners) in a single action.
   • Expands scheduled scans to support all Code Repository Integration projects.
   • Improves repository URL synchronization for Code Repository Integration projects so the URL is automatically reflected in both the Project and Project Settings API responses on create or update.
   • Adds projects.delete event logging to the Audit Trail API, tracking project deletion actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds API Security support to the Checkmarx MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, letting AI coding assistants (Claude Code, Cursor, Windsurf, Copilot) query API risks including undocumented, shadow, and zombie APIs.
   • Adds manifest and lockfile change gate for Codex CLI and Gemini CLI via Dev Assist, scanning dependency changes for vulnerable and malicious packages before they are written to the file system.
   • Adds asynchronous CSV export for the imports table in Bring Your Own Results, processing large exports in the background and making the file downloadable from the imports table when ready.
   • Adds an Internet-Facing badge to risks in Risk Prioritization, indicating when the affected asset is exposed to the internet.

   +1 more show less

   • Adds bulk triage to Risk Orchestration, letting you apply severity, state, change log, and VEX parameter updates to multiple risks (including across different scanners) in a single action.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The /presets API has been announced as end-of-life and will soon stop being supported entirely; migrate all workflows to /preset-manager before the cutoff.
7. docs update Sep 23, 2026 · issue 083

   Checkmarx: Adds a public Global Inventory API that programmatically retrieves packages, risks, and license data aggregated across an account, filtered by project, application, severity, or exploitability, with pagination; authenticated via platform API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role for controlling access to each DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI feature independently.
   • Adds UV Resolution setting at the tenant or project level so SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. uses the UV Python package manager for dependency resolution instead of pip.
   • Adds support for importing manual testing results via CLI or a JSON file, unifying manual and automated (ZAP) findings in a single scan view with UI filtering, report inclusion, and CLI-based overrides.
   • Adds token-based authentication support for Bitbucket Cloud (previously only available for on-prem Bitbucket) via the custom setup flow.
   • Adds Application Association Enforcement for Projects, which rejects project creation or updates that would leave a project without an application association, enforced across API, CLI, Import API, migration, Code Repository Integration, and webhook-created repositories.

   +11 more show less

   • Adds Git Commit ID Scan Tagging so push- and pull-request-triggered scans are automatically tagged with the associated commit ID, configurable via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. setup flow, project settings, or project migration.
   • Adds a native Reachability Analysis engine in SCA that runs independently of the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine, adding a Reachability column with statuses Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed; supports Python, Java, JavaScript, and C# for direct dependencies.
   • Adds OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.-Realtime scanner support for RubyGems, Composer, Yarn, and Bower package managers in the Developer Assist CLI plugin.
   • Adds two new tables — Results Distribution by Status and Results Distribution by State — to the Scan Report's Scan Results Overview section, included in both PDF and JSON exports.
   • Adds AI Triage and Remediation support for SCA risks on the Risk Orchestration screen, matching the existing SAST experience.
   • Adds triggering user identity and a link to the AI Triage insight to the Changelog for every AI-driven state change in SAST and SCA findings, covering manual, auto-triage, and bulk triage executions.
   • Adds API Security engine vulnerability data to Analytics, including severity and state changes reflected in dashboard KPIs, charts, and summary counters.
   • Adds package name and version to SCA vulnerability listings alongside the CVE identifier wherever CVE-based vulnerabilities are listed, ranked, or broken down.
   • Adds hybrid SAST scanning that automatically routes code to the traditional query-based engine or an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based engine based on language support, with an opt-in/opt-out toggle tied to the AI Usage setting in Global Settings.
   • Enables persistent, shareable Dashboard filter links so a filtered view can be captured and shared without recipients needing to recreate the same filter selections.
   • Adds an admin setting that replaces the raw API key in copied scan-trigger commands with CLIENT_ID/CLIENT_SECRET placeholders for teams authenticating via OAuth.
   • Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role for controlling access to each DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI feature independently.
   • Adds support for importing manual testing results via CLI or a JSON file, unifying manual and automated (ZAP) findings in a single scan view with UI filtering, report inclusion, and CLI-based overrides.
   • Adds Application Association Enforcement for Projects, which rejects project creation or updates that would leave a project without an application association, enforced across API, CLI, Import API, migration, Code Repository Integration, and webhook-created repositories.
   • Adds Git Commit ID Scan Tagging so push- and pull-request-triggered scans are automatically tagged with the associated commit ID, configurable via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. setup flow, project settings, or project migration.
   • Adds a native Reachability Analysis engine in SCA that runs independently of the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine, adding a Reachability column with statuses Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed; supports Python, Java, JavaScript, and C# for direct dependencies.

   +3 more show less

   • Adds hybrid SAST scanning that automatically routes code to the traditional query-based engine or an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based engine based on language support, with an opt-in/opt-out toggle tied to the AI Usage setting in Global Settings.
   • Enables persistent, shareable Dashboard filter links so a filtered view can be captured and shared without recipients needing to recreate the same filter selections.
   • Adds an admin setting that replaces the raw API key in copied scan-trigger commands with CLIENT_ID/CLIENT_SECRET placeholders for teams authenticating via OAuth.

   8 more in Everything

8. docs update Sep 19, 2026 · issue 079

   Checkmarx One gains Software Supply Chain Security module with secrets detection and repository health scoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Software Supply Chain Security (SCS) module to Checkmarx One, with a secrets scanner that identifies 170+ types of login credentials, access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., encryption keys, API keys, SSH keys, and webhook URLs across repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a repository security health scanner within SCS that continuously evaluates repositories on code quality, dependency management, CI/CD best practices, and project maintenance.

   2 details in Everything

9. docs update Sep 19, 2026 · issue 079

   Checkmarx 3.30 adds Container Security policy conditions, Azure AI guided remediation, and Sysdig Spotlight token onboarding⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds guided remediation in the Visual Studio Code Plugin and CLI that integrates with a customer's Azure AI environment as a secure alternative to the OpenAI platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds policy condition support for the Container Security scanner in Checkmarx One Policy Management, including specialized conditions usable in Condition Groups.
   • Enables project scanning for projects without Code Repository integrations.
   • Streamlines Sysdig integration onboarding by allowing account connection via a Spotlight token.
   • Extends PR/MR decoration with collapsible tabs across GitHub, GitLab, Bitbucket, and Azure DevOps (Bitbucket does not support collapsible tabs).
   • Adds guided remediation in the Visual Studio Code Plugin and CLI that integrates with a customer's Azure AI environment as a secure alternative to the OpenAI platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables project scanning for projects without Code Repository integrations.

   3 more in Everything

10. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.32 adds package mute/snooze controls for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and smarter Feedback App alert conditions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Feedback App Alerts (Slack, Teams, Email) now fire only when a vulnerability matching the specified severity and state is identified, eliminating per-scan noise.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the ability to set a package state to muted so that its associated vulnerabilities are suppressed from project risk views in SCA scan results.
    • Adds a snooze option for packages that temporarily mutes them for a fixed period, after which they automatically revert to monitored status.

    3 details in Everything

11. docs update Sep 19, 2026 · issue 079

    Checkmarx One 3.36 adds CrowdStrike Cloud Insights integration, ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. risk scores in IDE, and a new Entities base report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Integrates Cloud Insights with CrowdStrike by connecting to CrowdStrike's API endpoints, set up via a wizard launched from the Cloud Insights page in the Checkmarx One UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Entities base report that delivers insights into high-risk security issues and their trends over time, with flexible grouping and breakdowns by selected entity.
    • Surfaces ASPM risk-scored results directly in the IDE, showing high-risk findings first to align the IDE experience with the ASPM model in the web app.
    • Adds a card information feature on hover over a vulnerability's risk score, displaying metrics, weighting factors, and contributing elements used to calculate the score.
    • Adds a Status column to the results table indicating whether an image has been Muted, Snoozed, or Unresolved, with a tooltip explaining why an image wasn't resolved.

    +1 more show less

    • Upgrades the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine to version 9.7.2.
    • Integrates Cloud Insights with CrowdStrike by connecting to CrowdStrike's API endpoints, set up via a wizard launched from the Cloud Insights page in the Checkmarx One UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Entities base report that delivers insights into high-risk security issues and their trends over time, with flexible grouping and breakdowns by selected entity.
    • Surfaces ASPM risk-scored results directly in the IDE, showing high-risk findings first to align the IDE experience with the ASPM model in the web app.
    • Adds a card information feature on hover over a vulnerability's risk score, displaying metrics, weighting factors, and contributing elements used to calculate the score.
    • Adds a Status column to the results table indicating whether an image has been Muted, Snoozed, or Unresolved, with a tooltip explaining why an image wasn't resolved.

    1 more in Everything

12. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.40 adds application-level SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports and per-app ticket isolation for feedback apps in multi-app environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds application-level SBOM report generation via the UI at Workspace > Projects, in addition to existing project-level SBOM support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an option to exclude all licenses not designated as Effective for a package when generating SBOM reports.
    • Enhances feedback apps functionality so each app only updates tickets it originally created, even when multiple apps share the same connection.
    • Adds application-level SBOM report generation via the UI at Workspace > Projects, in addition to existing project-level SBOM support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

13. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.44 distinguishes Not Used vs Not Calculated package and exploitable-path results, and adds self-hosted SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. support for Auto PR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Package results now distinguish Not Used (no usage detected) from Not Calculated (usage could not be determined), with a reason provided for Not Calculated entries (e.g., unsupported language).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Risk results now distinguish Not Found (no Exploitable Path detected) from Not Calculated (exploitability could not be determined), with a reason provided for Not Calculated entries (e.g., transitive dependencies are not supported).
    • Package results now distinguish Not Used (no usage detected) from Not Calculated (usage could not be determined), with a reason provided for Not Calculated entries (e.g., unsupported language).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

14. docs update Sep 19, 2026 · issue 079

    Checkmarx One 3.46 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. compliance column with PDF/JSON reports, Git blame in IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. table, and Agentic-AI remediation sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • DAST results viewer gains a compliance column that tags vulnerabilities with relevant compliance standards and supports filtering by compliance tag or generating compliance reports in PDF or JSON formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Git blame information as a dedicated author column in the Application Risk Management table for the IaC engine, showing who made each code change.
    • Introduces Agentic-AI remediation sessions that feed vulnerability context to an AI agent connected to Checkmarx's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, generating remediated code that can be accepted or refined via chat.
    • Email notifications from Checkmarx One Feedback Apps are now sent from notifications@checkmarx.com, replacing ast-bot@checkmarx.com.
    • DAST results viewer gains a compliance column that tags vulnerabilities with relevant compliance standards and supports filtering by compliance tag or generating compliance reports in PDF or JSON formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Agentic-AI remediation sessions that feed vulnerability context to an AI agent connected to Checkmarx's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, generating remediated code that can be accepted or refined via chat.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Checkmarx One Feedback Apps now send email from notifications@checkmarx.com instead of ast-bot@checkmarx.com — mail filters allowlisting the old address must be updated.
15. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.48 adds a new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy status condition, revamped license reporting with Permissions/Legal Risks sections, and unified binary/source CVE deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a new status policy condition for the SCA scanner, enabling policies that trigger on New or Recurrent vulnerabilities while filtering out dev and test dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Revamped SCA Scan Reports now include a Package Licenses section (CSV, XML, JSON) with per-package license data and a Legal Risks section (CSV, XML, JSON) with license usage risk data, available via the UI and REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services..
    • SCA Scan Reports gain license Permissions, Limitations, and Conditions data, plus an option to filter results to show only licenses marked as Effective.
    • Deduplicates CVE results when a binary shares the same CVEs as its source package, counting them once as a unified result while still surfacing separate entries when binaries have distinct vulnerabilities.
    • Adds a new status policy condition for the SCA scanner, enabling policies that trigger on New or Recurrent vulnerabilities while filtering out dev and test dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

16. docs update Sep 19, 2026 · issue 079

    Checkmarx One adds Private Registry APIs for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. config management and expands IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. coverage for Azure and GCP resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Private Registry APIs to create, edit, tag, and associate private registry configurations with projects for SCA scanning, replacing manual edits to project config files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Expands IaC (Terraform Azure) coverage to include azurerm_linux_web_app and azurerm_windows_web_app Azure App Service resources.
    • Adds IaC check for Terraform Google Cloud Platform: ensures Log_min_error_statement database flag for Cloud SQL PostgreSQL is set to Error or stricter.
    • Adds IaC check for Terraform Google Cloud Platform: ensures Log_min_messages flag for Cloud SQL PostgreSQL is set to at minimum Warning.
    • Adds a Resolution field for closing issues in Feedback Apps integration with Checkmarx One projects.
    • Adds Private Registry APIs to create, edit, tag, and associate private registry configurations with projects for SCA scanning, replacing manual edits to project config files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds IaC check for Terraform Google Cloud Platform: ensures Log_min_error_statement database flag for Cloud SQL PostgreSQL is set to Error or stricter.
    • Adds IaC check for Terraform Google Cloud Platform: ensures Log_min_messages flag for Cloud SQL PostgreSQL is set to at minimum Warning.

    2 more in Everything

17. docs update Sep 19, 2026 · issue 079

    Checkmarx One adds GitHub App auth for repo integrations, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. proxy support, and full DAST CLI workflow⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports GitHub App-based authentication for code repository integrations, enabling short-lived scoped tokens, automatic token rotation, and granular permission control as a more secure alternative to Personal Access Tokens and OAuth apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds proxy support for DAST, enabling scanning of internal, non-public, or firewall-protected applications from the cloud without whitelisting or exposing external IPs.
    • Enables running a full DAST workflow directly from the CLI via a REST-API-driven script that handles authentication, session creation, scanning, and results retrieval.
    • Adds an automated process that identifies and publishes newly identified CVEs with a pending manual review note, later updated after AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Research team analysis.
    • Enables triaging SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. results — editing state and adding comments — directly from the Visual Studio Code console.
    • Supports GitHub App-based authentication for code repository integrations, enabling short-lived scoped tokens, automatic token rotation, and granular permission control as a more secure alternative to Personal Access Tokens and OAuth apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables running a full DAST workflow directly from the CLI via a REST-API-driven script that handles authentication, session creation, scanning, and results retrieval.
    • Enables triaging SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. results — editing state and adding comments — directly from the Visual Studio Code console.

    2 more in Everything

18. docs update Sep 19, 2026 · issue 079

    Checkmarx One 3.56 adds Custom Secret Detection Rules, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. CxScore, and Secret Detection/Repository Health in reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Custom Secret Detection Rules, enabling organizations to define, manage, and enforce tailored secret detection logic across codebases and development workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Secret Detection and Repository Health as selectable scan types when generating reports, providing a consolidated view of findings across all scan types.
    • Introduces a new SCA Composite Risk Score called CxScore.
    • Adds a vulnerability distribution section to reports with tables showing breakdown by status and state, improving governance reporting.
    • Adds new permissions for Analytics — AI Triage and Remediation.

    +3 more show less

    • Adds a Systemic label for vulnerabilities.
    • Reports now display date-time values in the user's local time zone (instead of UTC), with the applied time zone shown in the report header; browser time zone is applied automatically for UI-generated reports.
    • Automatically retrieves and applies the default branch when importing Bitbucket repositories by calling the Bitbucket API during import.
    • Adds Custom Secret Detection Rules, enabling organizations to define, manage, and enforce tailored secret detection logic across codebases and development workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces a new SCA Composite Risk Score called CxScore.
    • Adds new permissions for Analytics — AI Triage and Remediation.
    • Adds a Systemic label for vulnerabilities.

    4 more in Everything

19. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.58 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. authentication URL discovery, Insights engine, and Teams Workflows webhook support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Replaces deprecated Office 365 Connectors in the Microsoft Teams Feedback Apps integration with Microsoft Teams Workflows webhook URLs — customers must update their Teams webhook configuration after deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • DAST now prompts to include authentication URLs during setup and surfaces all discovered but non-included URLs in the authentication report, error messages, and configuration settings.
    • Adds an Insights engine to DAST that flags conditions affecting scan accuracy — such as authentication failures, blocking mechanisms, or repeated server errors — as non-vulnerability findings; a High-level Insight stops the scan and marks it failed.
    • Replaces deprecated Office 365 Connectors in the Microsoft Teams Feedback Apps integration with Microsoft Teams Workflows webhook URLs — customers must update their Teams webhook configuration after deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Insights engine to DAST that flags conditions affecting scan accuracy — such as authentication failures, blocking mechanisms, or repeated server errors — as non-vulnerability findings; a High-level Insight stops the scan and marks it failed.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Microsoft Teams Feedback Apps integration no longer uses Office 365 Connectors; customers must update to a Microsoft Teams Workflows webhook URL after deployment or feedback notifications will stop being delivered.
20. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.60 adds in-environment API collection management and TLS misconfiguration detection with automatic policy inclusion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the ability to manage uploaded API collections and authentication scripts directly within an environment, available in both API and Web environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Detects unsecured TLS connections and triggers an alert prompting configuration correction; findings appear in scan results and are automatically included in the default policy on environment setup.

    2 details in Everything

21. docs update Sep 19, 2026 · issue 079

    Checkmarx 3.62 adds Attack Vector ID grouping and automated AI Triage on scans and pull requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces Attack Vector ID, a flow-aware finding grouping that encodes programming language, vulnerability query, and exact dataflow path — providing finer-grained separation than the default Similarity ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables AI Triage and AI Remediation to be launched for a specific risk directly from Risk Orchestration.
    • Adds automatic AI Triage configuration at the account or project level so AI Triage runs on every completed scan.
    • Supports automatic AI Triage on pull requests and direct remediation requests via pull request comments for GitHub Code Repository Integration projects.

    4 details in Everything

22. docs update Sep 19, 2026 · issue 079

    Checkmarx One gains MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. risk triage, SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine 9.7.7, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development. dependency scope, and upgraded AI Triage/Remediation agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables changing a risk's state and severity directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server using natural language, without opening Checkmarx One — supports marking risks Not Exploitable or Confirmed across all major scan engines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Upgrades AI Triage and AI Remediation agents for improved accuracy and performance, applied automatically.
    • Adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. dependency scope tracking for Direct dependencies — packages called directly by the application.
    • Adds Java SBT support (build.sbt, any .sbt file) for SCA dependency scanning.
    • Adds inventory:attested state (Inventory:attested) as a recognized risk/inventory classification.
    • Enables changing a risk's state and severity directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server using natural language, without opening Checkmarx One — supports marking risks Not Exploitable or Confirmed across all major scan engines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. dependency scope tracking for Direct dependencies — packages called directly by the application.
    • Adds Java SBT support (build.sbt, any .sbt file) for SCA dependency scanning.
    • Adds inventory:attested state (Inventory:attested) as a recognized risk/inventory classification.

    1 more in Everything

23. Manual triage is where backlogs are born. Checkmarx Triage & Remediation Assist is how they’re cleared. (2026-09-17) Sep 17, 2026 · issue 090

    Checkmarx One gains AI-driven Triage & Remediation Assist to move SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings from detection to governed fix with full audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Trigger AI triage on a single SAST finding directly from Risk Orchestration to get an instant reachability and exploitability verdict without leaving the working view.
    📍In Checkmarx One, open Risk Orchestration › select an eligible SAST finding › in the side panel, choose Triage with AI. Review the reachability and exploitability analysis in the Info tab and inspect the AI-proposed state (Confirmed or Proposed Not Exploitable) before making a final disposition.
    Generate a review-ready code fix for a confirmed SAST vulnerability and push it to GitHub as a pull request without leaving Checkmarx One.
    📍In Checkmarx One, open a finding with state Confirmed in a GitHub Code Repository Integration project › select Remediate with AI › review the proposed change under Remediation › AI Remediation (what/why/how) › approve creation of the pull request containing the suggested fix.
    Scope automated AI Triage to run at scan completion for high-severity SAST findings on a specific branch, so the backlog is triaged before any reviewer opens the queue.
    📍In Checkmarx One, navigate to the project settings for the target project › configure automated AI Triage scoped to branch: main, scanner: SAST, severity: High › save; after each scan completes, Risk Orchestration will reflect AI-assigned states automatically without manual triage per finding.
    • Adds Triage with AI control in the Risk Orchestration side panel to evaluate eligible SAST findings for reachability, exploitability, and sanitization coverage, automatically setting state to Confirmed or Proposed Not Exploitable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Remediate with AI control for eligible confirmed SAST findings, generating a suggested code fix with a structured what/why/how explanation inside Remediation > AI Remediation.
    • Adds automated AI Triage at scan completion, configurable by project, branch, scanner, risk status, and severity, with administrator controls over which parameters a project team can override.
    • Adds an AI Triage & Remediation dashboard reporting total triage and remediation actions, unique developers, estimated developer time saved, activity trends, triage outcomes, remediation results, and most-active projects, with filters by resource, branch, scanner, time range, tags, and groups.
    • Adds GitHub Code Repository Integration support to automatically create a pull request containing the AI-suggested fix for SAST findings.

    +3 more show less

    • AI Triage state changes propagate forward to identical SAST findings in subsequent scans (matched by Similarity ID or Attack Vector ID) and retroactively to identical results in earlier scans, preventing duplicate verdict work.
    • AI-driven state changes are attributed to AI Assist in the Change Log with actor, timestamp, previous state, new state, severity change, and reasoning preserved on the same risk record.
    • Both Triage with AI and Remediate with AI actions consume Checkmarx Credits; triage does not re-run or re-charge on an identical finding, and administrators can monitor burn rate and projected depletion.

    8 details in Everything

24. Triage is where backlogs are born.  Checkmarx Triage & Remediation Assist is how they’re cleared. (2026-09-17) Sep 17, 2026 · issue 079

    Checkmarx One adds AI-powered Triage & Remediation Assist to evaluate reachability, exploitability, and generate suggested code fixes for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Quickly assess whether a high-severity SAST finding is actually reachable and exploitable before assigning it to a developer.
    📍In Checkmarx One, open Risk Orchestration and select a SAST finding. In the side panel, choose Triage with AI. Review the reachability and exploitability analysis in the Info tab; the state is set to Confirmed or Proposed Not Exploitable with AI attribution visible.
    After confirming a SAST risk, generate a review-ready code fix and open a pull request so the developer receives context-complete remediation guidance without leaving their normal workflow.
    📍In Checkmarx One, open the confirmed SAST finding in Risk Orchestration, select Remediate with AI, review the proposed change and what/why/how explanation in the Remediation › AI Remediation tab, then (for GitHub Code Repository Integration projects) trigger creation of a pull request containing the suggested fix.
    Prevent backlog growth by automatically triaging all new Critical and High SAST findings on every main-branch scan, so analysts only review decisions rather than re-investigate context.
    📍In Checkmarx One administration settings, enable automated AI Triage and scope it to the target project, the main branch, the SAST scanner, and severity levels Critical and High. Set administrator-controlled overrides to restrict project teams from changing the branch and severity scope.
    • Adds Triage with AI control in the Risk Orchestration side panel to evaluate eligible SAST findings for reachability, exploitability, and existing sanitization — setting state to Confirmed or Proposed Not Exploitable with AI attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Remediate with AI control for eligible SAST findings, generating a suggested code fix surfaced in the Remediation > AI Remediation tab with a structured what/why/how explanation.
    • Adds automated AI Triage on scan completion, configurable by project, branch, scanner, risk status, and severity, with administrator control over which parameters a project team can override.
    • Adds an AI Triage & Remediation dashboard reporting total triage and remediation actions, unique developers, estimated developer time saved, activity trends, triage outcomes, remediation results, and top projects — filterable by resource, branch, scanner, time range, tags, and groups.
    • Propagates AI Triage state changes to identical SAST findings retroactively across earlier scans (matched by Similarity ID or Attack Vector ID depending on account settings) and forward into subsequent SCA scans (matched by package version and package manager, without retroactive application).

    +1 more show less

    • Both Triage with AI and Remediate with AI actions draw on Checkmarx Credits, with administrator visibility into burn rate and projected depletion.

    6 details in Everything

25. docs update Sep 11, 2026 · issue 071

    Checkmarx 3.66 adds native SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reachability, UV package manager support, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. risk triage, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI permissions, and expanded OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.-Realtime scanner coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds two new DAST AI permissions, Dast-to-code-initiator and Dast-AI-attack-initiator, to the dast-admin role for granular access control over DAST AI features.
    • New native reachability analysis engine in SCA performs exploitable path analysis without requiring a separate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan, adding a Reachability column with statuses: Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed; supports Python, Java, JavaScript, and C#.
    • Adds support for the UV Python package manager in SCA, selectable via a new Python Package Manager configuration setting at tenant and project level (pip remains the default).
    • Adds risk triage (state and severity changes) directly through the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., spanning all major scan engines.
    • Includes API Security engine data in Analytics — vulnerability data, severity changes, and state changes are now reflected in dashboard KPIs, charts, and summary counters.

    +3 more show less

    • Adds OSS-Realtime scanner support in JetBrains and Visual Studio IDE plugins for Java (Gradle, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development.), JS/TS (Yarn 1 & 2, Bower), Python (PIP, Setup.py/Setuptools, Poetry), PHP/Drupal (Composer), and Ruby (RubyGems).
    • Adds OSS-Realtime scanner support in the VS Code IDE plugin for JS/TS (Yarn 1 & 2, Bower), PHP/Drupal (Composer), and Ruby (RubyGems).
    • Global Inventory export now removes the previous result-count limitation, enabling full dataset exports.
    • Adds two new DAST AI permissions, Dast-to-code-initiator and Dast-AI-attack-initiator, to the dast-admin role for granular access control over DAST AI features.
    • New native reachability analysis engine in SCA performs exploitable path analysis without requiring a separate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan, adding a Reachability column with statuses: Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed; supports Python, Java, JavaScript, and C#.
    • Adds support for the UV Python package manager in SCA, selectable via a new Python Package Manager configuration setting at tenant and project level (pip remains the default).
    • Adds risk triage (state and severity changes) directly through the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., spanning all major scan engines.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The /presets API has reached end-of-life and will be removed; migrate all workflows to the /preset-manager API before support is discontinued.
26. docs update Sep 9, 2026 · issue 069

    Checkmarx One 3.66 adds native SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reachability engine, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. triage actions, UVUVA Python package and project manager written in Rust, maintained by Astral, that resolves and installs dependencies far faster than pip, making it attractive for cyber tools with heavy Python dependency trees. package manager support, and expanded AI T&R for SCA.

    • Adds --skip-default-filter flag to the CLI to bypass default file filters and include all files in the .zip archive submitted for scanning.
    • Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role, gating access to each DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI feature individually.
    • Adds UV as a selectable option in the new Python Package Manager configuration setting (available at tenant and project level) for SCA dependency resolution, with pip remaining the default.
    • Adds OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.-Realtime scanner support for RubyGems, Composer, Yarn, and Bower package managers in the CLI (used by Developer Assist).
    • Adds OSS-Realtime scanner support for Java (Gradle, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development.), JS/TS (Yarn 1 & 2, Bower), Python (PIP, Setup.py/Setuptools, Poetry), PHP/Drupal (Composer), and Ruby (RubyGems) manifest files in JetBrains and Visual Studio IDE plugins.

    +11 more show less

    • Adds OSS-Realtime scanner support for JS/TS (Yarn 1 & 2, Bower), PHP/Drupal (Composer), and Ruby (RubyGems) manifest files in the VS Code IDE plugin.
    • Adds *.tfvars and *.tfbacken file extensions to the list of supported files included in the scanned .zip archive.
    • Introduces a new native reachability analysis engine in SCA for Package Usage and Exploitable Path analysis, running as part of the SCA scan without requiring a separate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan; supports Python, Java, JavaScript, and C#.
    • Enables risk state and severity changes directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, supporting all major scan engines, so developers can triage findings from their AI assistant without opening Checkmarx One.
    • Expands AI Triage and Remediation to SCA findings via the Risk Orchestration screen, bringing parity with the existing SAST AI T&R experience.
    • Adds triggering user identity and a link to the AI Triage insight in the Changelog for every AI-driven state change across SAST and SCA findings, covering both manual and automated (auto-triage) executions.
    • Improves AI SAST remediation suggestions by incorporating curated guidance from the SAST Query Store — including risk description, root cause, and query-specific recommendations — surfaced to the remediation agent alongside the finding and source code.
    • Adds two new tables — Results Distribution by Status and Results Distribution by State — to the Scan Report's Scans Overview section, available in both PDF and JSON exports.
    • Includes API Security engine vulnerability data in Analytics, reflected in dashboard KPIs, charts, and summary counters, with severity and state changes also captured.
    • Replaces page-number navigation with Next and Previous controls on the Packages, Risks, and Licenses tabs in Global Inventory.
    • Upgrades the SAST engine to version 9.7.7, rolling out gradually.
    • Adds --skip-default-filter flag to the CLI to bypass default file filters and include all files in the .zip archive submitted for scanning.
    • Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role, gating access to each DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI feature individually.
    • Adds UV as a selectable option in the new Python Package Manager configuration setting (available at tenant and project level) for SCA dependency resolution, with pip remaining the default.
    • Introduces a new native reachability analysis engine in SCA for Package Usage and Exploitable Path analysis, running as part of the SCA scan without requiring a separate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan; supports Python, Java, JavaScript, and C#.
    • Enables risk state and severity changes directly through the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, supporting all major scan engines, so developers can triage findings from their AI assistant without opening Checkmarx One.

    +1 more show less

    • Includes API Security engine vulnerability data in Analytics, reflected in dashboard KPIs, charts, and summary counters, with severity and state changes also captured.

    10 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The /presets API has been announced as end-of-life and will be removed soon; migrate all workflows to the /preset-manager API before it is shut down.
27. docs update Sep 2, 2026 · issue 062

    Checkmarx One 3.66 adds native SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reachability engine, UV package manager support, Git commit ID scan tagging, and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. AI permissions.

    └──▷ HOW TO FIND IT
    Select the UV package manager for a project to get full SCA dependency visibility on modern Python tooling.
    📍In Checkmarx One, go to your Project Settings › SCA › Python Package Manager and select UV instead of the default pip.
    Enable Git commit ID tagging so every push-triggered scan can be traced back to its exact commit.
    📍In Checkmarx One, go to SCM Setup (or Project Settings › SCM) and enable the Git Commit ID Scan Tagging option during the SCM setup flow or project migration wizard.
    • Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role, enabling granular access control over each DAST AI feature.
    • Adds a new Python Package Manager configuration setting (at tenant and project level) that supports UV as a package manager for SCA dependency resolution, in addition to existing pip support; pip remains the default.
    • New native reachability analysis engine in SCA runs Package Usage and Exploitable Path analysis as part of the SCA scan itself, replacing the previous separate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan dependency; supports Python, Java, JavaScript, and C# for direct dependencies with no additional configuration required.
    • Git Commit ID Scan Tagging (GA September 10, 2026) automatically tags scans triggered by push or pull request events with the associated commit ID, configurable via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. setup flow, project settings, or project migration; requires AI Triage & Remediation.
    • AI Triage and Remediation on the Risk Orchestration screen now supports SCA risks, bringing parity with existing SAST AI T&R support; requires AI Triage & Remediation.

    +5 more show less

    • AI remediation suggestions for SAST findings now incorporate curated guidance from the SAST Query Store, including risk description, root cause, and query-specific recommendations.
    • The AI Triage Changelog now shows the triggering user and includes a link to the AI Triage insight for every AI-driven state change in SAST and SCA findings, covering manual, auto-triage, and bulk triage actions.
    • Scan Report now includes two new tables — Results Distribution by Status and Results Distribution by State — in the Scans Overview section, available in both PDF and JSON exports.
    • SAST engine upgraded to version 9.7.7, rolling out gradually.
    • Global Inventory navigation on the Packages, Risks, and Licenses tabs switches from page-number controls to Next/Previous controls.

    10 details in Everything

28. docs update Sep 1, 2026 · issue 061

    Checkmarx One 3.62 adds Risk Orchestration, AI Triage & Remediation, AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. export, AISC CLI support, and a new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. package risk intelligence API.

    └──▷ TRY IT
    Query batch vulnerability and malware risk data for a set of packages — useful for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. enrichment or pre-release dependency checks.
    copy

    $ curl -X POST 'https://<tenant>.checkmarx.net/api/v1/packages/risks' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"packages": [{"purl": "pkg:npm/lodash@4.17.20"}, {"purl": "pkg:pypi/requests@2.28.0"}]}'

    • Adds POST /api/v1/packages/risks REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to query vulnerability and malware risk data on up to 100 packages per request, accepting packages by PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. or by name/type/version, with optional parameters controlling detail level from basic risk scores to full CVE details and remediation guidance; a dedicated endpoint for Package Upgrade Recommendations is also available.
    • Adds AI Supply Chain Security (AISC) as a standalone scanner type in the Checkmarx One CLI, triggerable with the same workflow and commands used for other supported scanners.
    • Adds include and exclude scope configuration rules for AI Supply Chain scans at both the global and project level; exclude rules always take precedence and changes apply to subsequent scans only.
    • Introduces Risk Orchestration — a unified, consolidated table of all scan results across all security engines, organized by severity, accessible to developers, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. managers, and CISOs without context-switching.
    • Introduces AI Triage & Remediation (GA): the AI Triage agent analyzes reachability and exploitability of findings, and the AI Remediation agent generates code fixes and automatically opens pull requests for GitHub Code Repository Integration projects; supports manual activation, automated workflow (account or project level), and PR Decoration workflow for GitHub; requires a Checkmarx Credits license.

    +11 more show less

    • Adds Attack Vector ID as a new grouping option for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings, providing flow-aware grouping based on programming language, vulnerability query, and exact data-flow path.
    • Adds Audit Trail coverage for SAST result triage: all changes to finding severity, state, and notes are captured with before/after values, user identity, timestamp, bulk action indication, and triage method (similarity-based or attack-vector-based), accessible via the Audit Trail API.
    • Extends Audit Trail to cover Analytics and Reporting actions, logging events through the centralized Audit Trail framework for activities initiated via integrations, APIs, and automation.
    • Adds a Credit Consumption Overview page in the administration area, showing remaining AI credit balance, 30-day usage patterns, top consumers, cost distribution by action type, and a depletion forecast.
    • Adds a non-dismissible Confidential header banner (enabled per tenant by Checkmarx, supports custom text such as Internal Use Only), and stamps a Confidential label on every page of exported PDF reports across all report types (Scan, Project, Global, Application).
    • Adds AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. export from scan results — available from the scan results screen or via API — generating a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.-compliant bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. with AI assets (LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., AI SDKs, AI APIs, AI frameworks, AI agents, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and clients) modeled as components.
    • Adds deterministic LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. risk assessment in the AI Supply Chain Engine, with results exposed consistently across the UI, API, and CLI.
    • Adds an API to disconnect a project from its Code Repository Integration and revert it to a manual project without requiring repository-to-repository migration.
    • Policy Management now supports combining Net New findings with SCA-specific rules, allowing policies such as breaking a build only on Net New vulnerabilities in production dependencies.
    • Updates the SAST engine to version 9.7.6, bringing the engine's latest features and updates to Checkmarx One.
    • Improves npm dependency resolution accuracy for npm v7 and later by leveraging native peer dependency resolution, producing more complete dependency trees and broader vulnerability coverage.

    16 details in Everything

29. docs update Sep 1, 2026 · issue 061

    Checkmarx One 3.64 adds organization-level scan settings, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. container scanning, PNPMPNPMA Node.js package manager that stores dependencies in a single content-addressable cache and links them into projects, saving disk space and speeding installs compared with npm or Yarn. lockfile resolution, and CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..

    └──▷ HOW TO FIND IT
    Enforce org-wide AI governance by disabling all AI capabilities from a single control point.
    📍In Checkmarx One, go to Account Settings › Global Settings › AI Usage and toggle AI Usage to disabled. Confirm the prompt to immediately turn off all AI-driven features platform-wide.
    • Adds allowedLevel and unableToBlockOverride attributes to settings metadata, letting platform administrators restrict specific settings to tenant or project scope and enforce override behavior across configuration levels.
    • Adds customState field to /api/results endpoint responses for API Security findings, surfacing custom triage states consistently with other scanners.
    • Adds AI asset counters to the scan summary API, enabling the CLI to display an assets table alongside scan results for AI Supply Chain scans.
    • Adds support for pnpm-lock.yaml lockfile resolution in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., using the lockfile as the authoritative source for resolving direct and transitive dependencies in PNPM-managed projects.
    • Introduces organization-level configuration for Code Repository Integration projects, with a new Organizations tab in Account Settings and an Organization Settings panel where administrators can enable/disable scanners and set per-setting Allow Override controls.

    +15 more show less

    • Adds Container Security scanning to the Checkmarx One MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., extending MCP coverage alongside existing SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCA, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., and Secrets integrations.
    • Adds manual SAST and SCA risk triage through the MCP Server, allowing users to update risk state (e.g. Confirmed, Not Exploitable), add comments, and view triage history without opening Checkmarx One.
    • Adds a global AI Usage toggle in Global Settings to instantly disable all AI-driven capabilities platform-wide, including future AI features.
    • Adds state-based exemption rules to Policy Management, letting teams define which vulnerability states are excluded from build-break enforcement across pull requests, builds, and CI/CD pipelines.
    • Upgrades the CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOM output to version 1.7, with each component now including provenance evidence (file path, manifest analysis vs. hash comparison), available via UI, API, or CI integration.
    • Expands SCA archive unpacking to support tgz, rpm, and whl file types, covering Linux, Red Hat, and Python ecosystems in both cloud scans and the SCA Resolver CLI.
    • Extends SCA C/C++ open source detection to include packages sourced from vcpkg, adding vcpkg fingerprints to the existing Conan-based fingerprint database.
    • Adds API Security triage actions to the Checkmarx One Audit Trail, capturing user, timestamp, before/after values, bulk vs. individual changes, and Similarity or Attack Vector ID triggers.
    • Adds CSV export for the Fixed Vulnerabilities drill-down table in the Analytics Dashboard.
    • Adds comment support when triaging BYOR imported findings, consistent with the triage experience for built-in engine findings.
    • Includes BYOR (Bring Your Own Results) data in risk summary views, the Applications Overview, and the Projects tab, covering total vulnerabilities, results by scanner type, results by state, and other summary fields.
    • Includes BYOR scan results in analytics and reports alongside results from standard scans.
    • Adds column management to the Risk Orchestration table across SAST, SCA, IaC, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., Containers, and Secrets, with show/hide, drag-and-drop reorder, filter, sort, and persistent session preferences.
    • Adds code snippets for each detected asset in the AI Supply Chain Global Inventory side panel, including file path copy and per-occurrence snippets for assets with multiple evidence locations.
    • Automatically reverts a risk's triage state from Not Exploitable to To Verify when a subsequent scan detects a new Exploitable Path, logging the reason in the risk History.

    20 details in Everything

30. docs update Aug 26, 2026 · issue 057

    Checkmarx 3.65 adds Global Inventory API, AI-based SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings analysis, manual test result import, and persistent dashboard filter links.

    • Adds Global Inventory API — query packages, risks, or licenses aggregated across your account with optional filters (project, application, severity, exploitability) and pagination; authenticated via platform API token.
    • Supports uploading manual testing results via CLI or JSON file, unifying manual and automated (ZAP) findings in one view; manual findings appear in UI, reports, and can be deleted individually or in bulk from the UI or overridden via CLI.
    • Adds AI-based SAST Findings Analysis that automatically classifies and filters out unlikely-relevant scan results; can be enabled or disabled at the account level or overridden per project.
    • Adds Git Commit ID scan tagging — scans triggered by push or pull request events are automatically tagged with the associated commit ID; configurable through the SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. setup flow, project settings, or during project migration.
    • Adds Application Association Enforcement for projects, rejecting project creation or updates that would leave a project without an application association; applies across direct API and CLI calls, Import API, migration, Code Repository Integration, and webhook-created repositories.

    +4 more show less

    • Adds CLIENT_ID/CLIENT_SECRET placeholder substitution in copied scan-trigger commands when the API key hide setting is enabled by an admin, preventing raw key exposure.
    • Adds token-based authentication support for Bitbucket Cloud integrations (previously only available for Bitbucket on-prem); available via the custom setup flow.
    • Dashboard views can now be saved as shareable links that preserve applied filters, allowing teams to share an exact filtered view without each user recreating the same selections.
    • SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. vulnerability listings now display the associated package name and version alongside the CVE identifier wherever CVE-based vulnerabilities are listed, ranked, or broken down.

    9 details in Everything

31. The Next Model Won’t Fix This: Three AppSec Imperatives From Black Hat USA 2026 (2026-08-17) Aug 17, 2026 · issue 061

    Checkmarx debuts Fusion multi-model SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., AI Inventory/AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk., Triage Assist, Remediation Assist, and autonomous Developer Assist MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. mode.

    • Adds Developer Assist autonomous mode, which uses hooks and MCP to intercept coding-agent actions such as file writes and package installations before they take effect, returning remediation guidance directly to the agent from an independent AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. layer.
    • Launches Checkmarx Fusion (early access), a Multi-Model AI Engine that runs curated frontier models over the hybrid SAST engine's already-validated findings to surface novel and AI-generated-code vulnerabilities with no known rule, CVE, or signature — available as an optional, usage-based layer where teams choose higher- or lower-cost models per project.
    • Introduces AI Inventory and AI-BOM using deterministic analysis to identify models, agents, MCP servers, AI libraries, and SDKs across repositories, with findings traceable to specific files and lines of code, and versioned AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. documentation generated per release.
    • Introduces Triage Assist, which applies AI reasoning to eligible SAST and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings grounded in reachability, exploitability, code context, risk context, policy, and mitigating controls to distinguish actionable findings from acceptable risks and suspected false positives.
    • Introduces Remediation Assist, which provides review-ready guidance and suggested code changes for prioritized findings and, for supported GitHub Code Repository Integration projects, can open a separate pull request containing the proposed fix for developer review — nothing is merged automatically.

    +1 more show less

    • Adds One Risk Orchestration to correlate signals from SAST, SCA, infrastructure-as-code security, API security, secrets detection, containers, repository health, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and third-party tools, enriched with exploitability, reachability, exposure, ownership, and business criticality for enforcement across pull requests, builds, and releases.

    6 details in Everything

32. What Is Checkmarx Fusion? (2026-08-05) Aug 5, 2026 · release notes

    Checkmarx Fusion adds Multi-Model AI Engine for zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. detection via Account Settings toggle and new LLM Generated Result label.

    └──▷ HOW TO FIND IT
    Activate the Multi-Model AI Engine for new detections.
    📍Account Settings → AI Capabilities
    Identify AI-generated findings in the results table.
    📍View the LLM Generated Result label in the results table
    • Enables Checkmarx Fusion under Account Settings → AI Capabilities to activate the Multi-Model AI Engine.
    • Adds LLM Generated Result label in the results table to identify findings produced by AI-based analysis.
    • Adds scanner badges in portfolio view to show which engines contributed to each result.

    3 details in Everything