Manifest

No entries match these filters. Clear filters

1. announced Oct 21, 2026 · issue 116

   Manifest Foreign Risk now runs in self-hosted and air-gapped environments, checking contributors against a local 20-billion-record dataset across 18 risk categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Extends Manifest Foreign Risk to self-hosted and air-gapped deployments, running all contributor-level foreign risk scans against a local copy of the dataset — no data leaves the network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Delivers contributor-level detection of sanctioned-jurisdiction contributors, foreign military/intelligence/state-lab affiliations, and unverifiable contributor identities inside disconnected environments.
   • Supports export of findings as audit evidence mapped to NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. SR-3 and SR-4 and Cybersecurity Maturity Model Certification (CMMC) supply chain controls.
   • Provides regular dataset updates packaged for local infrastructure, loaded into the customer's local database through a repeatable refresh process, keeping findings aligned with SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. without any outbound connection.
   • Extends Manifest Foreign Risk to self-hosted and air-gapped deployments, running all contributor-level foreign risk scans against a local copy of the dataset — no data leaves the network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Delivers contributor-level detection of sanctioned-jurisdiction contributors, foreign military/intelligence/state-lab affiliations, and unverifiable contributor identities inside disconnected environments.
   • Provides regular dataset updates packaged for local infrastructure, loaded into the customer's local database through a repeatable refresh process, keeping findings aligned with SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. without any outbound connection.

   1 more in Everything

2. announced Aug 26, 2026 · issue 058

   Manifest Supplier Risk adds a supplier-centric SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-grounded view of vendor risk with binary-generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and a supplier CLI flag.

   • Adds a --supplier flag to the Manifest CLI for associating an uploaded SBOM or binary directly with a named supplier at publish time.
   • Introduces binary-generated SBOMs for vendors who cannot provide one, covering C++, unmanaged code, and embedded systems where traditional SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. falls short, with results folded into that supplier's record.
   • New supplier portfolio view ranks every third-party vendor by risk score, asset count, open vulnerabilities, and last-updated date in a single screen.
   • New supplier detail view surfaces a full vendor footprint — every asset, version, risk score, component count, and vulnerability count — in one click.
   • Adds aggregated supplier risk scoring that rolls up asset-level risk to a single per-supplier score, enabling direct vendor-to-vendor comparison.

   +2 more show less

   • Adds prioritized supplier findings that stack-rank vulnerabilities by severity and product impact across a supplier's entire portfolio.
   • Extends the vulnerability and component pages to surface third-party products alongside first-party assets, with clear visual distinction between what teams build and what they buy.

   7 details in Everything