Panorays

No entries match these filters. Clear filters

1. Q2’26 seen Aug 2, 2026 · issue 033

   Panorays Q2'26 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-based AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration, new Live Dashboard widgets, and expanded public API for questionnaire automation.

   • New Panorays Axis integration enables AI/LLM tools to securely connect with Panorays tenants via a remote MCP server, providing access to third-party risk data with guided workflows for questionnaire analysis, assessment reports, and supplier onboarding.
   • Live Dashboards gains interactive widgets, pre-configured dashboards, and expanded filtering options for building flexible, use-case-tailored reports.
   • Public API expanded with new entities, endpoints, questionnaire lifecycle management, evidence validation retrieval, and additional questionnaire data fields.
   • Updated API documentation introduces a new structure under the Panorays domain with dedicated sections for Panorays Axis (MCP), TPCRM lifecycle use cases, and additional endpoint references.

   4 details in Everything

2. Q2’26 Jul 30, 2026 · release notes

   Panorays Q2'26 adds Panorams Axis (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.), Live Dashboard widgets, and expanded questionnaire API endpoints.

   • Introduces Panorams Axis, enabling AI/LLM tools to connect via a remote MCP server for accessing third-party risk data.
   • Adds new widget-based capabilities to Live Dashboards, including pre-configured dashboards and expanded filtering options.
   • Expands the public API with endpoints for questionnaire lifecycle management, evidence validation retrieval, and additional questionnaire data fields.

   3 details in Everything

3. Q1’23 seen Jul 23, 2026 · issue 023

   Panorays Q1'23 adds third-party inventory, endpoint detection, questionnaire collaboration, risk policy controls, remediation management, and automated reevaluation.

   ▶ ⤢
   • Adds Third-Party Inventory: a single consolidated view to classify, manage, and upload security documentation for all third parties regardless of tier or evaluation type.
   • Introduces Endpoint Detection as a new external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. assessment category, giving visibility into third-party endpoint security posture and its impact on cyber risk ratings.
   • Adds Questionnaire Conversations, enabling real-time in-platform collaboration with third parties and internal team members on individual questionnaire questions before submission.
   • Introduces Correlated Insights, displaying questionnaire results and external attack surface assessment findings side-by-side for cross-validation in a single pane of glass.
   • Adds customizable Risk Policy controls allowing admins to adjust weighting between questionnaires and external assessments, factor in critical tests and expired questionnaires, and modify the risk rating matrix.

   +4 more show less

   • Introduces Override Risk Rating, letting admins manually adjust a third party's bottom-line risk rating to account for external factors, with changes visible to all users in real time.
   • Adds centralized Remediation Management with a new Cyber Impact Score to prioritize tasks, assign them to third-party contacts, and track resolution through a dedicated remediation tab.
   • Introduces Automated Reevaluation to schedule recurring third-party assessments based on inherent risk, frequency, and priority, with email reminders and relevant question templates.
   • Adds Approval Snapshot to automatically capture and store risk rating scores at status-change events, enabling historical comparison across reevaluation cycles.

   9 details in Everything

4. Q1’24 seen Jul 23, 2026 · issue 023

   Panorays Q1'24 adds AI-powered answer validation, asset-based segmentation, richer supply chain discovery, and automatic remediation reminders.

   • New Smart Validation AI automatically parses third-party documents (questionnaire attachments or Files & Documentation uploads), correlates them with specific questions, and generates confidence scores plus supporting/contradicting evidence.
   • New Segments feature lets you group third parties into subsets by domain or geolocation assets, generating a focused attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. assessment for those specific assets.
   • Supply Chain Discovery now surfaces detailed evidence and navigation controls for direct and unregistered Nth parties, with the ability to select which to add for assessment and continuous monitoring.
   • Remediation Management adds automatic email reminders to third parties 3 days before open remediation task due dates, removing the need for manual follow-up.

   4 details in Everything

5. Q1’25 seen Jul 23, 2026 · issue 023

   Panorays Q1'25 adds supply-chain risk insights, customizable executive reports, a new dashboard widget, and custom integrations.

   • New Risk Insights and Response Portal gives a single-page view of cyber event impact across direct and indirect third parties for faster, data-driven response.
   • Adds customizable executive reports with mix-and-match widgets and export capability, tailored for board and management audiences.
   • New Live Dashboards Criterion Summary widget surfaces unresolved criteria with criticality, sources, and affected third parties in one consolidated view.
   • Introduces custom integrations to connect Panorays features with existing security systems for streamlined data exchange.

   4 details in Everything

6. Q2’23 seen Jul 23, 2026 · issue 023

   Panorays Q2'23 adds Supply Chain Discovery, Risk Insights portal, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. prioritization, and enriched Asset Details.

   ▶ ⤢
   • New Supply Chain Discovery maps direct and indirect suppliers automatically, surfaces Shadow IT, assigns cyber posture and Commonality ratings, and lets users add discovered suppliers to their inventory in one click.
   • New Risk Insights and Response Portal delivers real-time alerts on vulnerabilities, breaches, news, and zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. events across the digital supply chain, identifies affected direct and indirect suppliers, and enables immediate breach-questionnaire dispatch.
   • CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEVs) are now ingested and automatically prioritized as Critical findings within technology-vulnerability detection.
   • New Asset Details sidebar exposes enriched DNS, Network, Registration, and Web data for first- and third-party discovered assets, including discovery path and criticality context.
   • New Bulk Task Creation lets users multi-select findings and questions simultaneously and consolidates all resulting remediation tasks into a single outbound email to the third party.

   +3 more show less

   • Expanded API documentation adds new endpoints for automating a broader set of rules and actions; admins can now create, modify, and revoke API Tokens with access-permission controls directly inside the platform.
   • New customizable email templates allow full editing of copy, subject line, and CTA for Security Questionnaire, Remediation Task, and Security Passport communications.
   • Centralized Inventory Management view surfaces all unassessed third parties in one place and lets admins selectively trigger evaluations and choose assessment type per supplier.

   8 details in Everything

7. Q2’23 AI Release seen Jul 23, 2026 · issue 023

   Panorays Q2'23 adds Smart Match, an AI feature that suggests pre-answered responses to streamline questionnaire completion.

   ▶ ⤢
   └──▷ HOW TO FIND IT
   Speed up questionnaire submissions by letting Smart Match pull from your answered-question library instead of drafting responses from scratch.
   📍In the questionnaire submission flow, open a question field and select a suggested answer from the AI-generated library ranked by similarity score.
   • Adds Smart Match, an AI-powered capability that surfaces previously answered questions ranked by similarity score while completing a questionnaire, accelerating response time and ensuring answer consistency.

   1 detail in Everything

8. Q2’24 seen Jul 23, 2026 · issue 023

   Panorays Q2'24 adds internal questionnaires, AI answer lookup, SEC 8-K cyber news, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. findings, live dashboards, and custom risk factors.

   └──▷ HOW TO FIND IT
   Tune a specific supplier's risk score to reflect offline assurance evidence (e.g., a completed SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. report) without waiting for an automated scan update.
   📍In the console, open a supplier profile › Risk Policy › Custom Factors, add a point adjustment for SOC2 completion, and optionally mark evidence as mandatory.
   Reduce third-party questionnaire turnaround time by letting vendors search prior answers — third parties access the Answer Lookup search bar in the questionnaire portal to find previously answered similar questions before typing a new response.
   📍In the vendor-facing questionnaire portal, use the Answer Lookup search bar to enter a question keyword; review the returned list of similar past questions, their answers, source questionnaires, and similarity match scores.
   • New Internal Questionnaires feature lets admins circulate questionnaires within their own organization to gather third-party information from relationship owners at any assessment stage (due diligence, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. reviews, etc.).
   • New Risk Policy Custom Factors lets admins add or reduce points from a supplier's bottom-line risk rating based on external factors (offline questionnaires, SOC2 completion, trusted vendor status), with per-supplier configuration and mandatory evidence requests.
   • New Live Dashboards enable customizable reporting dashboards built from selectable data-visualization widgets, tailored for management and board reporting.
   • New centralized Findings Management page provides enriched finding details and in-place actions such as confirming resolutions or disputing findings.
   • New AI-powered Answer Lookup search bar helps third parties surface past questionnaire responses, showing similar questions, their answers, source questionnaires, and a similarity match score.

   +2 more show less

   • Adds SEC 8-K filings as a new cyber news source, with alerts on cyber events filed by breached companies.
   • New Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSP) Cyber Posture finding checks CSP configuration against security best practices, classified at High and Low severity levels.

   7 details in Everything

9. Q2’25 seen Jul 23, 2026 · issue 023

   Panorays Q2'25 adds Gemini-powered answer suggestions, simplified supplier onboarding, richer AI business snapshots, and Cyber News webhooks.

   • New AI Answer Advisor powered by Google Gemini generates intelligent questionnaire answer suggestions drawn from publicly available data, complementing SmartMatch's existing scan of prior responses.
   • Redesigned Add Supplier flow enables onboarding suppliers without prior background knowledge, with automatic cyber posture assessment initiated upon addition.
   • Enhanced Business Snapshot aggregates a broader spectrum of public data sources using advanced AI to enrich supplier profiles with company identifiers, financial attributes, and improved compliance accuracy.
   • Public API now supports Cyber News webhooks, delivering real-time threat intelligence for custom integrations with existing security systems.

   4 details in Everything

10. Q3’23 seen Jul 23, 2026 · issue 023

    Panorays Q3'23 adds Workflow Automation, Smart Match questionnaire uploads, and Internal References for reviewers.

    • New Workflow Automation feature lets you define preset rules to automatically approve or reject third parties, generate remediation tasks, and assign responsibilities to multiple stakeholders — triggered by Questionnaire Ratings, Cyber Posture Ratings, Risk Ratings, business impact, and third-party risk status.
    • Smart Match now accepts uploaded questionnaires from outside Panorays, improving auto-answer accuracy for new questionnaires based on previously completed responses.
    • New Internal References capability lets reviewers leave internal notes on questionnaires to surface company policy and compliance context, accelerating the review process.

    3 details in Everything

11. Q3’24 seen Jul 23, 2026 · issue 023

    Panorays Q3'24 adds DORA reporting, third-party portfolios, activity logging, dark web CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. alerts, and task management.

    └──▷ HOW TO FIND IT
    When you need to submit your DORA Register of Information to a Supervisory Authority, use the DORA File Generator to produce a pre-coded, ready-to-send file instead of manually filling the Excel sheet.
    📍In the Panorays console, navigate to the DORA module, select DORA File Generator, complete the built-in questionnaire templates, and export the Register of Information file for submission to your Supervisory Authority.
    When managing a large third-party portfolio, create segmented groups to focus review resources on your highest-criticality or most sensitive suppliers.
    📍In the Panorays console, go to Portfolios, select Create Portfolio, then filter and assign third parties by criteria such as criticality, sensitivity, geolocation, or company department.
    When investigating a supplier incident or preparing an audit, export a filtered activity log from the Activity Center for the relevant supplier and time range.
    📍In the Panorays console, open Activity Center, apply filters for the target supplier and date range, then select Export to download the log for reporting.
    • New DORA File Generator add-on module generates a complete DORA Register of Information report as a ready-to-send file for Supervisory Authorities, with built-in questionnaire templates pre-coded for DORA's Excel format.
    • New Portfolios feature lets you organize third parties into distinct groups segmented by criticality, sensitivity, geolocation, company department, and more for risk-based prioritization.
    • New Activity Center provides a consolidated log of all supplier activities on Panorays, with filtering and export for reporting and audit trails.
    • Enhanced Dark Web monitoring surfaces mentions relevant to your company and third parties with added metadata fields (Source Type, Site, and more) and CTI-backed alerting.
    • New Task Management: General Tasks enables opening customized tasks for internal teams or third parties from a single centralized location.

    +2 more show less

    • Business Snapshot now incorporates publicly available certifications into the Bottom Line risk rating, manually reviewed by Panorays experts.
    • Internal Questionnaires status is now surfaced via a Live Dashboards widget and included in executive summary PDF reports.

    7 details in Everything

12. Q3’25 seen Jul 23, 2026 · issue 023

    Panorays Q3'25 adds supplier inventory management, per-supplier Live Dashboard reports, enhanced tag management, and questionnaire re-submission.

    └──▷ HOW TO FIND IT
    Classify and monitor suppliers by region or department for targeted assessment plans.
    📍In the console, go to Tags Management, create a tag (e.g., Region: EU or Dept: Finance), apply it to the relevant vendors, then use the Tags Management page to tier and segment those vendors for a custom assessment plan or report.
    Build a focused cybersecurity report tailored to executive stakeholders for a single supplier.
    📍In the console, navigate to Live Dashboards, select a supplier, add and configure interactive widgets relevant to your use case, then save the dashboard as a named report version for that supplier.
    • New Inventory view provides a centralized location to manage your supplier list, view automatic risk indicators, and move suppliers into tiered assessments based on risk level or priority.
    • Live Dashboards now support single-supplier reports, letting you build and save multiple tailored report versions per supplier using interactive widgets.
    • New Tags Management page lets you group and label vendors by characteristics such as location, department, or risk level, and manage all tagged vendors from a single centralized view.
    • Segments now support configurable Questionnaire Rating calculation — choose to mirror the parent company's questionnaires or create dedicated questionnaires per segment.
    • Internal Questionnaire responders can now update answers on already-submitted questionnaires without requiring a new submission; senders are automatically notified of any changes.

    5 details in Everything

13. Q4’23 seen Jul 23, 2026 · issue 023

    Panorays Q4'23 adds supplier intake forms, archival status, AI-powered cyber news, internal notes, and an expanded API v2.0.

    └──▷ HOW TO FIND IT
    Archive an inactive supplier to stop ongoing cyber assessments while retaining their historical documents.
    📍In the Panorays console, open the third party's profile, go to their status settings, and change the status to Archived.
    • New Intake Form lets internal stakeholders add suppliers via a one-time verification process without requiring a Panorays sign-in.
    • New Archived status pauses cyber assessments for inactive or terminated third parties while preserving their files and documents.
    • Cyber News enriched with additional data sources and an AI-based categorization and classification system for business-specific risk exposure.
    • Risk Insight and Response Portal gains an Internal Note feature for team communication, memos, and decision-rationale documentation within the portal.
    • API v2.0 expands access to questionnaire templates, remediation data retrieval, and Portfolio assignment to third parties, with faster response times.

    5 details in Everything

14. Q4’24 seen Jul 23, 2026 · issue 023

    Panorays Q4'24 adds SIG 2025 support, task consolidation, drill-down dashboards, and security event audit trails.

    • Adds SIG 2025 evaluation with mapping to DORA and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., per-supplier scoping by material risk, and seamless third-party SIG uploads across all SIG versions.
    • Adds Inherent Risk Questions to questionnaires, enabling business impact assessments with internal and external stakeholder collaboration.
    • Adds Task Management Consolidation — a single centralized view to find, track, and manage all tasks assigned to suppliers and internal teams.
    • Adds drill-down capability to Live Dashboard widgets, surfacing detailed supplier breakdowns for report types and tracking critical findings and remediation task status.
    • Adds a security events category to the Activity Center audit trail, tracking user login activities per supplier and across all suppliers.

    5 details in Everything

15. Q1’26 Apr 30, 2026 · release notes

    New AI Vendor Detection with dashboard widgets, new IRQ questionnaire template for risk assessment, and expanded Activity Center audit logs

    └──▷ HOW TO FIND IT
    Monitor AI adoption across your third-party supply chain by viewing the new dashboard widgets and running the predefined questionnaire.
    📍Navigate to the Dashboard › AI Vendors widget to view populations, then open the AI Questionnaire in the supplier assessment workflow.
    Configure inherent and material risk calculations using the new template structure.
    📍In the IRQ settings, select the IRQ questionnaire template and configure which question templates to include or exclude for specific third parties.
    • Adds AI Vendors identification with dedicated dashboard widgets and a predefined AI questionnaire to track suppliers using AI technologies
    • Introduces the IRQ questionnaire template for calculating Business Impact and allows customizing risk assessments by selecting which templates and questions to include or exclude
    • Expands Activity Center audit logs to capture time-stamped events for asset management, dispute workflows, remediation tasks, user lifecycle events, and company user invitations

    3 details in Everything

16. Q4’25 Jan 30, 2026 · release notes

    Panorays Q4’25 adds Smart Match autofill from compliance docs, DORA RoI submission workflow, segment-level custom factors, and API entity expansion.

    • Smart Match now analyzes uploaded compliance documentation (certifications, attestations, formats like SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria.) using Gemini-powered intelligence to generate referenced answer suggestions
    • New DORA Register of Information solution with automated tools for submission-ready ZIP file generation that complies with regulatory and technical formatting requirements
    • Activity Center captures new events including additional remediation details, reminders, and API tokens with timestamps
    • Segments now support assigning a dedicated business owner, applying unique Custom Factors at the segment level, generating Approval Snapshots, and adding internal notes/comments/tagging colleagues
    • Smart Validation adds an explanation field to provide context behind AI-suggested questionnaire reviews

    +1 more show less

    • Public API expanded to support additional platform entities and workflows for custom integrations

    6 details in Everything

17. Q3’25 Sep 30, 2025 · release notes

    Panorays Q3’25 adds Live Dashboards per supplier, granular Tags management, questionnaire segments, and answer updates.

    └──▷ HOW TO FIND IT
    Create multiple report versions for a specific supplier using Live Dashboards widgets.
    📍In the Live Dashboards interface, select the single-supplier view, add interactive widgets for risk indicators, and save the custom version.
    Group vendors by department to streamline targeted assessments.
    📍Navigate to Tags Management and create a new tag labeled Department: Finance to group relevant vendors.
    • Live Dashboards with interactive widgets allow building and saving multiple versions of single-supplier reports to highlight specific data for stakeholders
    • Tags Management enables grouping and labeling vendors by location, department, or risk level from a single page for targeted assessment plans
    • Segments feature allows defining how each segment’s Questionnaire Rating is calculated, including mirroring parent company questionnaires or creating dedicated ones
    • Internal Questionnaires enhancements allow responders to update answers to already-submitted questionnaires without requesting a new one, with automatic notification to the sender

    4 details in Everything

18. Q2’25 Jul 22, 2025 · release notes

    Panorays Q2'25 adds Gemini AI answer suggestions, simplified supplier onboarding flow, enriched Business Snapshots, and Cyber News webhooks via public API.

    • Gemini Answer Advisor generates questionnaire answer suggestions from public data and SmartMatch results
    • New Add Supplier flow initiates a cyber posture assessment automatically upon creation without prior background knowledge
    • Business Snapshot aggregates broader public data sources for deeper supplier profile visibility
    • Public API now supports new Cyber News webhooks for real-time threat intelligence

    4 details in Everything

19. Q1’25 May 21, 2025 · release notes

    Q1'25 release adds Executive Report Customization with widget mixing/export and a new Criterion Summary Widget for Live Dashboards.

    └──▷ HOW TO FIND IT
    Monitor unresolved third-party compliance issues directly on a dashboard using the new Criterion Summary widget.
    📍In Live Dashboards, click + Add Widget and search for Criterion Summary to display on your main view
    • Adds customizable executive reports allowing users to mix and match widgets and export them via a newly enhanced interface
    • Adds the Criterion Summary widget to Live Dashboards, providing consolidated views of unresolved criteria including criticality, sources, and affected third parties

    2 details in Everything

20. Q4’24 Jan 8, 2025 · release notes

    Panorays Q4'24 adds SIG 2025 mapping, inherent risk question selection, centralized task management, and live dashboard supplier breakdowns.

    • Configure panoramic surveys with the new SIG 2025 model mapped to DORA and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. regulations for third-party evaluations
    • Select specific questions within Panorays’ questionnaires to define which items are included in the business impact assessment (Inherent Risk Questions)
    • Track and manage all tasks assigned to suppliers and internal teams from one centralized Task Management location
    • Drill down into Live Dashboard widgets to see detailed supplier breakdowns for report types and monitor critical findings
    • View user login activities in a new security events category within the Activity Center audit trail page

    5 details in Everything

21. Q3’24 Oct 9, 2024 · release notes

    Panorays Q3’24 adds DORA generator, Portfolios, Activity Center, Dark Web updates, and task management

    └──▷ HOW TO FIND IT
    Generate and send a DORA compliance report directly to Supervisory Authorities.
    📍In Panorays, navigate to the DORA File Generator module and use the built-in templates to export the Register of Information.
    Segment third parties by criticality and location for risk-based management.
    📍In Panorars, use the Portfolios feature to group vendors based on criteria like geolocations and company departments.
    Export supplier activity logs for auditing purposes.
    📍In the Activity Center, filter logs by supplier and use the export function to download the data for reporting.
    • DORA File Generator module enables generation of a complete DORA Register of Information report for Supervisory Authorities using built-in questionnaire templates to automate Excel coding values.
    • Portfolios feature allows organization of third parties into distinct groups based on criteria such as criticality, sensitivity, geolocations, and company departments.
    • Activity Center provides a consolidated view of logs to track supplier activities with filtering and export capabilities for reporting.
    • Dark Web Enhancements add Source Type and Site details for third-party mentions, leveraging Cyber Threat Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) to categorize information and send alerts.
    • Task Management: General Tasks allows opening customized tasks for internal teams or third parties from a centralized place to streamline follow-ups.

    +2 more show less

    • Business Snapshot: Certifications Improvements incorporate public certifications into the Bottom Line risk rating of third-party cyber assessments, subject to manual expert review.
    • Internal Questionnaires Report adds visibility of questionnaire status via a widget in Live Dashboards or an executive summary PDF report.

    7 details in Everything

22. Q2’24 Jul 3, 2024 · release notes

    Panorays Q2’24 adds Risk Policy custom factors, SEC 8-K cyber news, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. findings, Live Dashboards, and centralized Findings Management.

    • Enables admins to set default configurations adding or reducing points from the bottom-line risk rating based on external factors via Risk Policy: Custom Factors
    • Adds SEC 8-K filings as a new source for cyber news alerts to view latest cyber events filed by breached companies
    • Introduces New Cyber Posture Findings for Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSP) checking configuration against security best practices with High and Low severity levels
    • Launches Live Dashboards allowing users to build customized reporting dashboards using various data visualization widgets
    • Releases centralized Findings Management page with intuitive UI and data enrichment for confirming resolutions or disputing findings

    +1 more show less

    • Deploys AI-powered Answer Lookup search bar enabling third parties to find past responses to previous questionnaire questions

    6 details in Everything

23. Q1’24 Apr 9, 2024 · release notes

    Panorays Q1'24 adds Smart Validation AI scores, third-party Segments, Nth-party Supply Chain Discovery, and automatic remediation reminders.

    • Adds AI-generated confidence scores and evidence to Smart Validation for questionnaire responses submitted by third parties
    • Introduces Segments to group third parties by specific assets, domain, or geolocation for focused attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. assessments
    • Enhances Supply Chain Discovery visibility into direct, unregistered Nth parties with options to add them for assessment and monitoring
    • Enables automatic email reminders for third parties 3 days prior to a remediation task due date

    4 details in Everything

24. Q4’23 Jan 17, 2024 · release notes

    Panorays Q4'23 adds supplier archival status, internal Risk Insight notes, enriched Cyber News categorization, and API v2.0 enhancements.

    • Adds Archived status for third parties to stop assessments and preserve documents
    • Enables internal notes on Risk Insight events for team communication and rationale documentation
    • Enhances Cyber News with AI-based categorization and richer data sources
    • Updates API v2.0 with performance improvements and expanded capabilities for questionnaire templates, remediation data, and portfolio assignment

    4 details in Everything

25. Q3’23 Oct 30, 2023 · release notes

    Panorays Q3'23 adds Workflow Automation for vendor approval, Smart Match questionnaire uploads, and internal reviewer notes.

    • Adds Workflow Automation feature to define preset rules based on Questionnaire Ratings, Cyber Posture Ratings, Risk Ratings, business impact, or third-party risk status to automatically approve/reject third parties and assign stakeholders.
    • Enables uploading previously answered questionnaires from outside Panorays via the Smart Match: Upload Questionnaires feature.
    • Introduces the ability to leave internal references (notes) for questionnaire reviewers within the platform.

    3 details in Everything

26. Q2’23 AI Release Aug 8, 2023 · release notes

    Panorays Q2’23 AI Release adds Smart Match AI feature to streamline questionnaire submission.

    └──▷ HOW TO FIND IT
    Accelerate third-party security evaluations by using AI-suggested answers for common compliance questions.
    📍In the Panorays console, go to Questionnaire Submission and enable Smart Match to auto-fill responses based on historical data.
    • Adds Smart Match AI capability that suggests pre-answered questions ranked by similarity score to accelerate questionnaire response time.

    1 detail in Everything

27. Q2’23 Jul 24, 2023 · release notes

    Panorays Q2'23 adds Supply Chain Discovery, Risk Insights Portal, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. prioritization, Asset Details sidebar, bulk remediation tasks, API token management, and custom email te

    └──▷ HOW TO FIND IT
    Send breach questionnaires directly from the Risk Insights portal for affected suppliers.
    📍Navigate to Risk Insights › Select Supplier › Click Send Breach Questionnaire
    Manage API access by creating new tokens for automation integrations.
    📍Admin Settings › API Management › Create New Token
    Customize the subject line and body for a specific Remediation Task email template.
    📍Settings › Email Templates › Edit Remediation Task › Modify Subject/Body
    • Supply Chain Discovery maps direct and indirect suppliers with Shadow IT detection and cyber posture ratings to expand attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. monitoring.
    • Risk Insights and Response Portal provides automated alerts on vulnerabilities, breaches, and zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. attacks across the supply chain with one-click breach questionnaire sending.
    • Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. (KEVs) are now prioritized as Critical findings in detection for actionable risk assessment.
    • Asset Details sidebar offers enriched DNS, Network, Registration, and Web data to understand asset discovery and criticality.
    • Bulk Task Creation allows selecting multiple findings/questions at once to send condensed remediation emails with task IDs.

    +2 more show less

    • Custom Email Templates for Security Questionnaires, Remediation Tasks, and Security Passport allow editing copy, subject, and CTA.
    • Inventory Management provides a centralized view of unassessed third parties with selectable evaluation types.

    7 details in Everything

28. Q1’23 Apr 19, 2023 · release notes

    Panorays Q1’23 adds Third-Party Inventory, Endpoint Detection, Smart Questionnaires with Conversation, Remediation Management with Cyber Impact Score, and Override Risk Ratin

    └──▷ HOW TO FIND IT
    Communicate with a vendor about missing controls without leaving the platform using the new conversation flow.
    📍In the Smart Questionnaire view, open the specific question and use the Questionnaire Conversations panel to message the third party or internal team for clarification.
    Manually adjust a vendor's final risk score based on known external factors not captured by automated scanning.
    📍Navigate to the third party's profile, locate the Override Risk Rating option available to admins, and apply the manual adjustment to the bottom-line rating.
    Prioritize remediation efforts by focusing on tasks that will have the highest positive impact on the third party's security rating.
    📍In the Remediation Management tab, sort or filter tasks by Cyber Impact Score to identify which mitigations enhance the rating most significantly.
    • Adds Third-Party Inventory to view and manage all third parties in one place, including uploading security control documentation for unassessed vendors.
    • Adds Endpoint Detection as a new category in external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. assessments to provide visibility into third-party devices such as desktops and laptops.
    • Adds Questionnaire Conversations feature allowing real-time communication with third parties on questions and internal team messaging during the assessment process.
    • Adds Integration and Ratings Correlated Insights view to display questionnaire results and external assessment findings side-by-side for validation.
    • Adds Risk Policy customization capability for admins to adjust weighting methodology, factor in critical tests or expired questionnaires, and modify risk rating matrix values.

    +5 more show less

    • Adds Override Risk Rating permission allowing admins to manually adjust the bottom-line risk rating for transparency and control.
    • Adds Remediation Management tab as a centralized location to create tasks, assign contacts, and track resolution of security issues.
    • Adds Cyber Impact Score metric to prioritize remediation tasks by showing how mitigation enhances the third party's rating.
    • Adds Automated Reevaluation feature allowing customization based on inherent risk, frequency, and priority with email reminders and recurring scheduling.
    • Adds Approval Snapshot feature that automatically captures screenshots of bottom line risk rating scores when status changes occur.

    10 details in Everything