Changelog
SecurityVault product changelog.
What shipped each month, and what it means for the teams who run SecurityVault. For what comes next, see the roadmap.
Faster, more resilient scanning and a more responsive console
ScanningEvery tool for a repository now runs together in one isolated scan, each with its own deadline. If one tool is slow or fails, results from the others are kept and the scan says exactly which tool did not finish, so an incomplete scan is never mistaken for a clean one.
PerformanceReading, writing, result ingestion and live updates now scale independently, reducing contention between scan processing and interactive console use.
UpgradesUpgrade checks compare the schema of a migrated installation with a fresh installation and verify migration integrity, helping detect problems before a self-hosted upgrade.
WebsiteA new public website and documentation, with product, role and comparison pages written from how the platform actually works.
Code-to-cloud lineage you can trust
GraphThe security graph now models registries, Kubernetes namespaces, services and ingresses, and every relationship records how it was established: observed, derived or inferred.
LineageTrace a finding from the repository to the ingress that exposes it, with a clear explanation wherever a link cannot be proven, plus blast-radius search and an exploit-path view.
RemediationRemediation cases that persist from first finding to verified fix, with staged rollouts, simulation before rollout and clear reporting when a rollout is stopped.
QualitySecurityVault now scans its own code and images on every release, and what we learn from that feeds directly into sharper detection and fewer false positives.
The security ontology and Command Center
OntologyA shared security model connects findings to source, build and deployment context. Versioned interfaces make changes reviewable as coverage grows.
CorrelationCorrelation rules group related findings into security cases with one owner, and every rule is proven in shadow mode before it changes what you see.
Attack pathsAttack-path analysis that highlights choke points and the interventions that close the most paths at once.
RiskA risk model that explains every score by the factors behind it and updates as new evidence arrives.
Cloud 360 and cloud posture
CloudOne cloud posture engine across CSPM, KSPM, CIEM and IaC, with every result landing as a finding on the same graph as your code and images, so a misconfiguration and the code that deployed it are one story.
ConsoleCloud 360 pages for every cloud resource, plus a cloud inventory and posture dashboard.
Every scanner isolated, and a console built around roles
IsolationOur native engine runs isolated and untrusted, exactly like every third-party tool, and reports only through the same authenticated, signed and replay-protected path. Nothing gets a privileged shortcut.
Native engineTyped evidence on every finding, native secrets detection with provider fingerprints, supply-chain checks for typosquatting, dependency confusion, package age and maintainer risk, reachability hints, API discovery and deterministic remediation templates.
ConsoleEight role-based home views over one shared model; disposition made human-only with mandatory reason codes; natural-language filters that are validated and audited.
Enterprise identity, hardening and release 3.1
SecurityStronger tenant isolation, an audit record for every change, encrypted integration credentials, replay protection on inbound webhooks, credential and signing-key rotation, SSO with OIDC and PKCE on by default, enforced MFA, account lockout, dual-control approvals and reliable notification delivery.
Release 3.1Two-way Microsoft Teams, bulk operations, pull request annotations, VEX, an executive scorecard and application risk view, saved queries, the CLI and IDE extension, native Azure and GCP, deeper CIEM, external attack surface management, serverless coverage, webhooks, ChatOps, questionnaire auto-fill, regulatory monitoring and a vendor risk portal.
See it on your estate
See the latest release on your own code.
One repository and the cloud account it deploys to, traced from commit to workload.