Releases

v4.0

The AI release: agent-driven static analysis, web scanning and penetration testing, plus built-in vulnerability management.

Earlier releases used a language model to assist the scanners. This one puts agents in charge of the work: they plan their own approach, call tools, and verify what they find against the real system before it reaches you. Alongside them, ScanSuite gained its own vulnerability management rather than delegating all of it to DefectDojo.

The organising idea across every feature below is the same: a finding is not reported because a pattern matched, but because the platform could demonstrate it — a traced call path, a reproduced HTTP exchange, or an exploit that ran.

AI Native SAST

A model reads every file in scope and reports what it finds as structured records, instead of matching patterns. Logic flaws, broken authorization and unsafe data handling surface even when no rule exists for them — the class of bug a pattern scanner is structurally unable to see.

Capability	Description
Reachability gate	A tool-using agent opens the surrounding code, follows callers and callees, and returns a strict reachable or not-reachable verdict. Unreachable findings never reach you; reachable ones arrive with a call-path diagram as evidence.
Security architecture analysis	An optional pass building a repository-level model of trust boundaries and data flow, feeding severity scoring so it reflects your application rather than a generic template.
Git history analysis	An optional pass reviewing recent commits for risky changes.
Identity-based deduplication	Findings are keyed on vulnerability class, file and parameter — deduplicated within the scan and against history, so a recurrence reopens the original record instead of creating a second one.
Custom Scope	A scanning mode that analyses only the files and folders matching your patterns, so an expensive AI pass can be pointed at the code that matters.

See Executing the AI-powered scan.

Dependency reachability

A dependency scan reports every advisory touching your lock files. Four gates, cheapest first, decide which are worth a person's afternoon: severity, then reported real-world exploitation, then applicability to this component at this installed version, then reachability — does your code actually call the vulnerable API?

Survivors carry the exploit reference links and a diagram tracing entry point, import site and vulnerable component API. Everything a gate drops is counted in the scan log and left to the classic dependency spreadsheet, so nothing disappears silently.

See Dependency reachability.

AI-verified secrets

Secret detection findings from three scanners are normalised into a single pipeline and each one is judged: path prefilters and deterministic rules settle the clear cases for free, a per-value cache means a key repeated across twenty files costs one judgement, and the model sees a commit-accurate source window rather than a bare string.

See Secrets detection.

AI code documentation

Generates a security-oriented tutorial of a codebase — its abstractions, how they relate, and what order to read them in — readable directly in the web interface. Aimed at the codebase nobody on the security team wrote.

See AI code documentation.

AI DAST

A black-box web engine where the model picks the attack point, the technique and the concrete payload; the technique module shapes the request flow and scores the signal.

01
Discover
Crawling and imported crawl records build the attack surface, deduplicated into distinct attack points so the same parameter is not tested eleven times under eleven URLs.
02
Profile
WAF detection shapes payload encoding, and an optional surface profiler widens coverage beyond what the crawler could reach.
03
Probe
The model chooses among 34 technique modules and the payload values to send. A destructive-payload guard sits in front of anything that would change state.
04
Confirm
A second pass issues its own follow-up requests and either confirms or denies. Signals that cannot be reproduced are discarded rather than shipped as informational.
05
Report
Confirmed findings ship with severity, the payload list and the resolved HTTP exchange that produced them.

See Web App Scanning.

AI Pentest

Give the agent a scope and a sentence of instruction. It plans the engagement, runs the tools, improvises when the plan stalls, and comes back with findings it has proved.

Capability	Description
Plan-driven workflow	Plan, execute, analyze, ideate, replan, report — a real engagement workflow rather than a flat loop.
Engagement journal	Durable memory recording plan versions, tool runs, analyses and findings, so nothing is re-run and nothing is forgotten between phases.
Ideate phase	A dedicated phase that brainstorms the attacks the plan missed, working from an attack-technique cheat sheet and recording them as leads on an attack tree.
44 tools	Recon bundles, enterprise scanners driven by API, web scan bundles, interactive HTTP with session-persistent login and response diffing, and an allow-listed command runner.
Exploit research to PoC	Look a product and version up in the exploitable-CVE database, fetch the referenced exploit, generate a proof of concept, run it in a sandbox — and record the finding only if it worked.
Attack chains	Findings that enabled one another are chained and rendered in the report.
Safety rails	Scope-locked targets enforced on every tool call, no shell and allow-listed binaries only, exploit pages fetched solely from database-returned URLs, sandboxed execution, and budgets on every engagement.

See AI Pentest.

Vulnerability management

Findings from every engine — AI Native SAST, dependency reachability, secrets, AI DAST, AI Pentest and the classic scanners — are normalised into one vulnerability record inside ScanSuite, rather than living only in DefectDojo.

Capability	Description
Correlation	Identity keys collapse the same issue across engines and across runs. A recurrence reopens the original record instead of creating a second one.
Validation on the record	The exploitable verdict, risk score, confidence, rationale, required action and reported-exploitation references sit on the finding, along with the code-flow diagram and its step-by-step explanation.
Lifecycle	Status, owner, due date, tags, references, evidence, solution and lifecycle notes. Status changes inline from the list, and findings can be added by hand.
Dashboard	Severity mix, total open findings, scanned products and repositories, most exposed targets and most common vulnerabilities.
Search and export	Full-text search across CVEs, titles and targets, filters by product, severity and status, and one-click XLSX export.

See Vulnerability Management.

Executable proofs of concept

Generate an exploitation proof of concept with streamed progress, edit the Python in place, save it, run it in a sandbox and read the exit code and output — or hand it back to the model to refactor against the success condition until it works.

See Proof of concept.

AI providers and cost control

Capability	Description
Second provider	Claude models on Google Cloud Vertex AI alongside any OpenAI-compatible endpoint, including models running locally on your own network.
Failover and locking	Providers are tried in order; the first that succeeds can be locked for the remainder of the scan so a run does not drift between models.
Token accounting	Prompt, completion and total token counts recorded per scan, so the cost of an engagement is visible rather than inferred.
Generation language	A setting controlling the language the models write findings and reports in.

See AI providers and cost.

Platform

Capability	Description
Global search	One search across assets, vulnerabilities, scans and credentials. See Global search and system logs.
Exploitable Vulnerabilities Database	Grown to over 130,000 CVEs carrying real exploitation evidence — KEV listings, published exploits, proof-of-concept code, or a top-decile EPSS score — with a CVE detail view and full-text search, queried locally with no data leaving the deployment.
Command-line interface	Submit scans, query status and retrieve reports from a terminal or a script, with scanner selection and repository scanning mode as arguments.
Object storage	Scan artefacts and reports stored outside the database.

New to the AI features? AI providers and cost is the place to start — every engine on this page runs through the provider you configure there, and the cost controls described in it apply to all of them.

Last reviewed 2026-08-16