Current Single-Tenant Version | 3.60

The HTML email body for reports sent by email now includes a structured header and a metadata section tailored to each report type, improving readability and customer-facing presentation.

When filtering the Analytics dashboards by tags, you can now specify which entity (application, project, scan) or combination of entities the filter applies to, enabling more granular and accurate filtering.

Added a new section, SAST Scanned Files, to the Project Report. This section lists each file analyzed during the SAST scan along with the number of vulnerabilities identified by the SAST scanner in that file.

You can specify to include (default) or exclude this section when generating reports via the UI or API. It is available for reports in PDF or JSON format.

This addition improves report completeness for audit, compliance, and governance use cases, and provides a more consistent reporting experience for teams migrating from CxSAST on-prem to Checkmarx One.

The Import Project wizard now includes improved keyboard accessibility for the project configuration flow. All service buttons are now fully focusable and operable via keyboard, and focus correctly reaches the Select Service section in sequence.

This update ensures enterprise users can complete project configuration and manual scan setup workflows without a mouse, improving WCAG 2.2 compliance and readiness for accessibility audits.

A persistent, non-dismissible header banner has been added to Checkmarx One. The banner appears at the top of all pages and remains visible throughout the session. Users cannot close, minimize, or remove it.

The banner is disabled by default. Checkmarx administrators can enable it on a per-tenant basis and customize the banner text via Global Settings. The default text is Confidential. Configuration changes take effect on the next session refresh.

This addition supports compliance with internal data classification requirements, ensuring confidentiality status is clearly and continuously communicated to all users.

The License page now displays Developer Assist seat usage alongside existing contributing developer information, with a breakdown by IDE.

The exported CSV file has also been updated to reflect both contributing developer and Developer Assist usage data.

Checkmarx One now supports rescanning a project directly from the latest source code already stored on the server, without requiring a new upload. The Rescan option is accessible from the actions menu of each project in the projects table.

Rescans are based on the last successful scan of the project, use the same engines, and automatically apply any updated project settings such as presets, exclusions, or scan mode changes. This feature is also available via API.

By eliminating repetitive file uploads, rescanning saves time, reduces manual effort, and ensures vulnerability assessments always reflect the most current code and configuration.

Policy management now supports configuring Net New Vulnerability rules at the scanner level, with severity thresholds set independently per scanner. Pull request results reflect the specific scanners and severities configured in the rule, reducing noise from scanners not relevant to the evaluation.

In addition, the Break Build option has been moved to the global policy level, outside individual rules.

These update give security teams greater precision in enforcing vulnerability policies.

AI Supply Chain Security (AISC) provides visibility into the AI components embedded in your code, helping address the growing challenge of Shadow AI - untracked models, agents, and integrations that introduce risk, unclear data flows, and compliance concerns.

AISC discovers and classifies AI assets directly from source code and configuration, identifying components such as MCP clients and servers, AI agents (for example, LangChain and Semantic Kernel), AI models, core ML libraries (for example, PyTorch and TensorFlow), and AI SDKs (for example, OpenAI, Anthropic, Vertex AI, and Hugging Face).

The feature includes end-to-end capabilities to operationalize this visibility, including scan orchestration for consistent analysis across projects, a dedicated results viewer for exploring detected AI assets, CLI support for CI/CD integration, and policy management to enforce governance and compliance.

With AISC, teams can uncover hidden AI usage, assess risk early, and maintain control over AI adoption across their software supply chain.

For more information, see AI Supply Chain Security.

Checkmarx One now includes a native MCP Server, enabling developers and AppSec teams to interact with security workflows directly from AI assistants and IDE chat interfaces such as Claude, Cursor, Windsurf, Kiro, and Copilot Chat.

Using a set of purpose-built tools, users can manage applications and projects, trigger and monitor scans across SAST, SCA, IaC, and Secrets Detection, and investigate security findings - all through natural language without leaving their development environment. An intelligent scan orchestration workflow allows developers to start with a simple command such as "scan this project" and seamlessly progress to prioritized results and remediation guidance. Vulnerabilities can also be reviewed and remediated directly within the chat interface using natural language interactions.

The MCP Server leverages Checkmarx One's existing authentication and role-based access control (RBAC) model, supporting both the pre-defined OAuth client (cx-mcp-client) and Dynamic Client Registration for flexible integration across different environments. It requires no additional licensing and includes comprehensive audit logging.

For more information, see documentation

The AI Supply Chain scanner is now available when configuring Code Repository Integration projects, providing visibility into AI assets used across your codebase. You can enable it alongside existing scanners during project import, project migration, and through project-level settings. Once enabled, AI Supply Chain scans are triggered automatically by SCM events such as push and pull requests, consistent with the behavior of other scanners.

This ensures comprehensive AI asset coverage across your projects without requiring additional configuration.

Repository URL management for Code Repository Integration projects has been improved to ensure consistent behavior across all APIs and views. The repository URL is now controlled exclusively by the SCM integration for imported projects - manual edits to the repository URL are blocked to prevent data inconsistencies and silent scan failures.

The URL is now reflected consistently across project views.

The Policy Violations Download API endpoint - GET /api/policy_management_service_uri/policy_violations - is now available, providing programmatic access to policy-violating findings from SCA and SAST scans. The endpoint auto-detects the relevant scanner from the provided Scan ID, returning SCA package violations, SAST vulnerability violations, or both when a project includes multiple scanners.

Group names can now include the colon (:) character. This update restores compatibility with existing naming conventions that use colons as structural delimiters, while maintaining the validation improvements introduced for other unsupported characters.

The Delta Scan feature in SCA has been updated to better determine when a full scan is required. The set of monitored files per package manager has been expanded, and scan arguments and platform configurations are now factored into the delta evaluation - ensuring that relevant changes always trigger a full scan and produce accurate results.

A new rule, Is Not a DEV or TEST Dependency, is now available in Policy Management under the Package Instance category. It evaluates to true when a package is not classified under either DEV or TEST scope, replacing the need to manually combine two separate rules. This enables more precise and efficient production dependency policy enforcement.

SCA scanning now supports an expanded set of private registries, enabling teams to analyze dependencies from credential-protected and on-premises sources. The following capabilities were added:

These enhancements give development teams greater flexibility to secure their full dependency landscape, regardless of where packages are hosted.

Learn how to set up the GitHub integration here.

Learn how to configure Gradle and Pip projects here.

Container scan results now support package-level muting and snoozing, allowing triage actions to be applied to a specific package across all images rather than being tied to a specific image name and tag. This is available both via the web application (UI) as well as API.

Managing triage at the package level lets teams apply one consistent decision across their entire image estate, cutting repetitive triage work and keeping pipelines from failing on vulnerabilities that have already been reviewed.

You can now record a browser flow and automatically turn it into runnable security tests. Your recording is converted into a DAST/API scan that uses your latest authentication details and follows the exact steps you performed with no manual setup.

When you run recordings through the CLI, you can assign a recording name. If you reuse the same name, CheckmarxOne will overwrite the previous recording, ensuring your scans always run against the most current version of your flow.

Both API and Web environments now let you manage your uploaded API collection and authentication scripts directly in an environment’s Settings, including viewing, downloading, deleting, editing, and adding new files.

Define business flows for each environment by organizing your recordings into sequences. You can upload single or multiple recordings, set their order, reuse recordings across flows, and edit or replace them as needed.

If you delete a recording, you will see how many sequences use it, and those sequences will skip that step. During scans, recordings run in the order you set. If a specific recording fails, any recordings that depend on it are skipped, and you receive a clear error with a screenshot so you can fix the issue.

Unsecured TLS connections now trigger an alert, prompting you to correct the server’s configuration. These alerts also appear in your scan results and are automatically included in the default policy when you set up your environment.