Upcoming Single-Tenant Version | 3.62

The Audit Trail now includes full visibility into SAST result triage activity. All changes to finding severity, state, and notes are captured with before and after values, including the user identity, timestamp, bulk action indication, and triage method (similarity-based or attack-vector-based). Users can access these events via the Audit Trail API.

This enhancement strengthens governance and compliance readiness, enables accurate forensic analysis of finding changes, and provides complete traceability for manual and bulk triage workflows.

Analytics and Reporting actions are now captured in the Checkmarx One Audit Trail, improving visibility into report-related activities performed by users and system integrations.

Relevant events are logged through the centralized Audit Trail framework using a standardized schema, supporting compliance, security investigations, and operational transparency. This enhancement extends audit coverage to reporting workflows initiated through integrations, APIs, and automation, ensuring consistent tracking across the platform.

You can now control the scope of AI Supply Chain scans by configuring include and exclude rules at both the global and project levels.

Exclude rules always take precedence over include rules, and configuration changes apply to subsequent scans only.

These settings follow the same patterns used by other Checkmarx One scanners, ensuring a consistent configuration experience across the platform. Teams can reduce scan noise by targeting only the files and paths relevant to their work, without changing how scans are executed or results are interpreted.

The Checkmarx One CLI now supports AI Supply Chain Security (AISC) as a standalone scanner type. Organizations can trigger AISC scans using the same workflow and commands used for other supported scanners, providing a consistent scanning experience across the platform.

Scanner availability is controlled by licensing, ensuring that AISC capabilities are available only to entitled customers. This addition does not affect existing scanner types, commands, or workflows.

Added a new grouping option based on Attack Vector ID, offering more precise, flow‑aware grouping than the default Similarity ID.

Each Attack Vector ID uniquely reflects the programming language, the vulnerability query, and the exact data‑flow path involved. Because any change to language, query, or flow produces a new ID, this grouping provides clearer separation of findings and supports more effective triage. See here for more information.

Risk Orchestration provides a unified view of all scan results across your security engines in a single, consolidated table. Instead of reviewing findings separately in each scanner, you can see everything in one place, organized by severity, and act on it without switching contexts.

Risk Orchestration is designed for everyone involved in application security:

For more information, see Risk Orchestration.

Checkmarx One now offers AI Triage & Remediation, an AI-assisted capability that helps you evaluate and fix vulnerabilities with less manual effort. The AI Triage agent analyzes new risks for reachability and exploitability, distinguishing theoretical risk from concrete, exploitable risk, while the AI Remediation agent generates suggested code fixes, creating a pull request automatically for Code Repository Integration projects, or providing in-app guidance for other project types. There are three ways to run these actions:

By combining automated risk analysis with AI-generated fixes, this feature reduces the manual effort required to distinguish real risk from noise and speeds up remediation without disrupting existing development workflows. A dedicated dashboard lets you monitor adoption and outcomes across your organization, and a separate credit usage view helps you track and manage consumption.

Current limitations:

For more information, see AI Triage & Remediation.

Checkmarx One now includes a Credit Consumption Overview page that gives administrators full visibility into AI credit usage across their tenant. Accessible from the administration area, the page consolidates several views into one place:

Checkmarx One now supports a persistent Confidential banner displayed in the header across pages, which cannot be dismissed by users. The banner is enabled per tenant by Checkmarx and supports custom text, such as "Internal Use Only," to match an organization's data classification terminology.

In addition, exported PDF reports now display a Confidential label stamped in the header of every page across all report types, including Scan, Project, Global, and Application reports. The label is centered and consistent with the header banner, ensuring that the confidential classification extends beyond the UI to any report generated and shared outside the platform.

Together, these capabilities help organizations meet internal data classification policies and audit compliance requirements by ensuring that confidential application security data is consistently labeled - whether viewed in the platform or distributed as a document.

Checkmarx One now supports exporting an AI-BOM directly from a project's scan results. Available from the scan results screen or via API, the export generates a CycloneDX-compliant bill of materials that represents the project as the root component, with all AI assets discovered in that scan - such as LLMs, AI SDKs and APIs, AI frameworks, AI agents, and MCP servers and clients - modeled as components connected through dependency relationships.

This gives teams a structured, shareable view of the AI supply chain for an individual project, supporting integration with governance and compliance tools.

Checkmarx One now performs deterministic risk assessment for LLMs as part of the AI Supply Chain Engine, with results exposed consistently across the UI, API, and CLI. This gives teams a reliable, unified view of LLM risk wherever they choose to access it.

An API is now available to disconnect a project's Code Repository Integration and revert it to a manual project, without requiring migration to a different repository. This simplifies the process for teams that need to remove a repository connection, and allows flexible workflows to be built around it rather than relying on repository-to-repository migration.

We have changed the terminology for the two types of Code Repository Integration projects to more accurately reflect the different configuration procedures. Cloud-hosted is now referred to as Managed Setup — indicating that it is a pre-configured procedure prepared by Checkmarx. Self-hosted is now referred to as Custom Setup — indicating that it needs to be configured by the user, but can be used for both self-hosted and cloud-hosted SCM instances. This is a terminology change only; the underlying functionality remains the same.

The Results by Legal Risks widget in the Scan Overview has been renamed to Legal Risks and now displays only the legal risks shown in the Risks → Legal Risks tab: "Risky effective license", "Package with no effective license", and "Package with no license".

The widget no longer displays "Unknown" categories that do not correspond to any actual risk type. This ensures the Scan Overview accurately reflects your project's legal risk posture and strengthens confidence in the scanner's output.

Policy Management now supports combining Net New findings with SCA-specific rules, removing the previous limitation where Net New logic and engine-specific rule configuration were mutually exclusive. When configuring an SCA risk-level rule, you can now select Net New as a status option alongside other filters such as severity and dependency scope. This enables you to create more granular policies, for example, breaking the build only when Net New vulnerabilities are found in production dependencies.

Improved accuracy of npm dependency resolution for modern projects (npm v7 or later) by leveraging the new native peer dependency resolution when available. This results in more complete dependency trees and broader vulnerability coverage.

Checkmarx now offers a new public REST API, POST /api/v1/packages/risks, for querying vulnerability and malware risk data on a batch of software packages in a single call. Consumers submit packages by PURL or by name, type, and version, and use optional parameters to control how much detail is returned, from basic risk scores up to full CVE details and remediation guidance. We also provide a dedicated endpoint for accessing Package Upgrade Recommendations directly from our database.

This gives customers a Checkmarx-native alternative to third-party vulnerability intelligence APIs, simplifying integrations such as SBOM management platforms.

For more details see the API in our API Reference Guide

The Containers tab is no longer shown in SCA scan results for scans with no container risks, which is now the expected result since Containers scanning runs as a dedicated engine. For scans performed before this change that include container results, the tab continues to be displayed as before. This keeps the scan results view clean and relevant.

The Users table in IAM now supports sorting by username, email, status, and last login, along with filtering by status, authentication provider, roles, and groups. Full group membership for each user is visible directly from the table, with the complete list accessible without being limited to a truncated summary. Columns can be resized, and the users list can be exported to CSV, with the export reflecting active filters, sorting, and visible columns.

These enhancements make it easier to analyze users, their access, and identity attributes at scale.

Added the ability to hide or display widgets in the Overview tab, with your preferences saved across all environments. Also added a filter-reset option to restore the default view with all widgets visible.

Allowed user actions are now validated through their permissions rather than specific roles. Admin users retain their abilities to add, delete, or edit user roles and their associated permissions.

Added OWASP API Top 10 to Checkmarx One. This includes new tags for OWASP Top Ten 2025 and API Top Ten 2023.