Current Multi-Tenant Version | 3.64

The Risk Orchestration table now supports column management across SAST, SCA, IaC, DAST, Containers, and Secrets. You can show or hide columns, reorder them via drag-and-drop, and filter or sort by any column, with your preferences saved for future sessions.

Since engines expose different columns, shared columns stay consistent across engines while engine-specific columns remain available for deeper context. This gives teams a more tailored view of risk data that better fits their workflow.

AI-BOM export from Global Inventory now runs through the unified reporting pipeline for a more consistent, reliable experience. You can trigger the export as before and download it once it's ready.

This ensures dependable exports, even for large inventories.

You can now triage SAST and SCA risks directly through the MCP Server, without opening Checkmarx One. Using your AI assistant, you can update a risk's state, such as marking it Confirmed or Not Exploitable, add a comment, and view its triage history within your existing workflow.

This lets teams review and remediate risks faster, without switching context between tools.

Scan results from imported BYOR files are now included in analytics and reports, alongside results from standard scans. This data is available wherever project or application-level reports are generated.

As a result, reports reflect a complete and consistent view of all scan results, regardless of how they were produced.

When triaging BYOR imported findings, you can now attach a comment or note to a state change, consistent with the triage experience for findings from Checkmarx One built-in engines.

The scan summary API now includes AI asset counters, enabling the CLI to display asset data alongside existing scan results. CLI users who initiate AI Supply Chain scans can now view the assets table directly in their CLI output.

The AI Supply Chain Global Inventory now displays code snippets for each detected asset, consistent with the existing behavior in Scan Results. When viewing an asset in the inventory side panel, you can see the code snippet for each evidence item and copy the file path. Assets with multiple evidence locations display a snippet for each occurrence.

The /api/results endpoint now returns custom triage states for API Security findings. When a custom state has been applied to an API Security vulnerability, it is reflected in the customState field of the response, consistent with how custom states are surfaced for other scanners.

SCA archive unpacking now supports tgz, rpm, and whl files, expanding on the existing capability to detect and analyze package manifests found inside archive and package files. This applies to both Checkmarx One cloud scans and the SCA Resolver CLI, using the same unpacking pipeline already applied to other supported archive types.

With this expanded coverage, teams working in Linux, Red Hat, and Python ecosystems get accurate dependency and risk visibility for software distributed as pre-packaged archives, without any change to existing scan configuration.

The CycloneDX SBOM generated by Checkmarx One is now compliant with version 1.7 of the CycloneDX specification. As part of this upgrade, each component in the SBOM now includes evidence of its provenance and detection method: the file path in your project that produced it, and whether it was identified through manifest analysis or hash comparison, with both shown separately when a component was identified through more than one method.

This is available in the CycloneDX SBOM downloaded from Checkmarx One, whether generated through the UI, API, or CI integration.

By aligning with the latest CycloneDX standard, the SBOM is more useful for enterprise audit, provenance, and compliance workflows.

SCA now extends its C/C++ open source detection to include packages sourced from vcpkg, in addition to the existing Conan-based detection.

Since C/C++ projects don't have a standardized manifest or lockfile format, SCA identifies open source packages using fingerprint analysis; this analysis now runs against a combined Conan and vcpkg fingerprint database. Detected vcpkg packages appear in scan results with their name, version, and source registry, along with any associated risk data from the Checkmarx security knowledge base.

This gives teams that manage C/C++ dependencies through vcpkg the same visibility into open source risk that Conan users already have, closing a previous blind spot in C/C++ scanning.

Guided scan results now show errors from the recordings used in a scan, so you can see which recordings failed and why. This also shows how each recording affected scan coverage - including any additional paths or vulnerabilities it uncovered.

You can now define additional attributes when uploading an API file for scanning. Add key/value variables to Postman files, set a Target URL for OpenAPI/Swagger, or an Endpoint for GraphQL schemas.

This is especially helpful when a file's paths are relative and don't specify a host. Once saved, uploaded files show an icon indicating extra attributes are attached, with options to edit or delete them.