Version 3.61 | June 28, 2026

The Audit Trail now includes full visibility into SAST result triage activity. All changes to finding severity, state, and notes are captured with before and after values, including the user identity, timestamp, bulk action indication, and triage method (similarity-based or attack-vector-based). Users can access these events via the Audit Trail API.

This enhancement strengthens governance and compliance readiness, enables accurate forensic analysis of finding changes, and provides complete traceability for manual and bulk triage workflows.

Analytics and Reporting actions are now captured in the Checkmarx One Audit Trail, improving visibility into report-related activities performed by users and system integrations.

Relevant events are logged through the centralized Audit Trail framework using a standardized schema, supporting compliance, security investigations, and operational transparency. This enhancement extends audit coverage to reporting workflows initiated through integrations, APIs, and automation, ensuring consistent tracking across the platform.

You can now control the scope of AI Supply Chain scans by configuring include and exclude rules at both the global and project levels.

Exclude rules always take precedence over include rules, and configuration changes apply to subsequent scans only.

These settings follow the same patterns used by other Checkmarx One scanners, ensuring a consistent configuration experience across the platform. Teams can reduce scan noise by targeting only the files and paths relevant to their work, without changing how scans are executed or results are interpreted.

The Checkmarx One CLI now supports AI Supply Chain Security (AISC) as a standalone scanner type. Organizations can trigger AISC scans using the same workflow and commands used for other supported scanners, providing a consistent scanning experience across the platform.

Scanner availability is controlled by licensing, ensuring that AISC capabilities are available only to entitled customers. This addition does not affect existing scanner types, commands, or workflows.

Added a new grouping option based on Attack Vector ID, offering more precise, flow‑aware grouping than the default Similarity ID.

Each Attack Vector ID uniquely reflects the programming language, the vulnerability query, and the exact data‑flow path involved. Because any change to language, query, or flow produces a new ID, this grouping provides clearer separation of findings and supports more effective triage. See here for more information.

The Results by Legal Risks widget in the Scan Overview has been renamed to Legal Risks and now displays only the legal risks shown in the Risks → Legal Risks tab: "Risky effective license", "Package with no effective license", and "Package with no license".

The widget no longer displays "Unknown" categories that do not correspond to any actual risk type. This ensures the Scan Overview accurately reflects your project's legal risk posture and strengthens confidence in the scanner's output.

Policy Management now supports combining Net New findings with SCA-specific rules, removing the previous limitation where Net New logic and engine-specific rule configuration were mutually exclusive. When configuring an SCA risk-level rule, you can now select Net New as a status option alongside other filters such as severity and dependency scope. This enables you to create more granular policies, for example, breaking the build only when Net New vulnerabilities are found in production dependencies.

Added the ability to hide or display widgets in the Overview tab, with your preferences saved across all environments. Also added a filter-reset option to restore the default view with all widgets visible.

Allowed user actions are now validated through their permissions rather than specific roles. Admin users retain their abilities to add, delete, or edit user roles and their associated permissions.

Added OWASP API Top 10 to Checkmarx One. This includes new tags for OWASP Top Ten 2025 and API Top Ten 2023.