Version 3.62 | July 12, 2026

Risk Orchestration provides a unified view of all scan results across your security engines in a single, consolidated table. Instead of reviewing findings separately in each scanner, you can see everything in one place, organized by severity, and act on it without switching contexts.

Risk Orchestration is designed for everyone involved in application security:

For more information, see Risk Orchestration.

Checkmarx One now offers AI Triage & Remediation, an AI-assisted capability that helps you evaluate and fix vulnerabilities with less manual effort. The AI Triage agent analyzes new risks for reachability and exploitability, distinguishing theoretical risk from concrete, exploitable risk, while the AI Remediation agent generates suggested code fixes, creating a pull request automatically for Code Repository Integration projects, or providing in-app guidance for other project types. There are three ways to run these actions:

By combining automated risk analysis with AI-generated fixes, this feature reduces the manual effort required to distinguish real risk from noise and speeds up remediation without disrupting existing development workflows. A dedicated dashboard lets you monitor adoption and outcomes across your organization, and a separate credit usage view helps you track and manage consumption.

Current limitations:

For more information, see AI Triage & Remediation.

Checkmarx One now includes a Credit Consumption Overview page that gives administrators full visibility into AI credit usage across their tenant. Accessible from the administration area, the page consolidates several views into one place:

Checkmarx One now supports a persistent Confidential banner displayed in the header across pages, which cannot be dismissed by users. The banner is enabled per tenant by Checkmarx and supports custom text, such as "Internal Use Only," to match an organization's data classification terminology.

In addition, exported PDF reports now display a Confidential label stamped in the header of every page across all report types, including Scan, Project, Global, and Application reports. The label is centered and consistent with the header banner, ensuring that the confidential classification extends beyond the UI to any report generated and shared outside the platform.

Together, these capabilities help organizations meet internal data classification policies and audit compliance requirements by ensuring that confidential application security data is consistently labeled - whether viewed in the platform or distributed as a document.

Checkmarx One now supports exporting an AI-BOM directly from a project's scan results. Available from the scan results screen or via API, the export generates a CycloneDX-compliant bill of materials that represents the project as the root component, with all AI assets discovered in that scan - such as LLMs, AI SDKs and APIs, AI frameworks, AI agents, and MCP servers and clients - modeled as components connected through dependency relationships.

This gives teams a structured, shareable view of the AI supply chain for an individual project, supporting integration with governance and compliance tools.

Checkmarx One now performs deterministic risk assessment for LLMs as part of the AI Supply Chain Engine, with results exposed consistently across the UI, API, and CLI. This gives teams a reliable, unified view of LLM risk wherever they choose to access it.

An API is now available to disconnect a project's Code Repository Integration and revert it to a manual project, without requiring migration to a different repository. This simplifies the process for teams that need to remove a repository connection, and allows flexible workflows to be built around it rather than relying on repository-to-repository migration.

For more details see the API in our API Reference Guide

We have changed the terminology for the two types of Code Repository Integration projects to more accurately reflect the different configuration procedures. Cloud-hosted is now referred to as Managed Setup — indicating that it is a pre-configured procedure prepared by Checkmarx. Self-hosted is now referred to as Custom Setup — indicating that it needs to be configured by the user, but can be used for both self-hosted and cloud-hosted SCM instances. This is a terminology change only; the underlying functionality remains the same.

Improved accuracy of npm dependency resolution for modern projects (npm v7 or later) by leveraging the new native peer dependency resolution when available. This results in more complete dependency trees and broader vulnerability coverage.

Checkmarx now offers a new public REST API, POST /api/v1/packages/risks, for querying vulnerability and malware risk data on a batch of software packages in a single call. Consumers submit packages by PURL or by name, type, and version, and use optional parameters to control how much detail is returned, from basic risk scores up to full CVE details and remediation guidance. We also provide a dedicated endpoint for accessing Package Upgrade Recommendations directly from our database.

This gives customers a Checkmarx-native alternative to third-party vulnerability intelligence APIs, simplifying integrations such as SBOM management platforms.

For more details see the API in our API Reference Guide

The Containers tab is no longer shown in SCA scan results for scans with no container risks, which is now the expected result since Containers scanning runs as a dedicated engine. For scans performed before this change that include container results, the tab continues to be displayed as before. This keeps the scan results view clean and relevant.

The Users table in IAM now supports sorting by username, email, status, and last login, along with filtering by status, authentication provider, roles, and groups. Full group membership for each user is visible directly from the table, with the complete list accessible without being limited to a truncated summary. Columns can be resized, and the users list can be exported to CSV, with the export reflecting active filters, sorting, and visible columns.

These enhancements make it easier to analyze users, their access, and identity attributes at scale.