New 2025.2.8

Plexicus 2025.2.8: Optimized Workflows, Features and Security Fixes

Added support for BlackDuck and fixed import-related issues.

🚀 New Features

  • Added support for BlackDuck and fixed import-related issues.
  • Prioritized mandatory policies over best practices in findings management.
  • Introduced multiple tokens for the Plexalyzer connector.
  • Superadmin can now manage clients directly.
  • Integrated Azure Insights instrumentation for better monitoring.
  • CVSS score now displayed using a radar view.
  • Separated container & dependency scanner into 4 distinct categories for better organization.

🛠 Enhancements

  • Improved handling of findings creation of status not enriched
  • Applied enriched filters to all findings in downloads.
  • Enhanced UI elements for better clarity in finding details.
  • Improved the formatting of subscription start and end dates.
  • Updated login background image for a refreshed look.
  • Optimized the dashboard by ensuring only one date filter is used.

📋 Compliance & Customization

  • Enforced subscription restrictions in the upload scan workflow.
  • Adjusted worker permissions and cronjob configurations.
  • Updated pricing information for better transparency.

🔧 Integrations

  • Fixed issues with the BlackDuck importer and updated client data.
  • Resolved token parameter issues for Gitea repositories.
  • Improved SCM pipeline status tracking.
  • Added BlackDuck upload scan support.
Qualification

Check whether AI Swarm Pentest fits your environment.

Share the minimum context. We will review the scope and tell you the next commercial step.

Before submitting — verify you fit
Do you have a recent classic pentest you're not happy with?

0 / 280

No commitment. If you don't fit, we'll tell you.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorised target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)