🚀 What’s New
- AI SAST covers C#/.NET and Razor: The scanning engines now detect vulnerabilities in C#/.NET and Razor files, including SQL injection, process argument manipulation, file operations, weak cryptography, certificate validation bypasses, and CORS configuration issues. Findings in all other languages remain unchanged.
- PlexiFlow editor rebuilt: The automation editor now features undo/redo with full history, a visual condition builder for IF/SWITCH branches with natural-language previews, searchable pickers for repositories, branches, tools and developers, and a schedule builder with presets, timezone search and a next-run preview. Test runs work for every trigger type — you can simulate schedule and webhook flows without pasting a finding ID.
- PlexiFlow run panel with suggested actions: Every run outcome now shows a translated explanation and a one-line Nextstep suggestion, so you always know what to do after a flow completes, pauses for approval, or encounters an issue. Step facts like approval decisions and branch names are also translated.
- XBOM licence resolution: Components found only in manifests (requirements.txt, package.json, .csproj) now have their declared licences resolved automatically from package registries, so your SBOM no longer shows unknown for these dependencies.
- BYOAI model alignment: Codex Remedium now uses the same Smart model you configured for remediation across all entry points, ensuring consistent AI behavior whether you trigger a fix from the UI or an automated flow.
🛠 Improvements
- Dashboard KPI accuracy: A comprehensive audit pass ensures every Dashboard widget — risk posture score, findings trend, ROI card, OWASP chart, and severity breakdowns — matches your live data. The risk posture score is now normalized per asset, the findings trend axis spans the full selected date range with no dropped days, and the ROI card respects your dashboard time filter. Clicking an OWASP card now lists exactly the findings the card counted.
- SSO group role mappings sync on every login: When you change a user’s IdP group membership in Entra ID or another SSO provider, their Plexicus role updates automatically on their next sign-in — no re-provisioning required. Users in more than 200 Entra ID groups are now resolved correctly through Microsoft Graph.
- Azure DevOps seat counting: Azure DevOps team members are now included in seat counts, ensuring accurate billing for organizations using Azure DevOps as their SCM.
- Pentest unit refunds on cancellation: Cancelling an AI Pentest that produced no report and no findings now refunds your Pentest Units in full. Any delivered result commits the charge.
- Per-repository tool selection restored: The repository tools modal once again offers IaC, CI/CD Posture, Container Security and License scanning as per-repository options.
- Customer reminder emails refined: Onboarding and piloting reminder emails now respect a configurable recency window, cap the number sent per run, and never repeat for the same client — so your team gets helpful nudges without inbox fatigue.
- Findings re-enrichment sweep expanded: Findings marked as degraded during enrichment are now automatically picked up by the periodic re-enrichment sweep, so they get a second chance at full enrichment without manual intervention.
- PDF findings report matches your filters: The PDF report now applies the same filter defaults as the findings list — excluding sandbox, false-positive, duplicate and sub-findings — so exported reports match what you see on screen.
- Codex Remedium empty-diff detection: When a remediation generation produces an empty diff (nothing to change), it is now marked as failed with a clear reason instead of appearing as a successful fix with nothing to apply.
🔒 Security
This release strengthens authentication and access controls across the platform:
- SSO role-sync changes are now recorded in the audit log, giving you full visibility when a user’s role changes via IdP group membership
- Approval gates in PlexiFlow enforce the configured approver role, so only users with the designated role can approve or reject a waiting flow step
- Pentest log scrubbing is extended to the pentest detail view, ensuring stored authentication for engagement targets never appears in log output
- Server-side Turnstile verification is available for password login, adding an optional bot-protection layer that can be enabled by administrators
🔧 Fixes
- Findings list no longer flashes empty or loads stale data — the list loads cleanly every time, with no race conditions.
- False-positive mute opens its pull request correctly, and un-muting cleans up properly so the finding returns to its original state.
- Failed or degraded tool statuses clear after a clean scan, so your repository no longer shows a stale failure reason after a successful re-scan.
- PlexiFlow canvas shows branch handles and labelled edges for IF yes/no, on-failure and SWITCH cases, making complex flow logic easy to follow at a glance.
- PlexiFlow schedule and trigger configuration persists reliably — cron schedules, timezones and webhook settings are saved correctly on every edit.
- PlexiFlow validates ambiguous flow branches — two edges leaving the same branch for different targets are now caught at save time, preventing a silent step from never running.
- Scans wait up to 30 minutes for capacity before failing, with automatic backoff — so transient cluster constraints no longer cause immediate scan failures.
- XBOM inventory drops junk file-type components that carried no package identifier, keeping your asset inventory clean and actionable.