What's New

Release 2026.3.1 delivers a redesigned Vulnerability Assessment experience, a new Vendor Compliance Dashboard with automated notifications, and infrastructure improvements to scan reliability.

Vulnerability Assessment landing page

A new top-level Vulnerability Assessment page provides a single, filterable view of AI risk across all BOMs. Each row represents one BOM based on its latest completed assessment. Security teams can answer "where are my critical vulnerabilities?" in seconds rather than clicking through individual BOMs.

The page supports multi-select filtering and an artifact toggle updates severity counts and filter results in real time without a page reload. BOMs with no completed assessment display a "Run Assessment" prompt directly in the table. Both model vulnerabilities (by attack category) and technology vulnerabilities (by package CVE) are available as separate tabs, each with resolve and restore actions that capture a reason for auditability.

A CSV export option is available directly from the landing page. The export respects the current filters, sort order, and visible columns, and includes a column picker and BOM selector so the output matches downstream system requirements. This provides a ready path for importing vulnerability data into SIEM, GRC, or ticketing platforms while native integrations are in development.

Vendor compliance dashboard and automated notifications

A new My Vendors tab in the AI Manager gives enterprise customers an aggregated view of third-party AI Card compliance. A KPI bar at the top shows total vendors, total AI Cards, and counts for pending, declined, and overdue cards. Below it, a searchable vendor card grid supports sorting by name or most recently updated, with pagination options.

Clicking into a vendor opens a detail page showing all AI Cards with version history, associated BOMs, AI models used (tagged by severity), applicable compliance frameworks, and recent documents. Only AI Cards received through the publish/receive workflow appear in the dashboard. Direct uploads are not included.

The platform now automatically notifies vendors by email when a monitored AI System changes and the vendor's published AI Card is out of date. The notification lists affected AI Systems and stale AI Cards with a direct link to update. If the vendor does not update within seven days, an escalation email is sent to the customer. Vendors receive one notification per detection event with no repeated emails until the deadline passes.

Datasets and Infrastructure tabs removed from Vulnerability Assessment

The Datasets and Infrastructure tabs have been removed from the Vulnerability Assessment view. No underlying vulnerability data exists for these artifact types yet, and removing the empty tabs provides a cleaner interface.

Scan reliability improvements

Under-the-hood infrastructure work in this release improves scan reliability and status accuracy across the platform. A new job orchestration layer provides centralized tracking of scan jobs with durable state management, replacing a previous architecture that had no unified job registry. These changes are not visible in the UI today but lay the foundation for future scan monitoring and retry capabilities.

Bug Fixes

Detect AI scans were prematurely marked as "Success" while repositories were still scanning. Scan status now only transitions to "Success" after all repository scans and count updates are fully committed.
Arena, Shield, and Vulnerability Assessment used different methodologies to calculate vulnerability likelihood, producing inconsistent scores for the same vulnerability across views. A single unified calculation now weights each attack category equally, producing consistent scores regardless of where a vulnerability is viewed. Existing scores may shift as a result of this change (learn more in the Arena article).

Did this answer your question?