What we've shipped lately: September 2026

New features have been rolled out to manage AI pentest findings directly within the portal, integrating them alongside existing security scan issues for a unified workflow. Users can now connect Bitbucket or Azure Repos to initiate AI pentests against their codebases. A key feature is the ability to retest specific findings to validate fixes with unlimited, free retests. The platform also enhances scanning capabilities by allowing authenticated scans across multiple domains, including application, APIs, and authentication providers. Furthermore, integration with Azure DevOps is improved, allowing control over which targets and tags generate work items. An automated validation step for SQL injection findings suppresses false positives before they are presented to the user, and a new feature allows monitoring the trend of the Cyber Hygiene Score over time.

The narrative pivots on shifting security management from a siloed process into an integrated, continuous workflow where AI analysis is not an external report but an intrinsic part of development operations. The introduction of features like unlimited retests and cross-domain scanning addresses key friction points in security remediation by operationalizing feedback loops directly within the existing tooling. This attempts to build cognitive sovereignty by making complex vulnerability management feel less like a separate audit and more like iterative coding. However, the focus on automating validation, such as auto AI SQL injection checks, raises questions about the threshold for trust placed in automated suppression mechanisms; when does suppressing potential noise become riskier than investigating it? The pattern observed is the systemic push toward contextualizing data—taking raw vulnerability scores and applying context (fixes, domain boundaries, workflow integration) to increase agency. The cost borne by this system must be scrutinized: while reducing triage noise benefits human effort, an over-reliance on automated suppression might inadvertently mask genuine, subtle issues that require nuanced human judgment, potentially shifting cognitive load rather than alleviating it. What assumptions about the efficacy of AI-driven noise reduction are being made, and who controls the guardrails around what is suppressed?