August 2026: Reachability, Threat Intelligence, and AI Use Cases with Dojo

Hello everybody, this is Matt Tesauro, CTO and Co-Founder of DefectDojo.

Apparently, AI is hacking more than just gym classes these days. It certainly stole all the air out of the vendor space at Black Hat, where it appeared that having "agentic" on your booth was part of the entry fee. Still, AI floods are real as systems designed to work at people speed are getting interactions at compute speed.

Looks like the velocity of change isn't slowing down anytime soon. Although some interesting developments are happening in response to AI regulation (like Anthropic's new AI watermarking).

Speaking of velocity, in the last few weeks our team has put out some exciting new features like: Reachability, Threat Intelligence, our brand new Triage Engine (aka a more intuitive design for our Rules Engine), and not to mention we've surpassed over 500 new parsers/integrations!

We've been busy at DefectDojo, and if you haven't already joined our Slack community, be sure to join us to get the weekly changelog notification in #03-release-notes.

Hope you enjoy the new newsletter.

Upcoming Events

August 26th: AI Use Cases with DefectDojo Pro: Maturing Vulnerability Management Overnight

Last year we released our DefectDojo MCP to allow you to utilize LLM's to create reports and query data in DefectDojo. Since then, we've built up more use cases using MCP and DefectDojo Sensei to do some very cool things. Join us for our next training session as we cover some uses cases and more. Register here.

Blogs, Research, and Reports

The team has been busy on the blog this month. Here's what's new:

• Getting Data Into DefectDojo: A Practical Introduction to Parsers and Connectors
  Built from our July Parsers training session: what a parser actually does, the five ways to get data into Dojo, and how deduplication tuning works.
• Exploit Evidence, Built Into Your Priority Score: Threat Intelligence in DefectDojo Pro
  How exploit availability, known exploitation, and threat-actor activity now feed directly into Priority and Risk.
• Introducing Rules Engine 2.0: Visual Automation You Can Actually Trust
  Greg on the new visual automation builder: rule graphs, simulate mode, per-run traces, and egress to Jira, Slack, and beyond.
• FIPS 140-3 Mode: How DefectDojo Pro Clears the Cryptography Bar for FedRAMP
  What FIPS 140-3 mode changes in DefectDojo Pro and why it matters for FedRAMP-bound deployments.
• A Critical CVE You Can't Reach Is Not Your Biggest Problem: Introducing Reachability in DefectDojo Pro
  Why reachability changes the risk math, and how DefectDojo Pro's new Reachability verdicts fold into prioritization.

DefectDojo Product Updates

It's been a big month: nine releases have shipped since the last newsletter, headlined by v3.2 in early August. Here's a snapshot of the highlights:

• Rules Engine 2.0: Build automation rules as visual node graphs that react to Finding events, with per-run traces and a delivery outbox. Rules can now also be given their own schedule.
• Threat Intelligence: Threat Intelligence Enrichment reached general availability, with signed threat-intel bundles and new list and dashboard surfaces, plus a threat-intel risk floor based on whether a Finding has EPSS, KEV, or other exploitability.
• Compliance: The federal compliance pack: FedRAMP POA&M ledger and ConMon deliverables, CMMC Level 2 assessments, and control coverage. Optional FIPS 140-3 image variants (CMVP #5247) are also available for the connectors service, MCP server, integrators, and PSIRT advisory engine.
• Connectors: Added three more large batches of Connectors covering 75+ new tools, including Fortify, HCL AppScan, Aqua Security, Orca, Sonatype IQ, Mend, Black Duck, Bugcrowd, Cobalt.io, OpenVAS, Prowler, Kubescape, AppCheck, and CyCognito. Plus new Messaging Connectors (beta) that send alerts to Slack, Microsoft Teams, email, or an Amazon SNS topic, routed by Rules Engine 2.0.
• VEX: Added CycloneDX SBOM / VEX / VDR export and import, as a round trip: a document exported from DefectDojo can be imported back into DefectDojo.
• RBAC: Added user-defined Custom Roles with a granular permission set per object type, and SCIM 2.0 provisioning so your identity provider can create, update, and deactivate DefectDojo users directly.
• Work Assignment: Assign Findings and Risk Acceptances to individual people, alongside the existing group Owners, and give each person a My Work queue of what they are responsible for.

One heads-up for reporting users: the classic report engine (Report Builder, Report Templates, and Generated Reports) will be removed in 3.3.0 on September 8, 2026. Both the classic and new Report Builder now offer a one-click migration of your existing report templates, so you can move on your own schedule.

Check out the recent update to the Changelog for the full release notes.

That's a wrap for August's monthly newsletter. I can't wait to see everyone at our next training webinar and if you have any questions or topics you're interested in let me know.

Matt