July 2026: Parser Fundamentals, New Connectors in v3.1.100, and Sensei

Hello everybody, this is Matt Tesauro, CTO and Co-Founder of DefectDojo.

So we're changing things up on the newsletter a little bit, and I'm here to give you a heads-up on the change. This will be the first of this new style, laying out a foundation for future editions of this newsletter. Expect it to be more of a spotlight on things I’m seeing in security and what we’ve been working on at DefectDojo.

And speaking of foundations, I was chatting with a friend in the profession who recently inherited an existing AppSec program via acquisition.

After spending some time getting to know things at this inherited AppSec program, he came to a pretty interesting observation, and I think it's worth sharing. He noticed that while the team had done some definite improvements, the maturity of the program wasn't where he thought it should be. Now, the team had really embraced using AI to help write a lot of the inevitable glue code you have to write when doing automation, but he found the results didn't really match up to the effort.

It felt like they were doing more and getting less to him. And thinking about this, he came to the realization that it was a lack of a foundation, a core overarching vision for what the team should strive for. That core vision was lacking, and this led to disparate, different, uncoordinated efforts that sometimes made the next iteration of maturing the program harder because they had to undo that prior work.

Basically they weren't being good to their future selves. So if you're starting on your AI-ification or already in the middle of your AI-ification journey, don't forget to think about the big picture, even though you might have teams that are now enabled to pursue goals at a higher speed and with greater autonomy.

Hope you enjoy the new newsletter.

Upcoming Events

July 29th: 101 Training: Introduction to Parsers

We’re continuing our 101 training series with the next session centered around Parsers. There are a lot of different ways to get security finding data into DefectDojo and additional options to tune deduplication, data fidelity, and downstream reporting. Register here.

DefectDojo Product Updates

DefectDojo Sensei: Auto Scan & Remediation

Last month we released the latest version of Sensei and made it generally available as a beta. It can automatically run scans, triage findings, and fix what it finds. Sensei can run autonomously or be supervised as part of our Managed AppSec Offering. We're scheduling private preview sessions if you or your team is interested, and Pro customers will get limited free access in the next two weeks. Learn more.

DefectDojo v3.1.100 Release

v3.1.100 was released last week and there are a slew of new updates for DefectDojo. Here’s a snapshot of what came out in the release:

• Connectors: Added a large batch of new Connectors. New findings connectors: CrowdStrike Falcon, Microsoft Defender, Veracode, Qualys, Rapid7 InsightVM, GHAS, HackerOne, Contrast, Google Cloud Security Command Center, Shodan, Wazuh, Cloudflare, Censys, Docker Scout, and Have I Been Pwned.
• Integrations: Added new outbound integrators for Jira (Cloud and Data Center, with per-transition custom fields, ticket templates, and a test-render path), PagerDuty, Shortcut, and Bitbucket Cloud.
• Search: Added cross-model global search backed by native Postgres full-text search and trigram indexes, so you can search across findings and related objects from one place.
• Notes: You can now @mention users in notes with autocomplete; mentioned users receive a notification.
• Performance: close_old_findings now fetches only the columns it needs, and uWSGI workers and Celery prefork children are recycled by memory to keep long-running instances healthy.

Check out the recent update to the Changelog for the full release notes.

That’s a wrap for July’s monthly newsletter. I can’t wait to see everyone at our Parser 101 training next week and if you have any questions or topics you’re interested in let me know.

Matt

PS: As some of you know, at OWASP Vienna I brought some freshly roasted coffee beans. Our sales team loved it so much that they created a customized label with Gemini. Maybe at the next event you’ll see more coffee at our booth.