October 2026: Mythos, 1,000 Free Sensei Fixes, and Triage Engine 101

Hey everyone

Happy Security Awareness Month! The month has already flown by and our team has been hard at work with a number of new features and initiatives.

In particular, 2 exciting things have happened in the last few weeks.

DefectDojo recently got access to Anthropic’s Mythos and we’re running internal testing ourselves to see how it stacks up and how security teams will be able to use it.
As part of Security Awareness Month, we’re giving out 1000 free fixes with DefectDojo Sensei. It’s available for free for all users until November 30th. Sign up for an account here or if you’re a customer, this should already be toggled on.

We’ve got a lot more in store for you in the next couple of weeks so be sure that you and your team are opted into the newsletter for those updates.

Upcoming Events

October 21st: Triage Engine 101: Building Automations in DefectDojo Pro

Every scan drops a new batch of Findings into DefectDojo, and someone has to decide what happens to each one. At 10 AM PT, we'll show how to turn those decisions into Triage Engine rules that assign owners and open Jira issues on their own, and how Simulate mode lets you check exactly what a rule would do before it goes live. Register here.

October 29th: AppSec Supper Club at LASCON

Heading to LASCON? We're hosting a small, invite-only dinner at Este in Austin for AppSec folks, starting at 6 PM CT. Expect good food and good conversation, with no presentations, no pitches, and no demos. Seats are limited and every request is approved by our team, and confirmed guests get Lyft codes for the ride. Request a seat.

Blogs, Research, and Reports

Here's what's new on the blog this month:

What Does a Vulnerability Actually Need to Tell You?
Finding a vulnerability is only the start of the decision; this post covers the context a finding needs before anyone can say what it means, who should care, and what to do about it.
What Causes DevSecOps Teams to Mismanage ASPM Tools?
Why ASPM tools end up as one more dashboard: missing ownership data, noisy duplicate findings, automation rules nobody maintains, and a tool that sits outside the developer workflow.
Why Do Companies Struggle With Vulnerability Management Platforms?
Most vulnerability management platforms stall on problems that live outside the platform: an incomplete asset inventory, scanners that disagree with each other, and no agreed owner for each fix.
What Is the Best Vulnerability Management Platform for Mid-Sized Tech Companies?
The right answer depends on where your risk lives, and if most of it is in your own code, dependencies, containers, and cloud, you need a layer above your scanners rather than another scanner.
Auto-Remediation Is the Holy Grail. Take 1,000 Fixes on Us.
Greg on why AI-written code and faster exploits make auto-remediation urgent, and the details on the 1,000 free Sensei fixes running through November 30th.

DefectDojo Product Updates

It's been a busy few weeks: five releases have shipped since the last newsletter, from v3.3.200 through v3.4.101, headlined by v3.4.0. Here's a snapshot of the highlights:

Sensei: Ask Sensei from any page. Answers are built from live views of your data.
Triage Engine: AI steps: three new nodes in an AI section of the palette (Check for False Positive, Assess Exploitability, and Group by Fix) ask Sensei one fixed question about the findings that reach them and route each finding out of a named exit, so the AI proposes and a person decides.
Remediation Center: A new beta module (feature flag remediation_center, off by default) that makes the remediation action the unit of work: open findings are grouped by the change that resolves them, one action per change per place, each with a due date, risk, owner, workflow status, and the findings it will close.
AI Inventory: A beta AI inventory (feature flag ai_inventory, off by default, requires Locations): every scanned repository gets an inventory of its coding assistants, MCP servers, models, AI packages, AI service endpoints, agent skills, and provider keys. Governance policies mark each as authorized, unauthorized, or needs review, unauthorized components become findings, and each Asset exports a CycloneDX 1.6 AIBOM.
Compliance: New regulatory scope foundation with EU regulatory control catalogs, EU regulatory assessments, and exportable EU evidence packs (now including the CRA Annex I Part I requirements), plus a PCI DSS compliance pack, FDA cyber device packs, a CRA Article 14 reporting interface, certification control catalogs for ISO 27001, SOC 2, and NIS2, and framework presets for UK Cyber Essentials and the Australian Essential Eight.
i18n: The Pro UI is now multilingual, with 27 languages available including German, Japanese, French, Spanish, Portuguese (Brazil), Hindi, and Arabic. A new setting lets you choose the interface language.
Sandbox: Sandbox Mode: a practice copy of DefectDojo Pro under /sandbox/, on its own database and preloaded with sample data, with Reset and Wipe for superusers. Nothing done in the sandbox reaches production.
Connectors: New Microsoft Azure and Google Cloud asset connectors, and a new Kenna Security (Cisco Vulnerability Management) connector. AWS Security Hub gains configurable asset grouping, and the same grouping and placement ladder comes to Microsoft Defender for Cloud, Prowler, Google Cloud SCC, and Lacework.

Check out the recent update to the Changelog for the full release notes.

That's a wrap for October's monthly newsletter. I can't wait to see everyone at our next training webinar and if you have any questions or topics you're interested in let me know.

Matt

Get the next one in your inbox.