September 2026: A New Look for DefectDojo, CSPM, and Reporting 101

Hello everybody, this is Matt Tesauro, CTO and Co-Founder of DefectDojo.

If you clicked defectdojo.com today, you saw it before I could tell you: DefectDojo has a new look, new logo, and a new stance. And I want to be clear about what it means, because this is more than just a new coat of paint.

Since our OWASP days, we've watched security teams get sold the same story: buy more scanners = more security. What you actually got was sprawl and security vendors upcharging you for features you need to do your job. Duplicates counted three times over, and no straight answer to "what do we fix first?". And especially now, AI has fundamentally changed the rules of engagement with how to mitigate, respond, and fix vulnerabilities at a speed that no human can adequately react to 24x7.

The lie that has been fed to security teams cannot persist.

DefectDojo's job has been to unify the noise your scanners generate and tell you what matters most. That continues to be a pillar, but when we asked customers and users what would actually move the needle, the answer wasn't a better list of problems. It was fixes that reduce risk at a faster velocity.

So we're becoming a platform that not only just identifies risk but fixes it: Sensei opening the pull requests that close findings, CSPM applying reversible remediation to cloud misconfigurations, threat modeling catching design flaws before there's code to scan. You'll see that thread running through this month's product updates below.

And the part that makes us different doesn't move an inch. Your findings are yours and your data is yours: no paywalls in front of them, no black boxes adding more confusion. The Community Edition will always be free, and our roadmap and mission will always be shaped by our users.

What changes now is a new conviction: Where running an end-to-end security program doesn't have to cost millions of dollars. Where security findings can be prioritized and remediated within minutes. Where your security isn't dictated by your headcount and tool budget.

The practitioner sets the terms now.

We're excited for this new direction and welcome you all to join the underground.

Plenty more below: where to find us next, what we've published, and everything that shipped this month.

Upcoming Events

September 30th: Introduction to Reporting in DefectDojo

You've imported your scan data and triaged your findings; now an engineer needs a fix list, an auditor needs evidence, and leadership wants the trend line. This session covers the fundamentals of reporting in DefectDojo, from the metrics the platform tracks automatically to building reusable reports with Themes, Blocks, and Templates in Pro's Report Builder, whether you run Community Edition or DefectDojo Pro. Register here.

Blogs, Research, and Reports

The blog kept pace with the releases this month. Here's what's new:

• Getting Started with DefectDojo in 10 Minutes or Less
  A 10-minute walkthrough from creating your first Asset to importing scan results and prioritizing what matters, without disrupting the workflows you already have.
• Your Triage Work is Now an Export: SBOMs and VEX from DefectDojo Pro
  Sooner or later someone will ask for your SBOM. How Pro's SBOM and VEX exports carry your triage decisions with them, so the component list and the "what are you doing about it" ship together.
• DefectDojo Sensei Now Fixes Your Cloud Too: CSPM for AWS, Azure, and GCP
  Matt on extending Sensei's scan-and-fix loop to the cloud: posture scans and direct remediation of misconfigurations across AWS, Azure, and GCP.
• The Vulnerability Explorer: EPSS, KEV, and Root Cause Analysis in One View
  Greg on the gap between what scanners report and what teams actually fix, and the new Explorer view that puts EPSS, KEV, and root cause analysis in one place.
• Threat Modeling in DefectDojo: Find Design Flaws Before the Code Exists
  Why the cheapest vulnerability to remediate is the one you catch in the design document, and how the new Threat Modeling beta finds flaws before your scanners have anything to scan.

DefectDojo Product Updates

It's been a busy month: six releases have shipped since the last newsletter, headlined by v3.3.0 in early September. Here's a snapshot of the highlights:

• CSPM: Added Cloud Security Posture Management: connect AWS, Azure, and GCP cloud accounts, run posture scans against them, and apply reversible direct remediation to the misconfigurations that are found.
• Correlation: Cross-domain finding correlation groups related findings into shared root causes. A finding's page now lists its root causes, root-cause blast radius feeds finding prioritization, and a new Top Root Causes dashboard widget plus a Product breakdown show where risk concentrates.
• Sensei: Added a generic fix flow: you can now associate a repository with a finding inline, and a gap-closing wizard walks you through anything else Sensei needs before it can generate a fix. Also added Sensei Advisor, which recommends settings changes and offers one-click fixes for mechanical deduplication-hygiene issues, plus Amazon Bedrock as an on-prem LLM connection. The Sensei engine now ships in the on-prem compose bundles.
• Deduplication: Added Dedupe Pools: group the Assets that should deduplicate against each other, choose where their originals collect, preview what a membership change would link, and re-run deduplication over the Findings already in scope with Apply Now.
• Custom Fields: Added typed Custom Fields: define your own fields across seven datatypes and attach them to six entity types. Custom field values are tracked in the audit log, and Rules Engine 2.0 rules can read and write them.
• Compliance: Added FIPS 140-3 image support (FedRAMP SC-13), PAIN-keyed FedRAMP VDR remediation deadlines, and a FedRAMP prioritization preset, plus DISA STIG checklist import (.ckl/.cklb) with a CCI to NIST 800-53 crosswalk.
• Connectors: New Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only; registered the Aikido Security, Jit, and Cycode connectors; and added asset exposure reporting from Wiz, Shodan, and Censys, and from CrowdStrike Spotlight. Connectors also gain per-record sync checkpoints so an interrupted sync resumes, and health notifications when a connector stops working or authenticates but sees no data.
• Dashboards: Dashboards 2.0 expands into the DefectDojo Command Center, with a published security-posture score.

One heads-up: as flagged last month, 3.3.0 has now retired the classic Bootstrap UI and the classic report engine; Menu 2.0 and the Pro Vue UI are now standard, and the maintenance window feature has been removed.

Check out the recent update to the Changelog for the full release notes.

That's a wrap for September's monthly newsletter. I can't wait to see everyone at our next training webinar and if you have any questions or topics you're interested in let me know.

Matt