Implemented

🕵️ Fraud risk center: We said it was coming, and it shipped. The new view groups open vulnerabilities into Account Takeover, Data Harvesting, Payment Fraud and Fake Accounts, and shows only those reachable from the internet that affect confidentiality or integrity. 

When a risk is urgent, you can request priority remediation for one affected system or all of them, and the responsible contacts are notified right away. Available on Essential and Advanced plans through the new read-only Fraud Analyst role. Give it to your fraud-prevention team, not just AppSec.

🔑 Secret verification: Secret Scanning (SS) now tells you which credentials still work. Many detection rules include a verifier that asks the provider whether the secret is still valid, and it runs automatically. Active secrets are reported with a CVSS v4.0 vector ending in E:A, and unverifiable ones with E:U. 

Inactive secrets are dropped from the results and don't count toward the vulnerability count. Each check sends one request, only to the provider that issued the secret.

🎯 VLAI severity: Two vulnerabilities of the same weakness can carry very different risk, yet scanner results used to inherit a fixed severity from their weakness. Vulnerability Language AI (VLAI) reads the description and context of each vulnerability, rates it Low, Medium, High or Critical, and shows a confidence percentage. 

The score now appears for every finding across all manual and automated testing techniques in ASPM, so your team can focus on the vulnerabilities that really matter.

🌐 Group content language: When you change a group's content language, the platform now translates the content the group already has: findings, comments, reattack comments, evidence captions and reports. Everyone on your team can read the full history in the language they work in.

⚙️ New sub-processor: We've extended our AI infrastructure with a new provider, giving us access to leading open-source models. 

As part of our commitment to transparency in customer data management, we would like to inform you that we have engaged Fireworks as a sub-processor. For a full picture, visit our Trust Center.

Upcoming

🗺️ Discovery: An organization-level map of every asset you have, such as repositories and environments, both inside and outside Fluid Attacks' testing scope. Available as a paid add-on feature.

⚠️ Action required: Azure DevOps reauthorization 

Microsoft will deprecate the Azure OAuth credentials that use a legacy method on December 31, 2026. The platform already works with the modern method, and reauthorizing switches your integration to it. 

The credential owner must complete this process:

•  For Azure Credentials, go to Credentials, find and select the credential, click Manage Credentials, and then click Reauthorize. 
• For Azure Issues, go to Integrations, open Azure DevOps, find the group, and click Reauthorize.

 See Microsoft's documentation and our reauthorization guide.

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.