Skip to main content

What's New

This release broadens apPosture from application testing into a full CNAPP-shaped posture: a new Cloud Posture discipline (CSPM / CIEM / attack paths), an AI Security discipline for the risks of AI-assisted development, and Breach & Attack Simulation that measures whether your controls actually stop the attacks apPosture proves. Everything folds into the same risk-weighted posture.

Cloud Posture (CSPM / CNAPP)​

A new Cloud Posture discipline assesses AWS, GCP and Azure accounts - agentless and read-only - against CIS and OWASP Cloud-Native controls, and rolls every account into one estate view.

  • CIEM - IAM privilege-escalation paths, only in unconditional Allow statements, with cross-cloud admin-role recognition.
  • Attack paths - toxic combinations that actually exist in the snapshot: internet → compute → IAM → account takeover, IMDSv1 credential theft, IRSA gaps, subdomain takeover, public data stores.
  • Standard vs advanced tiers - strict public-ingress ports (Docker 2375 → critical) and fail-closed coverage gaps so a permissions hole can never hide as a clean score.
  • Remediation as code & drift - copy-pasteable fix commands, plus finding- and resource-level change tracking between scans.

AI Security​

A new AI Security discipline covers the risks that come with building with AI:

  • AI-BOM - an inventory of the AI/ML footprint (models, frameworks, vector stores, AI SDKs, MCP) derived from your component graph.
  • AI config scan - flags injected instructions and unsafe agent settings in AI rules / config files (CWE-1427).
  • Slopsquat detection - catches hallucinated (404) and newborn packages before a supply-chain trap lands.
  • MCP server - apPosture's own read-only MCP server brings posture into any AI IDE.

Breach & Attack Simulation​

BAS safely re-runs the attack shapes apPosture already proves against a target and reports a control-efficacy percentage - how many were blocked. Every probe is non-destructive; it measures your defenses without weaponizing anything.

Mobile Security (MAST)​

A new Mobile Security discipline scans Android and iOS artifacts (.apk / .aab / .ipa) - static and offline, no emulator:

  • Static analysis - native SAST (Kotlin / Java / Swift / Obj-C) and Flutter / Dart, native-library and dependency SCA (Gradle / CocoaPods / Swift PM), AndroidManifest and Info.plist config, and in-app secrets.
  • Privacy & standards - an embedded-tracker catalog mapped to the user data it reaches, plus a MASVS A-D grade with L1 / L2 / R depth, ATT&CK Mobile, SSVC and compliance roll-ups.
  • Dynamic testing - discovered backend endpoints bridge into a full DAST scan, with an SSRF-guarded URL fetch and a Flutter TLS-unpinning helper.

The engine is now an agent pentester​

The second stage of a scan is no longer an "AI exploitation" step - it is an autonomous agent pentest you can watch and defend.

  • Agent Cockpit - a live, narrated, first-person view of the run: an "Agent now" intent line, a phased task tree with engine badges, a kill-chain that builds in real time, and a visible SAFE trust signal. See Agent Cockpit & Attack Trace.
  • Attack Trace - every confirmed finding leads with its proven kill chain: numbered agent steps, Validated / Working-exploit / SAFE chips, a masked proof receipt, and the Proven Impact in plain language - not a bare CVSS number.
  • Cross-finding chaining - the engine feeds one primitive forward: a leaked credential replayed against a privileged endpoint, an SSRF walked from the AWS metadata service to usable credentials, a reference followed into an object the crawl never reached (object-graph IDOR).
  • Deeper oracles - a fused boolean+time SQLi oracle, out-of-band and second-order / stored injection (with a delayed re-check), stateful race conditions, executed business-logic workflows, and a site-wide global-reflector pre-flight that kills reflection false positives at the source.
  • Proof-first attack chains - the Attack Map now ranks chains by proven hops, adds N-hop lateral movement, and marks runtime- or exploit-confirmed chains with a RUNTIME PROVEN chip.

API Security is a scored discipline​

API Security is no longer a spec viewer - it has its own A-F risk grade and a differentiated feature set:

  • Toxic combinations - public + sensitive + not-provably-authenticated, surfaced as one "Risky" verdict.
  • Code to runtime - every endpoint labelled Code + Runtime / From source / Runtime-only (the SAST + DAST differentiator).
  • Contract as truth - attach an OpenAPI spec and diff declared vs runtime into documented / shadow / declared-untested / auth-drift.
  • Discovery & runtime - agentless external / shadow API discovery, runtime-log correlation, and an API change timeline.
  • CI gate & SARIF - fail a pipeline below a score threshold, export SARIF 2.1.0.

Runtime confirmation with IAST​

A new IAST sensor runs inside your application (Python, Node, Java, .NET) and confirms when tainted input reaches a dangerous sink - the strongest evidence tier in the platform. IAST findings fold into the same correlated posture and feed the proof-first attack-chain ranking. It is off by default and token-gated.

Reports for whoever is reading​

  • Audience-targeted reports - a deterministic CISO Briefing, an AppSec Program report (funnel, aging, team scorecards, signal quality), and a Developer Worklist (risk-ranked fixes, no info noise).
  • Autonomous Pentest report - a vendor-grade, per-scan deliverable: Security Grade (A-F), scope & timeframe, compliance status by framework, and an OWASP Top 10 pass/fail appendix, rendered as a high-fidelity PDF.

Posture and workflow polish​

  • Kubernetes Posture - a hero risk gauge with a controls-breakdown bar, a unified Priority-fixes queue, click-through drill-downs, one-click cluster drift, and cluster removal.
  • Vulnerabilities - a flat, sortable column table with an All / Signal toggle and funnel-popover filters.
  • Security Policy - hardening presets (NIST 800-63B / CIS Level 1 / Strict), a meets-baseline badge, and a weaken-on-save confirm. The org-wide MFA mandate is now runtime-tunable.

Where to start​

Last updated on