What's New in CISO Assistant — Week 18, 2026 (v3.16.1)

A single release this week, but a meaty one. v3.16.1 lands a new journeys editor, Azure Blob Storage support, AI memory management improvements, and several new and refreshed framework libraries.

Headline Features

• Journeys editor — A new editor to author and tailor journeys directly in the product, building on the journeys preset work landed in v3.16.0.
• Azure Blob Storage support — Operators can now point CISO Assistant at Azure Blob Storage as an alternative to S3 for object storage. Thanks to @rborlone for landing this on their first contribution.
• AI chat memory — session truncation and compression — Chat sessions now manage memory more intelligently with truncation and compression, so longer conversations stay coherent without blowing the context budget.
• Experimental batch loading of evidence files — A new experimental UX flow to upload multiple evidence files at once.

Respondent & Third-Party Workflow

• Auto questions for respondents — Questionnaires can now auto-generate questions for respondents, reducing manual setup. Thanks to @Mohamed-Hacene.
• Respondent mode for third parties — Third parties can now operate in respondent mode end-to-end, also from @Mohamed-Hacene.
• Respondent defaults — fix — Defaults are now applied correctly. Thanks to @eric-intuitem.

Vulnerabilities & Findings

• EPSS — individual data pulls and self-documented feeds — Pull EPSS scores per CVE, with feeds that document themselves.
• CWEs and security advisories — feature flags — Both can now be toggled via feature flags. Thanks to @melinoix.
• Functional tests — security advisories and CWEs — Coverage added to the functional test suite, also from @melinoix.

Framework & Library Updates

• IEC 62443 series outline — A new outline covering the IEC 62443 industrial cybersecurity standards, with generated descriptions to help teams orient quickly.
• NIST CSF 1.1 — reference controls — The framework now ships enriched with reference controls, mirroring the treatment given to NIST CSF 2.0 last week.
• 🇫🇷 ANSSI — Sécurisation des systèmes de contrôle d’accès physique et vidéoprotection (v2.2) — The ANSSI recommendations on physical access control and video surveillance systems are now available. Thanks to @tarkadia.
• 🇲🇦 Moroccan Law n°09-08 — checklist — A practitioner-oriented checklist accompanying the Moroccan personal data protection law that landed in W17. Thanks again to @oulkhabou.
• ANSSI AD Security Assessment Checklist — refresh — The Active Directory checklist framework was updated. Thanks to @tarkadia.
• ISO 27001:2022 — typo fixes — Two typos in the English wordings cleaned up. Welcome to @kriss-b for their first contribution.

Data Wizard

• Perimeter import — new fields & documentation — Enhanced perimeter import functionality. Thanks to @tchoumi313.
• Audit & risk assessment — perimeter now optional — The data wizard no longer requires a perimeter on audit or risk assessment imports. Thanks to @monsieurswag.

Exports & Reporting

• CyFun CCB export — observation as comment (column M) — Observations now flow into column M as a comment when exporting CyFun CCB.

Performance

• Faster audit data loading — Audit pages now load faster while still honoring the implementation group filter on related fetches.
• RBAC filtering on FieldsRelatedField — RBAC checks and list endpoint aggregates are now leaner. Thanks to @nas-tabchiche.

Bug Fixes

• Threat search by ref_id — Threats are now searchable by their ref_id again. Thanks to @tarkadia.
• Score definition updates — regression resolved — A regression on score definition updates is fixed. Thanks to @eric-intuitem.
• Asset explorer — page title preserved — Toggling the domain display no longer wipes the page title.
• Translations — SLA settings, vulnerability feeds, CWE, security advisory — A round of translation fixes. Thanks to @melinoix.
• docker-compose.sh paths in config directories — Corrected. Thanks to @melinoix.

CI & Tooling

• Node heap size aligned with the Dockerfile — CI now matches the Dockerfile heap settings, avoiding OOM divergence between local and CI builds. Thanks to @nas-tabchiche.
• Paraglide upgraded — The i18n toolchain bumped to a newer version.

New Contributors

A warm welcome to two first-time contributors this week:

• @kriss-b — fixed two typos in the English ISO 27001:2022 wordings.
• @rborlone — shipped Azure Blob Storage support as an alternative to S3, a substantial first contribution.

For full details, check out the v3.16.1 release notes on GitHub.