What's New in CISO Assistant — Week 32, 2026 (v3.20.5 – v3.21.0)

Four releases in nine days, closing the v3.20 line and opening v3.21: v3.20.5 and v3.20.6 on August 1, v3.20.7 on August 3, v3.20.8 on August 4, and the v3.21.0 minor on August 8. This edition folds in the two August 1 patches that landed after last week’s post went out.

The v3.21.0 minor is one of the larger ones this year — two epics land at once, and a third capability arrives on the Pro side.

Headline Features

• Threat modeling with TTPs and MITRE ATLAS — CISO Assistant gains first-class support for Tactics, Techniques and Procedures. TTP catalogs come with searchable matrices and hierarchical relationships between tactics and techniques; on top of them sits a threat-model object with technique selection and an interactive graph editor, and threat models can be linked to risk scenarios. MITRE ATLAS ships as bundled catalog content, so adversarial-ML threat coverage is available out of the box. Legacy TTP entries can be excluded from threat searches and autocompletes so existing data doesn’t pollute the new catalogs, and English and French translations are included (PR #4602). Thanks to @ab-smith.
• Workflow engine with a visual builder — A full automation engine, built visually: triggers, actions, branching, loops, variables, secrets, schedules and subprocesses. Workflows are versioned, published and activated, with execution monitoring, retries, logs and run replay. Triggers can be webhooks, schedules or internal events, with validation and rate limiting on each. Definitions import and export as YAML against a versioned schema, and a workflow library offers previews and one-click instantiation. Security was designed in rather than bolted on — scoped authorization, secret protection, webhook signing and SSRF safeguards (PR #4491). Thanks to @nas-tabchiche.
• Customizable asset classes, rendered as a tree — Asset classes are no longer a fixed list. They now form a manageable hierarchy mixing built-in and custom classes, with translations and visibility control per class. The new asset tree browses classified and unclassified assets with counts, expandable groups and pagination, and class selection is searchable and filterable. Import and export understand canonical paths, with an option to create missing classes on import, and deletions warn about blocked references before cascading (PR #4626). Thanks to @ab-smith.
• Service accounts (Pro) — A service account is an identity for a script, CI pipeline or external system to call the API on its own: no human, no session, no interactive login. Authentication uses the OAuth2 client credentials grant, fully delegated to the OIDC identity provider built into CISO Assistant (PR #4528). Thanks to @tchoumi313.

Breaking Change

• Invalid implementation groups are now pruned on framework update — When a framework update removes an implementation group, selections still referencing it are now cleaned up consistently across compliance assessments, posture assessments and campaigns, instead of lingering as dangling references. Library conversion also gained an integrity check that fails fast when requirement nodes reference “orphan” implementation groups the framework never declared. If you maintain custom libraries, run them through the converter before upgrading — a library that used to convert may now be rejected (PR #4594). Thanks to @ab-smith.

Security & Hardening

• Word template management hardened — The Word export context is now wrapped in a proxy that exposes a presentation of each object rather than the object itself, closing off template-driven access to internals. Word Template settings also carry a visible reminder to review templates for security and compliance before use, localized across supported languages (PR #4607). Thanks to @tchoumi313.
• Security headers on the favicon endpoint — Favicon responses — success, fallback and error alike — now carry security headers, guarding against content-type misinterpretation (PR #4609). Thanks to @monsieurswag.
• Focus mode aligned with IAM — With focus mode active, global admins appeared to lose their global permissions: the UI advertised root-scoped entries and actions that the focused IAM engine then rejected with raw 403s. Focus mode now relies entirely on the user’s actual permissions rather than strict folder scoping, and root-folder and global items stay reachable while focus mode is on (PR #4470). Thanks to @tchoumi313.
• Missing permissions blocking domain export recovered — Solution subcontractor records were missing from several role permission sets, which broke domain export for some roles. Readers and approvers can now view them; analysts, domain managers and administrators can manage them fully, with test coverage across every exportable record type (PR #4614). Thanks to @ab-smith.

New Features

• Evidence previews for many more file types — Evidence detail pages now preview images, PDFs, videos, text, Markdown, DOCX, CSV and Excel inline. Spreadsheet previews handle multi-sheet tabs and frozen panes and skip hidden sheets, with clear messaging when a file is too large or a preview is truncated. Markdown and document rendering is sandboxed to keep unsafe HTML and CSS from executing (PR #4592). Thanks to @ab-smith.
• Rename qualifications to risk categories — A setting swaps the “qualification” terminology for “risk category” across labels, filters, forms, reports and analytics charts, for teams whose vocabulary expects the latter (PR #4574). Thanks to @eric-intuitem.
• Risk assessment import from the AI chat — Following last week’s spreadsheet import, the chat now supports importing risk assessments, on top of a refactor of the underlying import code (PR #4618). The in-window chat also gets more context about the session it’s running in (PR #4610). Thanks to @ab-smith.
• Status on findings assessments — Findings assessments now carry a status field (PR #4613). Thanks to @Axxiar.
• Progress percentage on documents — Documents derive a progress percentage from their status (PR #4606). Thanks to @Axxiar.

Framework & Library Updates

• Plumber CI/CD security checks — A new risk library covering GitHub Actions and GitLab CI hardening across six domains: supply chain security, secrets, permissions, triggers, access and workflow hygiene. Requirements cover action and image pinning, injection risks, branch protection, dependency updates, SAST, trusted publishing, concurrency and workflow naming, each with severity guidance, remediation detail, documentation links and implementation-group assignments (PR #4624). Thanks to @ab-smith.
• ANSSI industrial systems cybersecurity — The detailed-measures edition of the ANSSI guidance on industrial control system security (PR #4617). Thanks to @ab-smith.
• LPM/OIV metrics — The ten required metric definitions for LPM/OIV, plus CI improvements on library builds (PR #4589). Thanks to @ab-smith.
• Cwb (NIS2) control framework — A new NIS2-aligned control framework, shipped alongside improvements to the add/update framework tooling (PR #4636). Thanks to @tarkadia.
• CyFun 2025 in French and Dutch — The CyFun 2025 framework added a few weeks ago is now available in FR and NL (PR #4616). Thanks to @tarkadia.
• BIO2 capitalisation fix — Implementation group capitalisation in BIO2 is now consistent (PR #4591). Thanks to @EternalBlueScreen.

Internationalization

• Core cybersecurity metrics translations — Translations for the core cybersecurity metrics set (PR #4593). Thanks to @monsieurswag.
• Slovak, Dutch and Ukrainian updates — Refreshed Slovak (PR #4596, thanks to @datasecsro), Dutch (PR #4595, thanks to @ReViCo-be) and Ukrainian (PR #4611, thanks to @Punkoivan) translations, plus a batch of missing strings filled in (PR #4608, thanks to @Axxiar).

UX & Bug Fixes

• Incident UI improvements — A round of interface cleanups on incidents (PR #4598). Thanks to @ab-smith.
• Chat window file upload fixed — Uploading a file from the chat window no longer fails (PR #4599). Thanks to @ab-smith.
• Mail template reset button fixed — The “reset to default” button on mail templates was broken and duplicated; both issues are resolved (PR #4587). Thanks to @Axxiar.

Power BI Connector

The Power BI connector shipped a v1.0.2 release on August 1, adding debugging tips to the documentation and bundling CisoAssistant-starter.pbit — the starter report with a preconfigured model — directly in the release artifacts (PR #4600). Install the connector first, then open the template and enter your instance URL when prompted for BaseUrl. Thanks to @ab-smith.

Under the hood, this cycle also brought an architecture decision record template and a first entry documenting the dual-database decision (PR #4633), plus backend and frontend dependency upgrades across the board.

Welcome to new contributor @EternalBlueScreen, who made their first contribution in v3.20.5. For full details, check out the v3.20.6, v3.20.7, v3.20.8 and v3.21.0 release notes on GitHub.