What's New in CISO Assistant — Week 39, 2026 (v4.0.5)

Two releases to cover: v4.0.5 and Power BI connector 1.1.0, both published on September 19, a few days after last week’s v4.0.4. This one is dense — a table view for framework mappings, relation graphs on detail pages, a reworked command palette, five new workflow capabilities, two new libraries, and a connector release that is effectively a repair for the API pagination contract 4.0 introduced.

Mappings, Now as a Table

The mapping explorer had one view: a graph. Good for seeing the shape of a mapping, poor for the question people actually ask of it — which of my requirements does this thing cover, and how well?

A table view now sits beside the graph (PR #4837). You can read mappings one-to-one, grouped by source, or grouped by target; search them, filter by relationship type or coverage, sort the columns, page through, and export the result to CSV. Relationship, strength, rationale and annotations are all columns, and unmapped requirements are listed rather than silently absent — which is the half of a mapping that matters most when you are deciding whether to trust it. Coverage summaries sit above the table, the labels are localized in English and French, and the table loads progressively so opening it does not block the graph. Thanks to @ab-smith.

Relation Graphs on Detail Pages

Rather than a single explorer, the graph idea moved to where the objects are (PR #4832). Supported detail pages gain a Relations Graph — a small neighbourhood view you can filter, expand node by node, and re-lay out — so the question “what is this control actually attached to?” is answered on the control’s own page. It ships behind its own feature flag, off until you turn it on.

Alongside it, an experimental Domain Whiteboard (Pro) lets you create, rename, move and delete domains on a canvas, with confirmation before applying and proper conflict handling when someone else has moved the tree underneath you. It lives under Experimental, and the folder-reorganization backend behind it gained real validation, batch handling and rollback — worth knowing even if you never open the board, since the same code path guards ordinary moves. Assets can now also be linked to document containers, and selected through the form. Thanks to @ab-smith.

The Command Palette Grows Up

The palette was a navigation shortcut. It is now three things at once (PR #4852):

• Search — an authenticated, permission-aware universal search with fuzzy matching and ranked results, over more object types and more fields than before.
• Add — creation actions that open the right form directly, offered only for models you may create.
• Command — including handing a question to the AI assistant.

Keyboard shortcuts and argument-based commands come with it. The permission work is the unglamorous part and the important one: navigation visibility is now consistent with what the user may actually see, service-account navigation is restricted to administrators, and creation actions do not appear for unsupported models or unauthorized users. A palette that offers you a door you cannot open is worse than no palette. Thanks to @ab-smith.

Workflows: Measure, Ingest, Collect

Week 37 gave workflows AI steps. This release gives them the enablers to cover evidence, tasks and metrics end to end (PR #4843) — the largest single change in the release.

Two new action steps. Record a measurement files a number against a metric instance as a dated sample, optionally carrying the evidence revision the number came from; the metric definition decides whether that number is a result or the index of a qualitative option. Post scan results files a batch of pass/fail/not_applicable/error/not_checked rows against a technical posture for one asset, matching each row’s ref_id against the framework’s requirements — so a scanner reporting benchmark numbers needs no mapping table. Rows that match nothing are counted and reported rather than failing the run, and reusing a run id patches an existing run instead of stacking duplicates.

Scheduled evidence collection that actually closes the loop. The Attach a file to an evidence step can now file a new revision instead of overwriting the last one — required for anything on a schedule, or a nightly collection keeps one file and no history. More interesting, it can work out the task occurrence the file answers for: the most recent occurrence that is due and not yet settled. A recurring task that expects an evidence only shows it as provided once a revision exists for that occurrence, so without this the task kept asking however good the file was. Filing a file still never marks the occurrence complete — attaching the work and deciding it is done are different calls, and only the second one is a person’s.

Failures you can route on. Both the HTTP request step and URL-sourced evidence collection gained Continue when the answer is an error and Continue when the tool cannot be reached, off by default. The default is the safe reading: a collection that could not run must not look like one that ran and found nothing. Turn them on and the step reports attached/status plus unreachable, host and reason on both branches — an unreachable tool reports status 0, which no real answer produces — so one branch handles a bad answer and no answer alike. Errors are logged by host only, so a secret in a query string cannot leak into the log.

More creatable objects and stricter publishing. External ratings, incident timeline entries, tasks and right requests join the list a workflow can create, and required fields are now enforced at publish time rather than letting a run write a blank. Roughly thirty new publish checks were added, each with the message you will see and what to do about it. Upsert matching now happens in the domain the object lands in — a purpose belongs to its processing, a scenario to its assessment — so a workflow in a parent domain finds the object it created last time.

Five new templates ship with it, including Evidence collection (wired with the failure branch as an example) and Findings binder, AI triage sweep. Thirty templates now, up from twenty-five. Thanks to @ab-smith.

Power BI Connector 1.1.0 — Install It Before You Tighten Pagination

Week 36 made API pagination a contract: a default of 50 and a hard cap of 200. The Power BI connector did not survive that cleanly, and this release is the repair (PR #4858, shipped as powerbi-v1.1.0).

The failure mode was silent. Connector 1.0.2 and older page by the limit they asked for rather than the number of rows the server actually served, so on an instance with PAGINATE_MAX below 5000 each table stopped after one page — no error, just a table holding fewer rows than the application shows. Connector 1.1.0 reads the page size back from the response and is correct at any ceiling. Upgrade every desktop and gateway running the connector before lowering PAGINATE_MAX. The reports themselves need no change.

The same PR widens what the connector exposes: Task Nodes, Entity Assessments, Contracts and Risk Acceptances as facts; Actors, Entities, Solutions, Task Definitions and Campaigns as dimensions. Actors is the one to note — an object can have several owners, so ownership travels through a bridge rather than an owner column, and the Actors dimension covers owners that are a user, a team or an entity alike.

Server-side, the API gained sparse fieldsets: ?fields=id,name,status on any list or detail endpoint. It can only narrow a response, never widen one — an unknown or unpublished field is a 400, id is always included, and fields hidden from your role stay hidden. Names are top-level response keys, not paths. The connector uses it for bridge tables; an older instance that does not know the parameter ignores it and returns full rows, so the connector works either way. Everything else — permissions, filters, ordering — is unchanged.

New Libraries

• MITRE ATT&CK for ICS and Mobile — the library generator now covers all three ATT&CK domains, with tactics, techniques, groups, mitigations and their relationships, published tactic ordering preserved and existing French translations carried forward. Duplicate shared mitigations across domains are no longer emitted (PR #4836).
• OWASP Top 10 for Agentic Applications 2026 — ten agentic threats covering goal hijacking, tool misuse, privilege abuse, memory poisoning, cascading failures and rogue agents, with 96 framework requirements of which 86 are assessable mitigation guidelines linked back to their threat (PR #4835).

Both thanks to @ab-smith.

Findings, Better Connected

Two changes from the same idea — a finding is only useful where you meet it.

Findings tab on a task (PR #4821) — a task already carried a findings relation, but the detail view had no tab for it, so findings raised from a periodic task were reachable only through the edit form. The tab is read-only, next to Documents and Incidents, and disappears with the follow_up flag like Incidents does under its own. One line of it was not cosmetic: the tab lists through a task_templates filter that FindingFilterSet did not declare, and an unknown filter is dropped silently — so the tab would have rendered perfectly while listing every finding in the instance. Two regression tests pin exactly that. Thanks to @Claquetteuuuh.

Pick existing findings on a requirement assessment (PR #4819) — applied controls, evidences and exceptions could be picked from existing objects; findings could only be raised. The reverse relation is now exposed as a field, with the usual autocomplete. A finding belongs to one requirement assessment, so the picker offers unbound findings plus the assessment’s own, and the backend refuses to bind one that is bound elsewhere — moving a finding stays a deliberate edit on the finding itself. Binding needs change permission on the finding and is refused on a locked binder; findings stay auditor-only in the default and third-party visibility sets, so auditees never see finding names in the response. The raise-finding modal also became a proper page action, fixing a case where saving the assessment right after raising a finding would unbind it. Thanks to @nas-tabchiche.

Additional OIDC Scopes

OIDC SSO configurations gained an additional_scopes field under advanced settings: a comma-separated list, trimmed, validated and de-duplicated on both ends, appended to the default openid / profile / email at the authorization redirect (PR #4841). If your IdP gates claims behind a custom scope, you no longer need a fork to ask for it. Labels and help text are localized in every supported language. Thanks to @tchoumi313.

Charts and Performance

Two more ways to read a breakdown over time (PR #4857) — Area and Small Multiples join the existing breakdown chart. Small Multiples gives each series its own independently scaled panel with a label, a summary and a trend line, which is the right shape when one series dwarfs the others and a stacked chart flattens everything below it. Small Multiples is selectable in dashboard widget configuration, applied-control statuses get consistent colours, and the metrics endpoints lost their N+1 queries in the same pass.

Forms mount progressively (PR #4842) — choice-field options are fetched when a create form opens rather than during the page load behind it, and previously loaded options are reused. A form whose options cannot be retrieved still opens, with the affected dropdown empty and disabled, instead of failing outright. Analytics tabs now load only the data they display, and dashboard selection survives navigation.

Another N+1 sweep (PR #4862) — folders, risk assessments, compliance assessments, quantitative risk studies, EBIOS RM studies, asset assessments and solutions all load their related vulnerabilities, requirements, controls, evidence, contracts, assets, scenarios and approval details in fewer queries. This continues the benchmark-driven work started in v4.0.3.

Bug Fixes

• Evidence filenames are preserved — uploaded names with spaces, accents, uppercase letters or multiple extensions survive download and audit archive export, with proper UTF-8 handling throughout. Unsafe characters, path traversal and over-long names are still rejected, duplicate names in an archive are made unique, empty or invalid names get a safe fallback, and a missing evidence file no longer aborts a whole archive export (PR #4860).
• PDF preview works in SaaS mode — uploaded documents preview again, with loading and error states while the file is being retrieved (PR #4848).
• Privacy module choices are translated consistently — autocomplete choice labels now use the most specific translation available, falling back to the displayed label rather than showing an untranslated value (PR #4846).

All three thanks to @ab-smith.

For Developers

The local development stack swaps MailHog for Mailpit and moves Qdrant to v1.19.1 (PR #4831). Only development and test environments are affected; the automated password-reset tests were reworked for the new mail interface. If you run the dev compose file, pull the new images.

For full details, check out the v4.0.5 release notes on GitHub.