What's New in CISO Assistant — Week 40, 2026 (v4.0.7)

This post covers one release, v4.0.7, published on September 26. It came out inside ISO week 39, after last week’s post had gone out, so it gets its own post instead of a third addendum. It is a patch number on a minor-sized release: a notification centre, a risk trajectory view, a rebuilt X-rays page, per-user module visibility, Mermaid diagrams, and another round of workflow enablers.

A Notification Centre

Until now, CISO Assistant reached you by email or not at all. v4.0.7 adds an in-app notification centre (PR #4867): a bell with an unread counter, an inbox you can filter, read/unread state, and batch actions from a context menu. Each notification shows who it was addressed to, and notifications sent to a team are labelled as team notifications, so you can tell “this is mine” from “this went to everyone in my team”.

Notifications cover deadline reminders and events across audits, applied controls, evidence, security exceptions, validation flows and tasks. Old notifications are cleaned up automatically, so the inbox does not keep growing.

The channels are configurable in Settings. In-app and email are separate channels, and four new email templates come with them. Administrators: the per-template email toggles added in week 34 now live in Notification Settings. Check them after upgrading if you had switched any templates off. User profiles also list the teams a user belongs to. The centre ships behind its own feature flag. Thanks to @ab-smith.

Risk Trajectory: Watch a Risk Assessment Move

A risk assessment records three positions for each scenario: inherent, current and residual. The matrix shows where each scenario sits. It does not show how far each one has to travel, or whether the controls meant to move it will arrive on time.

The new Risk Trajectory view, opened from a risk assessment, animates that movement (PR #4916). Stage playback moves scenarios from inherent to current to residual, with speed controls and a scrubber. The date-based projection is the more useful half: it uses the ETAs of the applied controls to project each scenario’s risk level forward in time and charts the result, so “we’ll be at residual by Q2” becomes a claim you can check. Indicators mark scenarios that got worse, controls that are overdue or have no ETA, and progress toward the residual target. If the control data behind the projection cannot be loaded, the view says the projection is unavailable. It does not show a projection built from partial data. Thanks to @ab-smith.

X-rays, Reworked and Widened

X-rays is the page that tells you what is wrong with your data. Three PRs change it.

A new check, and a page built for triage (PR #4884). The new warning flags applied controls marked active that have no evidence attached, in audits and risk assessments alike. A control that is “active” on paper with nothing to back it up is the first thing an auditor finds, so it is better that you find it first. The page itself is now a triage list. Domains are sorted worst first, searchable and collapsed by default, and each one opens on the tab with its most severe issues. Domains and assessments with nothing to report are no longer listed. Objects affected by a rule appear in a paginated, searchable table with the columns you need for triage: status, ETA, priority, result and treatment. The vocabulary changed as well: X-rays now reports issues and occurrences, because finding already means something else in the product. Thanks to @Mohamed-Hacene.

Governance and operations checks (PR #4913). X-rays used to look only at compliance and risk. It now also checks governance and operations: objectives, issues, evidence, findings, controls and tasks, grouped by domain and severity with links to the objects involved. Folder summaries and totals cover all four areas. You can also run X-rays on a single risk or compliance assessment, subject to your permissions.

Quality checks on requirement assessments, available to workflows (PR #4888). The audit rules were rewritten to flag problems with controls, evidence, assessment status, observations, justifications and consistency. They can now be queried for a single requirement assessment through the API. Workflow read actions can include the result as an optional quality_check field, so a workflow can branch on “this requirement has problems” without reimplementing the rules.

Both thanks to @ab-smith.

Hide the Modules You Don’t Use

Feature flags have been organisation-wide: a module enabled for the organisation was visible to everyone. Users can now hide modules from their own view under a new Modules section in their settings (PR #4870). The organisation still sets the limits. You can turn off what the organisation enabled, but you cannot turn on what it disabled, and modules disabled at organisation level are marked as such. Modules are grouped, a counter shows how many are visible, and one button restores the organisation’s settings. Two updates to the same preferences at once no longer overwrite each other. A second-line reviewer who never touches TPRM or privacy no longer has to scroll past them. Thanks to @ab-smith.

Workflows That Work on Documents

Last week’s release let workflows collect evidence and record measurements. This one lets them work on managed documents, tasks and validations (PR #4892).

• Documents — workflows can create, read and update managed documents and their revisions, including drafts created from a template. Document containers gain batch updates for attributes, labels and folders, and batch deletion.
• Tasks and validation flows can be created from a workflow.
• Richer requirement reads — reading a requirement now also returns its observations, applied controls and evidence. The quality checks flag missing evidence or action plans, and evidence that is stale or unusable.
• Better AI blocks — AI text steps accept longer content, response limits and timeouts are configurable, and truncated outputs are reported as incomplete instead of being passed on as if they were whole. Large outputs are supported, and records that had to be dropped are reported.

A new AI evidence review template shows how these pieces fit together. It reviews the evidence of an audit and writes its findings into a document linked to the audit. It does not change results or scores: the AI writes the review, and people decide what happens to the audit. Thanks to @ab-smith.

Mermaid Diagrams in Documents and PDFs

Markdown fields now render Mermaid diagrams, and so do policy document PDFs (PR #4906). An approval flow or a data-flow sketch in a policy no longer has to be exported as an image and uploaded. PDF layout keeps a diagram on a single page instead of splitting it across a page break. A diagram that fails to render, or that exceeds the rendering limits, is shown as its source code, so it is never dropped silently. In PDFs, the diagrams are rendered natively through Typst. Thanks to @ab-smith.

Threat Modeling: Real Techniques on Operational Scenarios

EBIOS RM operational scenarios could be linked to threats, but not to the attacker techniques behind them. They can now be linked to actual TTP techniques, such as MITRE ATT&CK or ATLAS entries (PR #4878). Techniques appear in the scenario form, on the detail page and in EBIOS RM reports, with links to each technique’s description. They survive domain export and import, and operational scenarios can be filtered by threat and by technique. The help text now explains the difference between a threat and a technique. Removing a threat from an elementary action also works again: the field was optional in the backend but required in the form (PR #4880, thanks to @Mohamed-Hacene). Thanks to @ab-smith.

Smaller Features

• Download the audit log (Pro) — export the audit log as CSV or XLSX, either the current filtered view or the whole log. Exports include timestamps, actor labels, changes and folder paths, and password changes are masked. An XLSX export larger than the configured row limit is rejected with an error that states the limit (PR #4908).
• Batch ETA on applied controls — select several controls and set one ETA for all of them (PR #4914). This fits well with the trajectory view above.
• Applied controls in audit import/export — CSV and JSON audit exports now include the applied controls linked to each requirement. The data wizard and CLI import accept them by reference or by name, with common separators, and can create missing controls when you allow it. References that cannot be resolved produce a warning, not a failed import (PR #4887).
• Control status on findings binders — the binder view shows each applied control’s status as a translated badge instead of a coloured dot you had to hover over (PR #4907).
• Third-party audit filter — the audit list can be filtered on whether an audit is a third-party one (PR #4896).
• Onboarding can be dismissed for good — the first-login onboarding saves its dismissal, which matters for users who only ever work in the global domain (PR #4898).

All thanks to @ab-smith.

Security

django-allauth moves to 65.19.4 (PR #4902). This closes two ways around the login rate limit. In 65.19.3, concurrent requests can no longer push attempts past the configured limit. In 65.19.4, admin and ádmin no longer count against separate throttle keys for the same account. Thanks to @tchoumi313.

Bug Fixes

• SSO users are no longer signed out by a re-authentication prompt — when a sensitive action such as enabling MFA or creating a personal access token needed re-authentication, SSO users were treated as local accounts and signed out with a warning to re-enter a password they don’t have. The check now resolves the user properly, and local accounts behave as before (PR #4895). Thanks to @Claquetteuuuh.
• Mappings are consistent across workers — each server worker kept its own cached copy of the mapping graph, and only the worker that loaded a new mapping library refreshed its copy. “Apply a mapping” therefore succeeded or failed depending on which worker handled the request: 4 times out of 12 in the reproduction. The engine is now built per request, at a measured cost of about 200 ms on actions that are always user-initiated. An audit created from a baseline with no mapping path is now created unfilled instead of failing (PR #4874). Thanks to @Claquetteuuuh.
• Duplicated risk assessments keep inherent risk — the duplicate copied current and residual risk but not inherent risk, so the inherent column of every copy showed -- (PR #4900). Thanks to @Claquetteuuuh.
• Unknown implementation groups are dropped — creating an audit through the API with an implementation group the framework does not define hid every requirement. Selections are now filtered against the framework’s own groups (PR #4901). Thanks to @Mohamed-Hacene.
• Read-only audits show their answers again — questionnaire answers are visible in read-only mode, table mode stays available on locked audits, and flash mode now applies the same Reader guard as table mode. Before this fix, a Reader could edit answers from flash mode on an unlocked audit (PR #4894). Thanks to @tarkadia.
• A task template can have several evidences (PR #4882), object classifications can be edited and only visible levels are offered (PR #4886), numeric fields use whole-number steps where it makes sense (PR #4883), and probability and impact badges use their level colours in dark mode (PR #4896). Thanks to @ab-smith.
• Performance and response handling — fewer unneeded API calls on risk scenario and requirement assessment pages, more reliable handling of failed and optional responses, and database backups that download as compressed .json.gz (PR #4911). Thanks to @ab-smith. Record imports now use the edition-specific serializer when one is configured (PR #4897). Thanks to @tchoumi313.

Library Updates

• CyFun 2025 — the implementation guidance for ID.RA-01.1 was truncated in the official ESSENTIAL and IMPORTANT booklets. It is now restored from the BASIC booklet in English and French, and the missing Dutch section was translated (PR #4885). Thanks to @tarkadia.
• Lowercase URNs — references in the ASF baseline, ISO 27001:2013 and French NIS-1 libraries are now all lowercase, and URNs are normalised on load, so library comparisons no longer show case-only differences. Linked controls and assignments are unchanged (PR #4912). Thanks to @ab-smith.

For full details, check out the v4.0.7 release notes on GitHub.