Administration

[Action Required] Legacy service account tokens expire 30 days after upgrading to v6.35.0.0 or to v6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade. RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, verify or reconfigure the service account role and application access.

Granular Subsystem Access in Group Permissions: Group permissions in application management now support granular access configurations to the files subsystem supporting each module. This enables more precise role-based access controls, so organizations can grant users only the access their role requires.

Preset Configuration Templates: Load relevant export templates and form-builder settings into your tenant, ensuring your users only see formatting relevant to their industry or domain across the platform.

• Relevant settings will be applied to Export Groups, Export Templates, Form Tabs, Form Fields, Form Field Dropdown Choices, and Module Rules
• Templates are provided for multiple service lines including Navy, Army, and USAF
• Option available to reset the UI to the original

Compliance Settings: Risk Accepted is now a roll up category in Compliance Settings and the Control Scorecard.

Catalogs

Versioning Update: Catalog versioning is now supported for catalogs of the same UUID. Every update to a catalog from the RegScale repository records a new version of the catalog instead of overriding the previous version.

Guidance Field: Control guidance is now stored separately from control descriptions. Base guidance from OSCAL catalogs is kept as its own field, and supplemental guidance from overlay profiles is captured alongside it. Each control implementation keeps an ordered history of its guidance layers, and the resolved guidance appears on the implementation and feeds narrative generation. Existing fields and customer data are unchanged.

Dashboards

STIG and CIS Benchmarks Reporting Dashboard: The new Compliance Dashboard gives security teams a single view of configuration compliance for a system.

• Summary cards show open findings, high-severity findings, findings without a POA&M, and average compliance, while a per-benchmark grid lets you drill into individual rules. High-severity findings are prioritized in their own list, and each one expands to show the affected hosts.
• A POA&M coverage widget includes a bulk action to create missing POA&Ms, and a severity-weighted CORA score summarizes overall risk.
• The dashboard also shows which scan feeds contributed findings, what carried forward after a benchmark revision, and which reviews have gone stale.

Workflows

Usability Enhancements: A new workflow strip on Record Forms shows progress at a glance, and the Workbench "Steps Assigned to Me" grid has been redesigned. The Alerts drawer is now action-first, so you can act directly from a notification, and a new review screen combines the record snapshot, a live stepper, and a review panel. Labels and step counts have been updated for clarity.

Governance Status Board: A new command center gives you visibility into workflow health across modules. It opens with an executive KPI row and includes a dynamic Kanban driven by each module's statuses, an SLA health matrix with an aging distribution, and SLA views by user and approver capacity and by module. Workflow steps can now be reassigned or reminded, with each action recorded in an audit trail.

Bug Fixes and General Maintenance

This version includes a RS-UI upgrade from Angular 21 to Angular 22.

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[6.53.0] - 2026-10-14

Added

• Added regscale trust-center evidence push to push JSON evidence to a Trust Center evidence record by its evidence ID
• eMASS commands now report failed records under REGSCALE_STRICT_EXIT_CODES, and the eMASS importers count failed saves, milestones, custom fields and role links they previously only logged
• Axonius V2 sync commands accept KEY=VALUE1|VALUE2 tags and an --aql-filter option for stricter filtering

Changed

• Incremental Wiz pulls re-baseline weekly through the new wizIncrementalRebaselineHours setting so daily syncs stay incremental, and wizFullPullLimitHours now only limits how old cached Wiz data may be
• The wizLastInventoryPull, wizLastVulnerabilityPull, wizLastIssuePull and matching FullPull keys are deprecated and replaced by wizPullWatermarks, and incremental Wiz pulls (wizIncrementalPulls) are planned to become the default in 7.0.0
• Axonius V2 --tags now takes effect by filtering on Adapter Tag values, so runs that previously returned no records or an unfiltered set can return different record counts

Fixed

• eMASS API POA&M, control test result and system mappers no longer fail on every record, and a non-compliant test result is no longer read as compliant
• eMASS POA&M bidirectional sync no longer pushes every POA&M to eMASS twice
• A JCAM URL that answers with anything other than a list of systems, such as a web or login page, an empty body or a bare JSON value, is now reported as a failed JCAM read naming the settings to check
• Incremental Wiz inventory syncs no longer mark unchanged assets Inactive
• Axonius v2 now reads device fields, aggregated values and AWS tags as Axonius 6.1 returns them, so assets sync with their names, addresses and operating systems and route by their AWS tags
• Wiz, Qualys and Tenable.sc syncs no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new wizTimeout, qualysTimeout and tenableScTimeout settings (300 seconds by default), and Tenable.sc no longer waits about 30 minutes and then reports success
• Incremental Wiz pulls keep a separate watermark for each SSP, Wiz project and filter, and move it only after every record is saved to RegScale, never on a dry run
• Wiz Ports and Protocols are no longer skipped after a full inventory pull when incremental pulls are on
• eMASS SLCM import now stops on a security plan or catalog ID that does not exist, and no longer fails on numeric or date cells
• Axonius V2 tag filtering now returns tagged assets and vulnerabilities

Fixed

• Release container images are now cosign-signed and carry a CycloneDX SBOM attestation

This patch re-publishes the container images (the 6.52.0 images were built from an earlier commit and were unsigned); latest and latest-fips move to this build.

Added

• New regscale acunetix import_acunetix command imports Acunetix XML scan exports as assets, vulnerabilities and issues
• JCAM SSP import now logs the RegScale security plan id assigned to each newly created plan, with a count in the run summary
• CrowdStrike Spotlight sync now supplies known-exploited, internet exposure, exploit availability and CVSS vector data for FedRAMP VDR evaluation, and uses the host role to set the asset type
• Scanner integrations share one asset type lookup, so vendor terms such as server or workstation map to the platform asset types instead of defaulting to Other
• Axonius V2 get_queries command to list the saved queries defined in Axonius and save their definitions to a JSON file

Changed

• eMASS POA&M workbook import now reports failed milestone custom field saves as errors instead of reporting success
• jcam import_controls states outcomes the mapping already decided (a Control Origin or Implementation Status written under the plan's own label, or a Control Origin or applicability answer in the Status column) once per run with a count and the plans it covered, instead of once per control
• A paginated RegScale issue fetch that loses a page now stops instead of carrying on with the issues that did arrive, so nothing acts on a partial list
• A JCAM POA&M export or GitLab issue sync stopped by an incomplete RegScale issue fetch now exits with code 6 (upstream unavailable) instead of completing on a partial list, and a Wiz retention reconcile, outdated-issue closure or scanner control assessment skipped for the same reason (control assessments and statuses are then not written rather than passed) counts as a partial failure, so REGSCALE_STRICT_EXIT_CODES=1 reports it as exit 3
• Compliance syncs now explain when issues are not created because complianceCreation is set to Assessment, and AWS compliance sync help text describes when issues are created for failed controls
• AWS Security Hub commands report progress while pulling findings (pages, findings and elapsed time every 30 seconds) instead of staying silent until the pull finishes, and say how many findings a --tags filter kept
• Plan-field routing summaries list how many records each security plan received, and name only the 20 unmatched, ambiguous or shared identifiers with the most records (with a count of the rest) instead of every one; the full lists are logged at DEBUG
• Guidance now says not to import defusedxml in new code; use hardened lxml for customer-supplied XML
• Wiz commands now honor the customCaCert setting and the SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables, and report a clear error when the named CA bundle cannot be read

Fixed

• CLI log output redirected or piped to a file is now plain, readable text instead of being polluted with color escape codes
• Progress bars no longer write redraw characters into redirected or piped log files
• jcam no longer reports a "Non-Cloud System" cloud descriptor as a value with no RegScale equivalent; it sets no cloud flags, as before, without a warning
• eMASS Control Information workbook import now reads Army and DISA-format workbooks, which have no Application, Database or Operating System Layer columns, without writing values into the wrong fields
• eMASS Control Information workbook import no longer resets a control's assessment frequency when the Frequency cell is blank
• eMASS workbook detection now recognizes Control Information workbooks by their column headers
• eMASS hardware/software inventory import no longer creates facilities during a dry run
• eMASS POA&M workbook import now finds the data sheet in Army and DISA-format workbooks that have no sheet named POA&M
• jcam check_config now reports a failed JCAM read, including an unset jcamToken or jcamURL, as a failure rather than as an empty tenant or a jcamFilter problem, and exits non-zero when JCAM cannot be read, since an import would stop on the same read
• Issue fetches by security plan no longer return each issue past the first 50 twice, and no longer return a partial list as if it were complete when a page fails, so the JCAM POA&M export, GitLab issue sync, Wiz retention and scanner control assessments stop acting on incomplete data
• eMASS system export import no longer deletes a tenant's existing information types when creating missing ones
• Information type lookups no longer fail when a type on the tenant has no description
• Nessus imports no longer close assets or findings for hosts in a file that failed to parse, report the file as an error, and leave it in place so the next run retries it
• Vulnerability mop-up now runs on the last request of an import even when the finding count is an exact multiple of the chunk size or the last chunk holds only compliance findings
• The --scan_date option is honored on Nessus imports, and each file keeps its own scan date when none is given
• Nessus vulnerabilities that carry only a CVSS v2 score now import with that score in the CVSS v2 field instead of 0
• The Tenable.io minimum severity filter now treats critical as 9.0 and accepts moderate
• Nessus software inventory is now built from the downloaded CPE dictionary, and a failed dictionary download is reported and no longer removes the existing one
• A Nessus import that finds no files now exits with a failure status
• A finding that appears in more than one Nessus file is no longer imported as a duplicate issue
• The Nessus CPE dictionary download now honors the sslVerify setting
• Flat-file imports no longer crash when the operating system column contains only numeric values
• Nexpose import now accepts the Rapid7 InsightVM CSV export headers without a manual column mapping
• Xray import now reads JFrog Xray native JSON exports that wrap findings in a top-level rows list
• eMASS POA&M sync now reports updated POA&Ms separately from newly created ones
• eMASS API full system sync with --dry-run no longer pushes controls and POA&Ms to eMASS
• The CLI's log file now records a timestamp and level on every log record, so a long run can be diagnosed from the file afterwards
• Routed Security Hub syncs (sync_securityhub_by_plan_field, sync_securityhub_by_component_map) run without --fallback_ssp_id now keep only the findings that reach a security plan while reading, instead of holding every finding in memory first, so a multi-account pull where most findings route to no plan stays small; with a fallback plan, unmatched and untagged findings are still held because the fallback receives them
• Axonius V2 saved-query sync now works against Axonius 6.1.67
• Qualys sync no longer changes the status or due date of vulnerabilities and issues that were marked accepted, excepted or otherwise set by a person
• Scanner imports that merge several findings into one record now keep any internet exposure, known-exploited and exploit flags, the highest EPSS score and severity, and the earliest first-seen date from every finding instead of only the first
• eMASS POA&M pushes no longer update an unrelated eMASS POA&M when a RegScale issue has no exact match
• The AWS evidence commands (sync_s3, sync_cloudtrail, sync_ssm, sync_cloudwatch, sync_cloudwatch_ex, sync_guardduty, sync_iam, sync_kms, sync_ec2, sync_org, sync_ecr, sync_inspector, sync_directory_services) and wiz compliance_report and wiz sync_compliance now fail the run when RegScale does not accept the evidence record or its file, with exit code 4 for a permission refusal and 6 when RegScale cannot be reached
• Evidence created by connector commands such as Entra ID evidence collection, the Wiz compliance report, and the AWS and GCP evidence commands is no longer rejected on instances with evidence approval enabled, because the CLI no longer sets the running user as the evidence approver
• Listing threats by parent and reading, updating or deleting privacy records no longer fail with a KeyError
• Mock service settings in init.yaml are now applied to Tenable, Microsoft Defender, AWS and BigQuery requests
• Updated Python and OpenSSL in the FIPS container image to patched versions
• Fixed AWS Systems Manager compliance totals, which were always reported as zero compliant and zero non-compliant
• Wiz host configuration findings recorded their first-seen date as the sync time instead of the date Wiz first saw them
• Entra ID evidence collection for the authentication evidence type now saves the authentication methods policy instead of failing with a missing key error
• The Threat model's record count endpoint template now points to the route the API serves
• Tanium sync now records each consolidated vulnerability against the same host on every run instead of a randomly chosen affected host
• Workflow action, workflow instance and workflow template models can be imported again
• Tenable.sc JSONL sync now stores a finding whose plugin name is empty but that carries a CVE or plugin id, under a title derived from the CVE and synopsis
• Tenable.sc JSONL sync now logs a warning naming the file and line of a finding it skips because the finding has no plugin name, CVE or plugin id, or is missing a required field, instead of dropping it silently
• The API-call summary logged at the end of a scanner sync is now emitted at DEBUG instead of INFO
• A vulnerability batch chunk the server refuses over one bad record no longer loses the issues and asset links of the records it retries one at a time; they go through the same batch route as the rest
• A Tanium vulnerability consolidated from several records now reports the earliest first-detected and the latest last-detected date across those records
• defender collect_entra_evidence, gcp collect_evidence and gcp sync_findings --generate-evidence now fail the run (exit code 1, 4 for a permission refusal, or 6 when RegScale cannot be reached) when RegScale does not accept an evidence record or its file, after finishing the remaining evidence, and the error line for a refused evidence record now names the record and gives RegScale's reason

Added

• Wiz syncs can skip vulnerability and end-of-life findings on container images that exist only in a registry and that no workload runs, by setting wizDropUndeployedRegistryImages to true
• Wiz vulnerabilities now show, in their plugin output, how many Wiz issues each finding contributes to by severity and whether a container image was scanned from its registry or a running workload
• eMASS system export import now accepts the eMASS export .zip directly, including its artifact files
• Plan-field routing can match a plan field that lists several identifiers, such as every ComponentID of a system, with --plan-match-multi-value, and can treat named prefixes such as COMP- as not part of an identifier with --ignore-id-prefix; aws sync_findings_by_plan_field supports both
• Axonius v2 can route assets and findings to security plans by a plan field that lists several identifiers, such as a system's Component IDs, with the new sync_assets_by_plan_field and sync_findings_by_plan_field commands, which sync an identifier that two plans list to both and close records that left a plan unless --suppress-mop-up is given
• Scanner integrations can now pass KEV, internet reachability and EPSS data through to vulnerabilities for FedRAMP VDR evaluation
• Evidence, Change and AppGroup models include the new platform fields externalKey, canApproveChanges and canRequestChangeApproval

Changed

• eMASS system export import now exits with an error status when the import records any error, so scheduled runs no longer report a failed import as successful
• eMASS CAC authentication now uses the OpenSSL 3 PKCS#11 provider instead of the deprecated OpenSSL engine interface, and works through a tunnelling proxy
• Asset syncs run their per-asset follow-up lookups in parallel for faster imports
• Faster vulnerability imports by leaving vulnerability-to-asset links to the platform instead of creating them a second time from the CLI
• Security Hub compliance runs routed by plan field now report how many finding resources were left out of every plan's control assessments

Fixed

• Re-importing an eMASS system export no longer duplicates control tests and test results
• eMASS system export import now assigns new controls to the Security Plan's System Owner or ISSO and new assessments to the matched eMASS tester, ISSO, or System Owner instead of the importing user
• eMASS system export import no longer reads artifact files from outside the export folder
• Imports that run past midnight no longer risk closing findings that the same import had just created
• Importing the same eMASS system into more than one Security Plan no longer moves POA&Ms from one plan to another
• eMASS system export import now sets POA&M statuses the tenant actually offers, no longer blanks a POA&M's Identification on re-import, and keeps the system acronym on tenants without a DoD package
• eMASS system export import now imports POA&Ms on DoW tenants, with their due dates, owners, status and severity, and records control narratives, statuses and Not Applicable results correctly
• JCAM information types now match RegScale information types whose titles carry SP 800-60 section numbers or spell "and" as "&", re-importing no longer detaches information types from their plan, and a plan whose information types match none is reported as failed

[6.50.0] - 2026-10-06

Added

• Wiz asset syncs now fill the public-facing FQDN, IP address and URL fields from the application endpoints Wiz confirmed, and network exposure vulnerabilities now carry their port and protocol
• AWS Audit Manager sync now filters assessments with --tags and scopes evidence to tagged resources with --resource_tags
• AWS Security Hub compliance sync commands assess controls from Security Hub standards, route results to one or many security plans by plan field or ComponentID mapping file, and record the unmodified Security Hub findings as evidence by default
• CLI options now accept both snake_case and kebab-case spellings everywhere, with kebab-case shown in --help, and unambiguous Security Plan ID options accept a friendly --ssp-id alias
• Opt-in REGSCALE_STRICT_EXIT_CODES=1 makes scanner syncs that finish with item-level failures exit 3 instead of 0, and the CLI exit-code contract is now documented
• Optional machine-readable output via regscale --output json (or REGSCALE_OUTPUT=json), including a standard run summary and JSON records for supporting commands
• New --preview flag on cleanup deletes, JCAM and eMASS push commands and set_permissions load lists every record that would be created, updated or deleted without writing anything
• New configurations store integration secrets in the RegScale secret store by default, and existing configurations can move theirs with the reversible regscale config migrate-secrets command
• Automated secret scanning on every source change to keep credentials out of published releases
• regscale config validate checks init.yaml for unknown, deprecated, missing and mistyped keys and leftover placeholders, with JSON output and a non-zero exit on errors
• Read-only config mode (REGSCALE_CONFIG_READONLY=1 or --no-write-config) never creates or writes init.yaml, and every setting can also be supplied as a REGSCALE_<NAME> environment variable
• Set REGSCALE_USE_PROXY_ENV=1 to route RegScale API and integration traffic through HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and custom CA bundles now apply to proxied and GraphQL connections
• Trust Center, QRadar and Prisma Cloud CSPM requests now retry automatically with bounded backoff when the vendor API throttles or is briefly unavailable
• Releases now include signed build provenance for the wheel and sdist, keyless cosign signatures and SBOM attestations on the Docker images, and a CycloneDX SBOM attached to each GitHub release, with verification steps in the release verification guide
• Deprecated commands, options and settings now print a warning naming their replacement and the release they will be removed in, following a published deprecation policy
• Shell tab completion for bash, zsh, fish and PowerShell (regscale completion), a regscale integrations list command showing each integration's category, description and docs link, and a regscale --help grouped by category
• Usage examples in the --help of the most-used commands, and corrected command examples in the documentation and in several AWS command help pages
• Opt-in structured JSON logging via regscale --log-format json or REGSCALE_LOG_FORMAT=json, with a run ID shared with the run summary and secret values redacted from every log line
• Added a --force-refresh option to Axonius v2 sync commands to re-pull every record instead of only recently changed ones
• make help now lists the model schema and Azure AD sync regeneration commands
• regscale devsecops run validates the full .regscale-devsecops.yml configuration (change, approval, targets, mapping, SAR, policy, assess, schedule and module settings) and reports each problem with its field path, line number and accepted values
• regscale devsecops ssp snapshot command that exports a Security Plan's control IDs, catalogs and evidence-type mapping coverage to a credential-free file for offline control resolution
• Pipeline readiness check with regscale devsecops doctor, reporting TLS, service-account identity and expiry, missing or excess permissions, configured SSP and component, mapping coverage and schedules
• Pipeline Change records with typed trace links to work items, pull requests, approvals, builds and artifacts via regscale devsecops change open|update|close
• regscale devsecops evidence collect and publish commands that capture branch protection, pull request approvals, CODEOWNERS and JUnit test results as evidence mapped to the security plan and its controls
• regscale devsecops sbom generate, diff and publish commands that produce SBOMs from the GitHub dependency graph or syft, compare them with the previous release and publish them as inventory, evidence and change trace links
• regscale devsecops scan import command that imports SARIF, Trivy, Grype and Wiz CLI results as vulnerabilities and records them as control assurance on the target Security Plan, whatever framework it uses
• regscale devsecops openssf scan and sync publish results to Security Plans without OSPS Baseline controls as a summary assessment and evidence record mapped to the plan's own controls, record them in the run ledger, and weigh AI-assessed observations as added risk only
• regscale devsecops schedule show and apply set the OpenSSF drift-monitor cadence as a RegScale Orchestration Hub job or a scheduled GitHub Actions or GitLab workflow, choosing between the Scorecard API and a fresh scan for each repository
• regscale devsecops assess command that rolls a pipeline run's evidence up to findings for the Security Plan's own controls, publishes them as assurance results, raises issues for failing tool-observed results and closes them once they pass, without changing implementation status unless asked
• regscale devsecops sar build and sar validate commands that produce the run's OSCAL Security Assessment Results and assessment plan from the run ledger and validate them against the pinned NIST OSCAL schema, failing closed when no schema is available
• regscale devsecops sar merge builds a release SAR from the run SARs between two release tags, and sar publish attaches a run or release SAR as a CI artifact, SSP file, SSP child assessment or Evidence record
• regscale devsecops attest writes an in-toto attestation over the run ledger, SAR and policy decision, optionally Sigstore-signs it (never in FIPS mode), attaches it as Evidence and has the platform verify it
• regscale devsecops gate, policy evaluate and policy pull commands that evaluate the digest-locked OPA gate bundle against the run's policy input without RegScale credentials, map the decision to a CI exit code, and skip credentialed steps on fork pull requests
• regscale devsecops policy init command that locks a framework-neutral default gate policy, deciding on evidence types, change categories and per-check OpenSSF Scorecard thresholds, without a RegScale connection
• regscale devsecops change request-approval and change verify commands that submit a Change to the platform's tolerance-policy approval and gate deployments on approved artifact digests, with change close always recording the deployment
• regscale devsecops change shadow-report command that compares shadow-mode Change approval decisions with CCB outcomes, reports agreement, false auto-approval rate, auto-approval share and approval wait time, and checks each component against configurable readiness thresholds before enforcement
• Opt-in regscale devsecops review impact command that reviews a change against the SSP's own controls with a pluggable AI provider (Anthropic, Amazon Bedrock, Azure OpenAI or RegML via the ai extra), records an advisory AI-assessed result and writes the Change's impact analysis section
• regscale devsecops scan import --offline records a scan in the run ledger without RegScale credentials
• regscale devsecops run --stage pr|build|release|deploy|scheduled runs the modules the manifest enables for each pipeline stage, split into a credential-free collect job that writes a verifiable run bundle and a trusted publish job that publishes it
• OpenSSF OSPS Baseline assurance commands (regscale devsecops openssf sync and scan) that run or ingest Scorecard, OSV-Scanner, Privateer, Security Insights, OpenVEX and SLSA provenance results and report per-requirement test results, control assessments, issues and evidence against an OSPS Security Plan
• Signed OSPS conformance attestations (regscale devsecops openssf attest and verify) packaging verdicts as in-toto statements with optional Sigstore keyless signing via the regscale-cli[attest] extra
• Scheduled OSPS drift detection (regscale devsecops openssf monitor) that compares published Scorecard results with the Security Plan and flags regressed controls without running scans
• Evidence tier (Declared, Observed or Verified) recorded on OSPS assessments and control test results
• Reusable GitHub Action that runs OSPS Baseline assurance, with an optional signed attestation, in a pipeline
• Self-contained HTML OSPS conformance report that pipeline runs can publish as an artifact
• QRadar compliance assessment minimum event threshold is now configurable through min_events in the qradar config block
• regscale devsecops change open|update options for the Change's title, description, case notes, test results, outage summary, type, priority, owner, change window and test date, --change-id with --adopt for existing records, a change attach command for files and URL links, --output json on the change, evidence and SBOM publish commands, and sbom publish --parent-asset --name

Changed

• AWS Security Hub tag filtering is now applied server-side so fewer findings are pulled over the wire
• Command reference documentation now covers every CLI command, with a complete generated command index and corrected command, option, and configuration examples across the user guides
• Dependency versions are now capped below their next major release so a new major version of a third-party package can no longer break a fresh pip install
• eMASS client reads and writes the eMASS API v3.31 field names for systems, POA&Ms, milestones and hardware, still reads the older names from earlier eMASS versions, and now sends the required POA&M source field under its correct name
• QRadar assess-compliance now runs through the standard compliance sync, creating a QRadar SIEM asset and scan history, and attaches the recommended fix to issues for failed controls
• Scanner asset syncs no longer look up or store raw source data per asset, which makes large asset imports faster
• FedRAMP SSP XML import no longer calls the retired OSCAL validation service or attaches an OSCAL validation report

Fixed

• License-gated commands now honour the platform's 5-day grace period after the RegScale license expires, warning on each command with the expiry date and grace days left, and after it ends report that the license expired on that date
• jcam import_ssp no longer stops partway through creating plans when JCAM reports a system with no categorization or system type, a new plan now gets its organization at creation, and one organization that cannot be read no longer stops the import
• JCAM control inheritance import again writes the plan lineage and inherited control records the RegScale inheritance views read
• FedRAMP CIS/CRM import now sets the inheritance model on control objectives and rolls it up to the control implementation
• Control matching now skips a missing, blank or non-text control ID instead of crashing the import
• Help text for the Axonius combine_data_parts and file_stats commands, and corrected descriptions for pull_data and pull_data_axonius
• Negated CLI flags (--no-x) now accept both snake_case and kebab-case spellings
• Settings supplied through environment variables are no longer written into init.yaml, so a secret in the environment can no longer overwrite a secret-store reference on disk
• A secret passed to regscale config --param is no longer written to the debug log
• Prisma Cloud imports no longer drop vulnerabilities whose published or fix dates are millisecond timestamps
• Issues whose asset identifier list is too long for the field now say how many identifiers were left out
• Scanner imports no longer silently drop every vulnerability when the RegScale tenant lookup fails
• GitHub SBOM sync no longer fails when the security plan already has component mappings, and the client-side outdated-issue closure and control objective lookup by catalogue no longer fail on every call
• JCAM import no longer stops when a FISMA rollup would move a security plan under a different parent; that plan is skipped and reported in the run summary
• Axonius v2 sync no longer fails on Axonius 6.1, and synced assets and findings now include hostname, IP, OS, CVE, severity and other details
• Fixed debug log issue in login and api modules.
• JCAM inheritance import no longer resets provider controls to not inheritable, and skips inheritances that name a plan as its own provider
• Updating an existing Security Plan no longer fails when the instance has disabled plan fields; those fields are skipped with a warning
• Asset imports, including Nessus, no longer fall back to slow one-by-one uploads when the same host appears more than once in a file
• QRadar compliance assessments now state why each control passed or failed and recommend how to fix it, instead of only the result
• Trivy and Grype imports now link vulnerabilities to their scanned assets
• DevSecOps hints, example manifests and the regscale-devsecops GitHub Action now match the commands and configuration keys the CLI actually reads, and unread module keys log a warning
• An invalid RegScale token no longer appears in login error messages, and devsecops run collect jobs no longer create an init.yaml in the working directory or refuse to publish a bundle whose configuration file differs only in line endings
• QRadar assess-compliance now creates issues for failed controls when complianceCreation is set to Issue or POAM
• Wiz inventory sync no longer fails when no project ID is supplied, and several integrations no longer fail on null values returned for optional fields
• Microsoft Defender for Cloud resource sync no longer fails on subscriptions with more than about 96,000 resources
• Microsoft Defender syncs now follow relative pagination links from the Defender API instead of sending them to the RegScale server
• Records queued for batch saving, such as Splunk Data records and Jira or SonarCloud issue updates, are no longer dropped when disableCache is enabled
• GCP runs now warn when a configured service account credential is invalid, name the rejected setting and the reason, and stop with an error when no configured credential is valid instead of continuing on a different credential
• regscale evidence start now creates the assessment for each project listed in list.json, instead of stopping with an error or attaching one program's results to another project
• Platform version checks now treat an internal build of the RegScale platform (one that reports a build number and date instead of a release version) as a development build rather than as a very new release. Features that stay off on development builds, such as linking one issue to multiple controls, are no longer switched on against these servers, and a server that reports an unrecognized version no longer causes a version-parsing error.
• Updating an existing task under a parent record that already has tasks no longer fails
• Installing the CLI now requires a PyJWT release free of the known critical and high severity vulnerabilities

Bug Fixes and Usability Enhancements

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[Action Required] Legacy service account tokens expire 30 days after upgrading to 6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade to 6.34.4.0. After the upgrade, RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, check that service account's roles and application access.

Rich Text Editor Upgrade: The Rich Text Editor has been replaced to provide more reliable formatting. Bulleted and numbered lists, tables, links, and text copied from Word now behave more consistently. Content you've already saved in these fields will not be modified.

Preset Configurations: When profile layering is disabled, the preview now clearly shows which catalogs and profiles will be excluded from the install.

[6.49.8] - 2026-09-29

Fixed

• Axonius v2 asset sync now works with older Axonius versions such as 6.1 and no longer fails with a bad request error

[6.49.5] - 2026-09-28

Added

• Added an about command to the Axonius v2 integration to show connected instance details

Fixed

• Axonius v2 asset sync pagination now sends valid requests, fixing full asset sync

[6.49.0] - 2026-09-28

Added

• Wiz STIG and CIS benchmark results now record, in each control test's observations, which configuration criteria produced the pass or fail result and what Wiz found on the host
• Wiz Ports and Protocols records now include ports reachable over VPN, from another cloud account or from a custom IP range, flag VPN-reachable ports, and record Wiz's exposure level in the purpose
• Optional Wiz setting that keeps only the stable Representative Resource when a workload is also reported as an ephemeral instance, so the asset register stops double-counting it, with a dry-run mode that reports what would collapse without changing anything
• Improved schema-drift detection tooling reliability
• Warning in CLI logs when the connected RegScale platform returns fields the CLI does not recognize, signaling the CLI may be behind the platform version
• Catalog revision family, number, and state are now available on catalog records
• The CLI's ControlImplementation model now carries inheritanceModel, so a caller can read
  back whether a control is offered for inheritance and as what. Writing it still goes
  through the platform's provider-model endpoint, which sets it and the legacy inheritable
  flag together.
• Complete example configuration file covering all supported settings
• • Options to save a new service account token to init.yaml or copy it to the clipboard
• Wiz excessive access findings are now synced, covering identity over-permissioning alongside the other Wiz finding types
• Axonius sync_assets can now sync every asset in a file to a single specified security plan instead of mapping by FISMA ID
• New regscale trust-center vdr push sends a Security Plan's RegScale issues to the Trust Center VDR bulk-ingest feed (idempotent per issue, batched, exits non-zero on rejects), and vdr job-template prints ready-to-paste systemd unit/timer and cron schedules for a turnkey push job

Changed

• JCAM imports no longer report a 500 as a failure. JCAM answers 500 both when an endpoint
  has no data and when something is wrong, and nothing in the response tells the two apart,
  so these are now counted and reported separately as indeterminate. A domain where every
  call answered 500 and nothing succeeded is still called out as an outage.
• Platform secret store resolution is now opt-in via the secretStoreEnabled setting or SECRET_STORE_ENABLED environment variable, and any problem pulling secrets while enabled produces one clear, actionable message naming the cause and the fallback. Upgrading from 6.47.0, where resolution was always on: if you removed credentials from init.yaml after running push-secrets, set secretStoreEnabled to true to restore resolution
• JCAM control inheritance import now records inheritance linkage to support accurate display in RegScale
• The first Wiz sync after upgrading imports previously excluded resolved and ignored cloud configuration findings, which on an established tenant can be substantially more records than the open findings alone
• The provider inheritance-model setter is now InheritanceProviderModel.set_for_controls, and rejects an unrecognized inheritance model before sending it to RegScale

Fixed

• Wiz messaging services such as SNS topics and SQS queues now sync as Applications instead of Other, and an unmapped Wiz asset type is reported instead of being silently classified as Other
• An invalid Wiz filter setting now stops the sync with a message naming the setting, instead of failing with a raw JSON error or silently pulling the entire tenant unfiltered
• JCAM artifact import no longer re-downloads and re-uploads the same files on every run.
  The check for "already imported" was built by a different rule than the filename RegScale
  stores, so any artifact whose name contained punctuation never matched and was attached
  again each time.
• A GraphQL field-level error, such as one field a service account may not read, no longer aborts the whole sync; the remaining fields are imported and the refused fields are named in the log
• FedRAMP POA&M import no longer sets an asset's type from the free-text "Resources Required" column
• Wiz issue and STIG syncs now read the configured Wiz settings block instead of falling back to built-in defaults, so scheduled completion dates, past-due handling and known-exploited-vulnerability windows all follow the Wiz configuration, with high severity shifting from 60 to 90 days under the shipped defaults on plans that do not define compliance-setting SLAs
• Asset, issue, and vulnerability updates no longer drop platform fields the CLI did not previously recognize
• ServiceNow date parsing now zero-pads very small years consistently across platforms, preventing invalid dates on Linux
• AWS Security Hub checklist statuses now reflect compliance pass and fail results instead of always showing Not Reviewed
• Wiz vulnerability sync now reports when a Representative Resource arrives in an unrecognized provider format, instead of silently skipping the findings it would have rolled up onto the parent asset
• JCAM inheritance now appears in RegScale. The importer marks a provider's control as
  inheritable using the inheritance data JCAM already sends, rather than inferring which
  plans are providers from their system type. Nothing was being marked before, so the new
  inheritance API refused every link and the older display had no inheritable source controls
  to show.
• eMASS CAC authentication settings in the example configuration no longer conflict with baseline sync settings
• Wiz cloud configuration findings are now synced in every status, and a misconfiguration ignored in Wiz as a false positive, by-design setting, accepted risk or exception carries that adjudication into the RegScale issue's deviation fields
• Wiz findings resolved at the source are now closed in RegScale again, after a query that failed on every run stopped suppressing stale-finding cleanup for the whole sync
• The JCAM POA&M import summary now counts POA&Ms. Its successes were security plans and its
  failures were individual records, so the numbers could not be reconciled against anything
  without reading the source. Plan-level outcomes are reported as notes beneath the tally,
  and a plan whose POA&Ms could not be fetched, a failed POC lookup and a refused custom
  field value each have their own domain.
• Qualys VMDR report import now creates issues successfully instead of failing, and their due dates honor the configured remediation timelines for each severity
• Axonius pull_data_axonius no longer reports a successful import when it has only downloaded a file, and names each output file after the saved query so pulling several in sequence no longer overwrites them
• A failed Wiz authentication now only retries alternative token endpoints within the same Wiz deployment, so credentials for Wiz for Gov are never sent to a commercial endpoint or the reverse
• jcam import_ssp now creates each security plan with the JCAM system id in the field the loaded mapping profile nominates, rather than always in otherIdentifier. On the recommended profile that field is the System Acronym and the id belongs on trackingId, so a plan whose front matter pass then failed was left with no trackingId -- invisible to the next run's plan lookup, and created a second time.
• Missing pytz dependency that caused commands to fail on a fresh install
• Axonius README now documents the sync_assets --schema option and its two field mappings
• QRadar event sync no longer duplicates findings on every run, compliance assessment now credits the event categories and log sources QRadar actually reports, and query_events no longer crashes when a plan lacks one of the mapped controls, rejects query values that could alter the search, labels POA&Ms and evidence with the field and time window that were queried, and exits with an error when a query-mode run fails
• Slow scanner imports caused by repeated asset and issue lookups, and issues that failed to link to assets created during the same run
• Vulnerability imports no longer slow to a crawl when the tenant lookup fails
• Axonius v2 asset sync no longer fails with a bad request error
• • The CLI no longer clears the root logger's handlers when used as a library, so host applications and test harnesses keep receiving log records
• • Qualys VMDR report re-imports now close stale vulnerabilities that no longer appear in the latest report
• eMASS workbook imports no longer erase stored data when a tenant disables a form field. A disabled column is now left at whatever the server already holds rather than being written back empty, across the hardware and software inventory, POA&M, SLCM, security categorization, control test results and eMASS baseline imports. An import that fails because the security plan is not visible, or because the workbook does not match the target plan, reports one error line instead of a Python stack trace, and a column the server refuses is now counted as an error rather than reported as a clean run. The software In Service Data column reaches its field instead of a retired one, the hardware inventory reports IP address values it discards rather than dropping them silently, a dry run no longer contacts the instance, and the Test Result import prefers a real data sheet over a boilerplate Template tab.
• Defender sync_cloud_resources now creates virtual network assets whose Azure address space is a list of prefixes, instead of failing with an asset validation error
• Connector syncs, including GCP, Wiz and Jira, now stop with an error naming the missing security plan or component when pointed at one that does not exist, instead of writing records that no plan can reach