[6.54.0] - 2026-10-19

Added

• The JSON run summary from --output json now reports the run duration and the CLI peak memory use
• Optional scannerPrefetch setting that fetches vendor findings and assets in the background while earlier ones are processed, speeding up scans against slow vendor APIs
• ServiceNow incidents can now carry selected RegScale issue properties, mapped to ServiceNow fields with the new snowIssuePropertyFields setting
• STIG checklist import now reads CKLB files from STIG Viewer 3 as well as CKL files
• JCAM POA&M import with the recommended mapping profile now records each milestone's JCAM status on the RegScale milestone's Status field
• Wiz vulnerability imports now send CISA KEV status, EPSS probability and internet exposure to RegScale for FedRAMP vulnerability ratings, and newly created assets with no Wiz exposure data are no longer marked as not public facing
• Tenable and Nessus imports now pass exploit availability and asset roles from scan data, and Nessus file imports also pass CISA KEV status and CVSS v3 vectors, for FedRAMP vulnerability evaluation
• Nexpose CSV import now supplies exploit availability and CVSS v3 vector data for FedRAMP VDR evaluation when the export includes those columns
• JFrog Xray import now records container image artifacts as container assets
• Axonius v2 pulls now log progress while reading devices and vulnerabilities, with a closing line giving the count and elapsed time
• DevSecOps change open can give the Change its parent record's security with --inherit-parent-security, or make it public with --public, and reports the result in its JSON output
• New wizReportWaitTimeout setting (default 3600 seconds) caps how long Wiz compliance_report waits for Wiz to build the compliance report

Changed

• Paginated RegScale GraphQL queries reuse connections across pages instead of opening a new TLS connection for every page
• The CLI now waits as long as the RegScale platform asks when it is rate-limited or temporarily unavailable, instead of giving up after a few quick retries
• The CLI no longer runs external commands through a system shell, and the Flask API debug mode now listens on the local machine only
• Large asset syncs send assets to RegScale in chunks of 5,000 as they are processed, roughly halving peak memory instead of holding the whole inventory until the end
• Reading large sets of issues and mappings from RegScale is faster and no longer stops at 500,000 records, by paging through them in record-ID order
• Faster CISA KEV due-date and KEV flag lookups during scanner imports, and lower memory use on long syncs that process many records
• Scanner integrations use about 70% less memory per finding and asset and build them more than twice as fast, so very large imports fit in less RAM
• Faster processing of large batch create and update responses from RegScale
• Faster CLI startup: regscale --help and regscale --version respond about five times sooner because heavy libraries now load only when a command needs them, and configuration loads faster by parsing init.yaml with the native YAML parser and reusing the parsed file while it is unchanged
• Customer-supplied XML files (Nessus scans, CCI lists, FedRAMP documents, file uploads and data transformer inputs) are now parsed with a hardened parser that refuses external entities and entity expansion, and Nessus files parse about twice as fast
• STIG checklist (.ckl and .cklb, including s3:// paths) findings are now imported through the platform's checklist import endpoint on RegScale 6.31 or later, which creates the issues for failed checks; older platforms keep the previous client-side .ckl import
• Burp import now records scanned targets as web applications and no longer marks newly created targets as not internet-facing, so FedRAMP VDR reachability is evaluated by the platform
• The jcam export_poams --preview help now explains that a plan whose issues could not be read completely is shown as skipped
• Axonius v2 sync commands now reject --tags and --aql-filter with --mode saved-query instead of silently ignoring them
• The FIPS container image ships pre-compiled Python bytecode, so a fresh container starts commands up to two and a half times faster
• Tanium sync_all now stops at the first step whose Tanium fetch fails, while an on-prem server without Tanium Comply still syncs with a warning
• Tanium sync_assets, sync_findings, sync_compliance and sync_all now exit 6 when fetching from Tanium fails (4 when Tanium refuses the token) instead of reporting success
• CrowdStrike and Jira commands no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new crowdstrikeTimeout and jiraTimeout settings (300 seconds by default)
• Azure AD sync, Intune and the Splunk Entra ID proxy login no longer hang when Microsoft Entra ID stops answering a token request: they fail with exit code 6 after a read timeout set by the new entraTokenTimeout setting (300 seconds by default), and an Azure AD sync authentication failure now exits with code 4 instead of 3
• Tenable.io io commands, AWS sync_assets and sync_ssm, and Defender collect_entra_evidence now exit 6 when the vendor does not answer or fails (4 when it refuses the credentials) instead of exiting 0 as if the run had succeeded; scripts that read the exit code will now see these failures
• Wiz compliance_report now exits 6 (4 when Wiz refuses the credentials) instead of 0 when the compliance report cannot be created, fails, or does not finish in time, and exits 1 when Wiz returns no report; scripts that read the exit code will now see these failures, and no assessments are written for a report that never arrived
• Commands that read RegScale data now fail with a non-zero exit and a message naming the module when the account lacks Read permission on it, or when the server rejects the query, instead of syncing nothing or a partial set

Fixed

• Synqly connector parameter types are now resolved from a fixed list instead of being evaluated, and Prisma SBOM archives skip special files and strip unsafe permission bits on every supported Python version
• Fixed a crash on macOS when a command used the built-in cache together with BigQuery or other Arrow-based data loading
• GCP Security Command Center sync no longer omits passed control assessments for controls that failed in an earlier run within the same process
• Salesforce case and attachment queries now escape their filter values, and BigQuery table names and row limits from configuration are validated before they are placed in a query
• A Microsoft Sentinel sync that fails while writing to RegScale no longer causes the next incremental sync to skip the incidents and alerts it did not write, and entity evidence is filed only after a successful write
• Custom form field saves rejected by the network edge are now retried, the Wiz sync names the assets whose form fields were not saved, and HTTP error pages are logged as one short line instead of the full page
• Wiz sign-in messages and help text name Wiz instead of the commercial Wiz.io service, which misled Wiz for Government users
• Wiz syncs no longer reuse an empty cached result, and a run against a different Wiz server no longer reads another server's cached data
• Wiz STIG check sync now imports only hosts in the selected Wiz project, and keeps a separate cached result per project
• Wiz issue sync no longer marks a rule False Positive or Risk Accepted while Wiz still has open issues for it
• FedRAMP DRF import no longer logs a misleading schema-drift warning when it adds a DR Number property
• JCAM mappings that send text to a Facilities field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no facility
• JCAM artifact imports summarize missing tags and explain how to create them before importing
• Missing or invalid dates no longer default to the current date
• Listing risks returned none against current RegScale versions because the risk model still requested eight fields the platform removed
• DevSecOps runs in a GitHub merge queue now use the pr stage and the queue's base and head commits, and the DevSecOps GitHub Actions install the CLI into a per-run virtual environment, keep bundle artifacts for a configurable 30 days by default and deprecate cli-version latest
• JCAM mappings that send text to a Users or Organizations field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no user or organization
• JCAM mappings that send text to a Compliance Setting, Related Policy, Risk Model, Profile, Threat Model or Program field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no record
• CrowdStrike incident sync now records the device serial number on the assets it creates
• SentinelOne commands that run without an API token now fail with a message that names the missing sentineloneToken secret, instead of an illegal request header error
• Workflow instance filtering in the Python models calls the API route the platform serves
• Prisma Cloud CSV-mode host sync now creates an asset for every host and attaches its findings to it, instead of creating no host assets
• Prisma Cloud syncs that upload findings in more than one chunk no longer close the earlier chunks' vulnerabilities at the end of the run
• rebuild_resolved_guidance now rebuilds exactly the resolved guidance the platform stores: it accepts the PascalCase guidanceStack keys the platform writes, labels every layer with its source name (a Baseline profile layer shows the profile name, not "Base Guidance"), skips layers with blank guidance, and appends the [Local Override]: <justification> line when given the implementation's local tailoring flag and justification
• AWS, Tenable.io and Wiz compliance report downloads no longer spend 12 to 20 minutes retrying a vendor that stopped answering: each now gives up after one read timeout, set by the new awsTimeout and tenableIoTimeout settings or the existing wizTimeout setting
• Jira task sync now logs each task that fails to create, update or close, and no longer counts it in the sync summary
• Nessus import now counts the remediation due date of STIG and compliance findings from the scan date instead of the import date
• Published Docker images are now built from the released commit, so they report the release's own version
• FedRAMP DRF import now saves decimal Adjusted CVSS Scores such as 6.1 to the deviation's Adjusted CVSS Score instead of dropping them or writing them to the Environmental Score
• FedRAMP DRF import now clears the CVSS Base Score for an empty or invalid cell instead of writing 0, keeps the stored score for the export's placeholder text, and keeps deviation fields the workbook has no column for (such as the Temporal Score) on re-import; the DevSecOps SAR publish now reads padded or signed compliance scores instead of sending 0
• FedRAMP DRF import no longer stops when a stored deviation has no DR number, and a re-import keeps a deviation field whose column the workbook does not have instead of clearing it
• FedRAMP DRF re-import updates a POA&M's only stored deviation that has no DR number, and stamps the row's DR number on it, instead of creating a second deviation on the issue
• FedRAMP DRF import no longer moves a deviation to another POA&M when its DR number belongs to a different issue, no longer adds blank or duplicate DR Number properties, and now matches against every stored deviation on a POA&M
• Axonius and legacy ServiceNow issue sync no longer fail when RegScale reports that the parent record has no readable issues
• FedRAMP DRF import no longer creates two deviations and two DR Number properties when one new DR number appears for two POA&Ms (the later row is skipped and reported), lists rows skipped for a DR-number conflict in the import report, no longer fails when no module is given, and loads every deviation of each POA&M from servers that offer it

Administration

[Action Required] Legacy service account tokens expire 30 days after upgrading to v6.35.0.0 or to v6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade. RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, verify or reconfigure the service account role and application access.

Granular Subsystem Access in Group Permissions: Group permissions in application management now support granular access configurations to the files subsystem supporting each module. This enables more precise role-based access controls, so organizations can grant users only the access their role requires.

Preset Configuration Templates: Load relevant export templates and form-builder settings into your tenant, ensuring your users only see formatting relevant to their industry or domain across the platform.

• Relevant settings will be applied to Export Groups, Export Templates, Form Tabs, Form Fields, Form Field Dropdown Choices, and Module Rules
• Templates are provided for multiple service lines including Navy, Army, and USAF
• Option available to reset the UI to the original

Compliance Settings: Risk Accepted is now a roll up category in Compliance Settings and the Control Scorecard.

Catalogs

Versioning Update: Catalog versioning is now supported for catalogs of the same UUID. Every update to a catalog from the RegScale repository records a new version of the catalog instead of overriding the previous version.

Guidance Field: Control guidance is now stored separately from control descriptions. Base guidance from OSCAL catalogs is kept as its own field, and supplemental guidance from overlay profiles is captured alongside it. Each control implementation keeps an ordered history of its guidance layers, and the resolved guidance appears on the implementation and feeds narrative generation. Existing fields and customer data are unchanged.

Dashboards

STIG and CIS Benchmarks Reporting Dashboard: The new Compliance Dashboard gives security teams a single view of configuration compliance for a system.

• Summary cards show open findings, high-severity findings, findings without a POA&M, and average compliance, while a per-benchmark grid lets you drill into individual rules. High-severity findings are prioritized in their own list, and each one expands to show the affected hosts.
• A POA&M coverage widget includes a bulk action to create missing POA&Ms, and a severity-weighted CORA score summarizes overall risk.
• The dashboard also shows which scan feeds contributed findings, what carried forward after a benchmark revision, and which reviews have gone stale.

Workflows

Usability Enhancements: A new workflow strip on Record Forms shows progress at a glance, and the Workbench "Steps Assigned to Me" grid has been redesigned. The Alerts drawer is now action-first, so you can act directly from a notification, and a new review screen combines the record snapshot, a live stepper, and a review panel. Labels and step counts have been updated for clarity.

Governance Status Board: A new command center gives you visibility into workflow health across modules. It opens with an executive KPI row and includes a dynamic Kanban driven by each module's statuses, an SLA health matrix with an aging distribution, and SLA views by user and approver capacity and by module. Workflow steps can now be reassigned or reminded, with each action recorded in an audit trail.

Bug Fixes and General Maintenance

This version includes a RS-UI upgrade from Angular 21 to Angular 22.

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[6.53.0] - 2026-10-14

Added

• Added regscale trust-center evidence push to push JSON evidence to a Trust Center evidence record by its evidence ID
• eMASS commands now report failed records under REGSCALE_STRICT_EXIT_CODES, and the eMASS importers count failed saves, milestones, custom fields and role links they previously only logged
• Axonius V2 sync commands accept KEY=VALUE1|VALUE2 tags and an --aql-filter option for stricter filtering

Changed

• Incremental Wiz pulls re-baseline weekly through the new wizIncrementalRebaselineHours setting so daily syncs stay incremental, and wizFullPullLimitHours now only limits how old cached Wiz data may be
• The wizLastInventoryPull, wizLastVulnerabilityPull, wizLastIssuePull and matching FullPull keys are deprecated and replaced by wizPullWatermarks, and incremental Wiz pulls (wizIncrementalPulls) are planned to become the default in 7.0.0
• Axonius V2 --tags now takes effect by filtering on Adapter Tag values, so runs that previously returned no records or an unfiltered set can return different record counts

Fixed

• eMASS API POA&M, control test result and system mappers no longer fail on every record, and a non-compliant test result is no longer read as compliant
• eMASS POA&M bidirectional sync no longer pushes every POA&M to eMASS twice
• A JCAM URL that answers with anything other than a list of systems, such as a web or login page, an empty body or a bare JSON value, is now reported as a failed JCAM read naming the settings to check
• Incremental Wiz inventory syncs no longer mark unchanged assets Inactive
• Axonius v2 now reads device fields, aggregated values and AWS tags as Axonius 6.1 returns them, so assets sync with their names, addresses and operating systems and route by their AWS tags
• Wiz, Qualys and Tenable.sc syncs no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new wizTimeout, qualysTimeout and tenableScTimeout settings (300 seconds by default), and Tenable.sc no longer waits about 30 minutes and then reports success
• Incremental Wiz pulls keep a separate watermark for each SSP, Wiz project and filter, and move it only after every record is saved to RegScale, never on a dry run
• Wiz Ports and Protocols are no longer skipped after a full inventory pull when incremental pulls are on
• eMASS SLCM import now stops on a security plan or catalog ID that does not exist, and no longer fails on numeric or date cells
• Axonius V2 tag filtering now returns tagged assets and vulnerabilities

Fixed

• Release container images are now cosign-signed and carry a CycloneDX SBOM attestation

This patch re-publishes the container images (the 6.52.0 images were built from an earlier commit and were unsigned); latest and latest-fips move to this build.

Added

• New regscale acunetix import_acunetix command imports Acunetix XML scan exports as assets, vulnerabilities and issues
• JCAM SSP import now logs the RegScale security plan id assigned to each newly created plan, with a count in the run summary
• CrowdStrike Spotlight sync now supplies known-exploited, internet exposure, exploit availability and CVSS vector data for FedRAMP VDR evaluation, and uses the host role to set the asset type
• Scanner integrations share one asset type lookup, so vendor terms such as server or workstation map to the platform asset types instead of defaulting to Other
• Axonius V2 get_queries command to list the saved queries defined in Axonius and save their definitions to a JSON file

Changed

• eMASS POA&M workbook import now reports failed milestone custom field saves as errors instead of reporting success
• jcam import_controls states outcomes the mapping already decided (a Control Origin or Implementation Status written under the plan's own label, or a Control Origin or applicability answer in the Status column) once per run with a count and the plans it covered, instead of once per control
• A paginated RegScale issue fetch that loses a page now stops instead of carrying on with the issues that did arrive, so nothing acts on a partial list
• A JCAM POA&M export or GitLab issue sync stopped by an incomplete RegScale issue fetch now exits with code 6 (upstream unavailable) instead of completing on a partial list, and a Wiz retention reconcile, outdated-issue closure or scanner control assessment skipped for the same reason (control assessments and statuses are then not written rather than passed) counts as a partial failure, so REGSCALE_STRICT_EXIT_CODES=1 reports it as exit 3
• Compliance syncs now explain when issues are not created because complianceCreation is set to Assessment, and AWS compliance sync help text describes when issues are created for failed controls
• AWS Security Hub commands report progress while pulling findings (pages, findings and elapsed time every 30 seconds) instead of staying silent until the pull finishes, and say how many findings a --tags filter kept
• Plan-field routing summaries list how many records each security plan received, and name only the 20 unmatched, ambiguous or shared identifiers with the most records (with a count of the rest) instead of every one; the full lists are logged at DEBUG
• Guidance now says not to import defusedxml in new code; use hardened lxml for customer-supplied XML
• Wiz commands now honor the customCaCert setting and the SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables, and report a clear error when the named CA bundle cannot be read

Fixed

• CLI log output redirected or piped to a file is now plain, readable text instead of being polluted with color escape codes
• Progress bars no longer write redraw characters into redirected or piped log files
• jcam no longer reports a "Non-Cloud System" cloud descriptor as a value with no RegScale equivalent; it sets no cloud flags, as before, without a warning
• eMASS Control Information workbook import now reads Army and DISA-format workbooks, which have no Application, Database or Operating System Layer columns, without writing values into the wrong fields
• eMASS Control Information workbook import no longer resets a control's assessment frequency when the Frequency cell is blank
• eMASS workbook detection now recognizes Control Information workbooks by their column headers
• eMASS hardware/software inventory import no longer creates facilities during a dry run
• eMASS POA&M workbook import now finds the data sheet in Army and DISA-format workbooks that have no sheet named POA&M
• jcam check_config now reports a failed JCAM read, including an unset jcamToken or jcamURL, as a failure rather than as an empty tenant or a jcamFilter problem, and exits non-zero when JCAM cannot be read, since an import would stop on the same read
• Issue fetches by security plan no longer return each issue past the first 50 twice, and no longer return a partial list as if it were complete when a page fails, so the JCAM POA&M export, GitLab issue sync, Wiz retention and scanner control assessments stop acting on incomplete data
• eMASS system export import no longer deletes a tenant's existing information types when creating missing ones
• Information type lookups no longer fail when a type on the tenant has no description
• Nessus imports no longer close assets or findings for hosts in a file that failed to parse, report the file as an error, and leave it in place so the next run retries it
• Vulnerability mop-up now runs on the last request of an import even when the finding count is an exact multiple of the chunk size or the last chunk holds only compliance findings
• The --scan_date option is honored on Nessus imports, and each file keeps its own scan date when none is given
• Nessus vulnerabilities that carry only a CVSS v2 score now import with that score in the CVSS v2 field instead of 0
• The Tenable.io minimum severity filter now treats critical as 9.0 and accepts moderate
• Nessus software inventory is now built from the downloaded CPE dictionary, and a failed dictionary download is reported and no longer removes the existing one
• A Nessus import that finds no files now exits with a failure status
• A finding that appears in more than one Nessus file is no longer imported as a duplicate issue
• The Nessus CPE dictionary download now honors the sslVerify setting
• Flat-file imports no longer crash when the operating system column contains only numeric values
• Nexpose import now accepts the Rapid7 InsightVM CSV export headers without a manual column mapping
• Xray import now reads JFrog Xray native JSON exports that wrap findings in a top-level rows list
• eMASS POA&M sync now reports updated POA&Ms separately from newly created ones
• eMASS API full system sync with --dry-run no longer pushes controls and POA&Ms to eMASS
• The CLI's log file now records a timestamp and level on every log record, so a long run can be diagnosed from the file afterwards
• Routed Security Hub syncs (sync_securityhub_by_plan_field, sync_securityhub_by_component_map) run without --fallback_ssp_id now keep only the findings that reach a security plan while reading, instead of holding every finding in memory first, so a multi-account pull where most findings route to no plan stays small; with a fallback plan, unmatched and untagged findings are still held because the fallback receives them
• Axonius V2 saved-query sync now works against Axonius 6.1.67
• Qualys sync no longer changes the status or due date of vulnerabilities and issues that were marked accepted, excepted or otherwise set by a person
• Scanner imports that merge several findings into one record now keep any internet exposure, known-exploited and exploit flags, the highest EPSS score and severity, and the earliest first-seen date from every finding instead of only the first
• eMASS POA&M pushes no longer update an unrelated eMASS POA&M when a RegScale issue has no exact match
• The AWS evidence commands (sync_s3, sync_cloudtrail, sync_ssm, sync_cloudwatch, sync_cloudwatch_ex, sync_guardduty, sync_iam, sync_kms, sync_ec2, sync_org, sync_ecr, sync_inspector, sync_directory_services) and wiz compliance_report and wiz sync_compliance now fail the run when RegScale does not accept the evidence record or its file, with exit code 4 for a permission refusal and 6 when RegScale cannot be reached
• Evidence created by connector commands such as Entra ID evidence collection, the Wiz compliance report, and the AWS and GCP evidence commands is no longer rejected on instances with evidence approval enabled, because the CLI no longer sets the running user as the evidence approver
• Listing threats by parent and reading, updating or deleting privacy records no longer fail with a KeyError
• Mock service settings in init.yaml are now applied to Tenable, Microsoft Defender, AWS and BigQuery requests
• Updated Python and OpenSSL in the FIPS container image to patched versions
• Fixed AWS Systems Manager compliance totals, which were always reported as zero compliant and zero non-compliant
• Wiz host configuration findings recorded their first-seen date as the sync time instead of the date Wiz first saw them
• Entra ID evidence collection for the authentication evidence type now saves the authentication methods policy instead of failing with a missing key error
• The Threat model's record count endpoint template now points to the route the API serves
• Tanium sync now records each consolidated vulnerability against the same host on every run instead of a randomly chosen affected host
• Workflow action, workflow instance and workflow template models can be imported again
• Tenable.sc JSONL sync now stores a finding whose plugin name is empty but that carries a CVE or plugin id, under a title derived from the CVE and synopsis
• Tenable.sc JSONL sync now logs a warning naming the file and line of a finding it skips because the finding has no plugin name, CVE or plugin id, or is missing a required field, instead of dropping it silently
• The API-call summary logged at the end of a scanner sync is now emitted at DEBUG instead of INFO
• A vulnerability batch chunk the server refuses over one bad record no longer loses the issues and asset links of the records it retries one at a time; they go through the same batch route as the rest
• A Tanium vulnerability consolidated from several records now reports the earliest first-detected and the latest last-detected date across those records
• defender collect_entra_evidence, gcp collect_evidence and gcp sync_findings --generate-evidence now fail the run (exit code 1, 4 for a permission refusal, or 6 when RegScale cannot be reached) when RegScale does not accept an evidence record or its file, after finishing the remaining evidence, and the error line for a refused evidence record now names the record and gives RegScale's reason

Added

• Wiz syncs can skip vulnerability and end-of-life findings on container images that exist only in a registry and that no workload runs, by setting wizDropUndeployedRegistryImages to true
• Wiz vulnerabilities now show, in their plugin output, how many Wiz issues each finding contributes to by severity and whether a container image was scanned from its registry or a running workload
• eMASS system export import now accepts the eMASS export .zip directly, including its artifact files
• Plan-field routing can match a plan field that lists several identifiers, such as every ComponentID of a system, with --plan-match-multi-value, and can treat named prefixes such as COMP- as not part of an identifier with --ignore-id-prefix; aws sync_findings_by_plan_field supports both
• Axonius v2 can route assets and findings to security plans by a plan field that lists several identifiers, such as a system's Component IDs, with the new sync_assets_by_plan_field and sync_findings_by_plan_field commands, which sync an identifier that two plans list to both and close records that left a plan unless --suppress-mop-up is given
• Scanner integrations can now pass KEV, internet reachability and EPSS data through to vulnerabilities for FedRAMP VDR evaluation
• Evidence, Change and AppGroup models include the new platform fields externalKey, canApproveChanges and canRequestChangeApproval

Changed

• eMASS system export import now exits with an error status when the import records any error, so scheduled runs no longer report a failed import as successful
• eMASS CAC authentication now uses the OpenSSL 3 PKCS#11 provider instead of the deprecated OpenSSL engine interface, and works through a tunnelling proxy
• Asset syncs run their per-asset follow-up lookups in parallel for faster imports
• Faster vulnerability imports by leaving vulnerability-to-asset links to the platform instead of creating them a second time from the CLI
• Security Hub compliance runs routed by plan field now report how many finding resources were left out of every plan's control assessments

Fixed

• Re-importing an eMASS system export no longer duplicates control tests and test results
• eMASS system export import now assigns new controls to the Security Plan's System Owner or ISSO and new assessments to the matched eMASS tester, ISSO, or System Owner instead of the importing user
• eMASS system export import no longer reads artifact files from outside the export folder
• Imports that run past midnight no longer risk closing findings that the same import had just created
• Importing the same eMASS system into more than one Security Plan no longer moves POA&Ms from one plan to another
• eMASS system export import now sets POA&M statuses the tenant actually offers, no longer blanks a POA&M's Identification on re-import, and keeps the system acronym on tenants without a DoD package
• eMASS system export import now imports POA&Ms on DoW tenants, with their due dates, owners, status and severity, and records control narratives, statuses and Not Applicable results correctly
• JCAM information types now match RegScale information types whose titles carry SP 800-60 section numbers or spell "and" as "&", re-importing no longer detaches information types from their plan, and a plan whose information types match none is reported as failed

[6.50.0] - 2026-10-06

Added

• Wiz asset syncs now fill the public-facing FQDN, IP address and URL fields from the application endpoints Wiz confirmed, and network exposure vulnerabilities now carry their port and protocol
• AWS Audit Manager sync now filters assessments with --tags and scopes evidence to tagged resources with --resource_tags
• AWS Security Hub compliance sync commands assess controls from Security Hub standards, route results to one or many security plans by plan field or ComponentID mapping file, and record the unmodified Security Hub findings as evidence by default
• CLI options now accept both snake_case and kebab-case spellings everywhere, with kebab-case shown in --help, and unambiguous Security Plan ID options accept a friendly --ssp-id alias
• Opt-in REGSCALE_STRICT_EXIT_CODES=1 makes scanner syncs that finish with item-level failures exit 3 instead of 0, and the CLI exit-code contract is now documented
• Optional machine-readable output via regscale --output json (or REGSCALE_OUTPUT=json), including a standard run summary and JSON records for supporting commands
• New --preview flag on cleanup deletes, JCAM and eMASS push commands and set_permissions load lists every record that would be created, updated or deleted without writing anything
• New configurations store integration secrets in the RegScale secret store by default, and existing configurations can move theirs with the reversible regscale config migrate-secrets command
• Automated secret scanning on every source change to keep credentials out of published releases
• regscale config validate checks init.yaml for unknown, deprecated, missing and mistyped keys and leftover placeholders, with JSON output and a non-zero exit on errors
• Read-only config mode (REGSCALE_CONFIG_READONLY=1 or --no-write-config) never creates or writes init.yaml, and every setting can also be supplied as a REGSCALE_<NAME> environment variable
• Set REGSCALE_USE_PROXY_ENV=1 to route RegScale API and integration traffic through HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and custom CA bundles now apply to proxied and GraphQL connections
• Trust Center, QRadar and Prisma Cloud CSPM requests now retry automatically with bounded backoff when the vendor API throttles or is briefly unavailable
• Releases now include signed build provenance for the wheel and sdist, keyless cosign signatures and SBOM attestations on the Docker images, and a CycloneDX SBOM attached to each GitHub release, with verification steps in the release verification guide
• Deprecated commands, options and settings now print a warning naming their replacement and the release they will be removed in, following a published deprecation policy
• Shell tab completion for bash, zsh, fish and PowerShell (regscale completion), a regscale integrations list command showing each integration's category, description and docs link, and a regscale --help grouped by category
• Usage examples in the --help of the most-used commands, and corrected command examples in the documentation and in several AWS command help pages
• Opt-in structured JSON logging via regscale --log-format json or REGSCALE_LOG_FORMAT=json, with a run ID shared with the run summary and secret values redacted from every log line
• Added a --force-refresh option to Axonius v2 sync commands to re-pull every record instead of only recently changed ones
• make help now lists the model schema and Azure AD sync regeneration commands
• regscale devsecops run validates the full .regscale-devsecops.yml configuration (change, approval, targets, mapping, SAR, policy, assess, schedule and module settings) and reports each problem with its field path, line number and accepted values
• regscale devsecops ssp snapshot command that exports a Security Plan's control IDs, catalogs and evidence-type mapping coverage to a credential-free file for offline control resolution
• Pipeline readiness check with regscale devsecops doctor, reporting TLS, service-account identity and expiry, missing or excess permissions, configured SSP and component, mapping coverage and schedules
• Pipeline Change records with typed trace links to work items, pull requests, approvals, builds and artifacts via regscale devsecops change open|update|close
• regscale devsecops evidence collect and publish commands that capture branch protection, pull request approvals, CODEOWNERS and JUnit test results as evidence mapped to the security plan and its controls
• regscale devsecops sbom generate, diff and publish commands that produce SBOMs from the GitHub dependency graph or syft, compare them with the previous release and publish them as inventory, evidence and change trace links
• regscale devsecops scan import command that imports SARIF, Trivy, Grype and Wiz CLI results as vulnerabilities and records them as control assurance on the target Security Plan, whatever framework it uses
• regscale devsecops openssf scan and sync publish results to Security Plans without OSPS Baseline controls as a summary assessment and evidence record mapped to the plan's own controls, record them in the run ledger, and weigh AI-assessed observations as added risk only
• regscale devsecops schedule show and apply set the OpenSSF drift-monitor cadence as a RegScale Orchestration Hub job or a scheduled GitHub Actions or GitLab workflow, choosing between the Scorecard API and a fresh scan for each repository
• regscale devsecops assess command that rolls a pipeline run's evidence up to findings for the Security Plan's own controls, publishes them as assurance results, raises issues for failing tool-observed results and closes them once they pass, without changing implementation status unless asked
• regscale devsecops sar build and sar validate commands that produce the run's OSCAL Security Assessment Results and assessment plan from the run ledger and validate them against the pinned NIST OSCAL schema, failing closed when no schema is available
• regscale devsecops sar merge builds a release SAR from the run SARs between two release tags, and sar publish attaches a run or release SAR as a CI artifact, SSP file, SSP child assessment or Evidence record
• regscale devsecops attest writes an in-toto attestation over the run ledger, SAR and policy decision, optionally Sigstore-signs it (never in FIPS mode), attaches it as Evidence and has the platform verify it
• regscale devsecops gate, policy evaluate and policy pull commands that evaluate the digest-locked OPA gate bundle against the run's policy input without RegScale credentials, map the decision to a CI exit code, and skip credentialed steps on fork pull requests
• regscale devsecops policy init command that locks a framework-neutral default gate policy, deciding on evidence types, change categories and per-check OpenSSF Scorecard thresholds, without a RegScale connection
• regscale devsecops change request-approval and change verify commands that submit a Change to the platform's tolerance-policy approval and gate deployments on approved artifact digests, with change close always recording the deployment
• regscale devsecops change shadow-report command that compares shadow-mode Change approval decisions with CCB outcomes, reports agreement, false auto-approval rate, auto-approval share and approval wait time, and checks each component against configurable readiness thresholds before enforcement
• Opt-in regscale devsecops review impact command that reviews a change against the SSP's own controls with a pluggable AI provider (Anthropic, Amazon Bedrock, Azure OpenAI or RegML via the ai extra), records an advisory AI-assessed result and writes the Change's impact analysis section
• regscale devsecops scan import --offline records a scan in the run ledger without RegScale credentials
• regscale devsecops run --stage pr|build|release|deploy|scheduled runs the modules the manifest enables for each pipeline stage, split into a credential-free collect job that writes a verifiable run bundle and a trusted publish job that publishes it
• OpenSSF OSPS Baseline assurance commands (regscale devsecops openssf sync and scan) that run or ingest Scorecard, OSV-Scanner, Privateer, Security Insights, OpenVEX and SLSA provenance results and report per-requirement test results, control assessments, issues and evidence against an OSPS Security Plan
• Signed OSPS conformance attestations (regscale devsecops openssf attest and verify) packaging verdicts as in-toto statements with optional Sigstore keyless signing via the regscale-cli[attest] extra
• Scheduled OSPS drift detection (regscale devsecops openssf monitor) that compares published Scorecard results with the Security Plan and flags regressed controls without running scans
• Evidence tier (Declared, Observed or Verified) recorded on OSPS assessments and control test results
• Reusable GitHub Action that runs OSPS Baseline assurance, with an optional signed attestation, in a pipeline
• Self-contained HTML OSPS conformance report that pipeline runs can publish as an artifact
• QRadar compliance assessment minimum event threshold is now configurable through min_events in the qradar config block
• regscale devsecops change open|update options for the Change's title, description, case notes, test results, outage summary, type, priority, owner, change window and test date, --change-id with --adopt for existing records, a change attach command for files and URL links, --output json on the change, evidence and SBOM publish commands, and sbom publish --parent-asset --name

Changed

• AWS Security Hub tag filtering is now applied server-side so fewer findings are pulled over the wire
• Command reference documentation now covers every CLI command, with a complete generated command index and corrected command, option, and configuration examples across the user guides
• Dependency versions are now capped below their next major release so a new major version of a third-party package can no longer break a fresh pip install
• eMASS client reads and writes the eMASS API v3.31 field names for systems, POA&Ms, milestones and hardware, still reads the older names from earlier eMASS versions, and now sends the required POA&M source field under its correct name
• QRadar assess-compliance now runs through the standard compliance sync, creating a QRadar SIEM asset and scan history, and attaches the recommended fix to issues for failed controls
• Scanner asset syncs no longer look up or store raw source data per asset, which makes large asset imports faster
• FedRAMP SSP XML import no longer calls the retired OSCAL validation service or attaches an OSCAL validation report

Fixed

• License-gated commands now honour the platform's 5-day grace period after the RegScale license expires, warning on each command with the expiry date and grace days left, and after it ends report that the license expired on that date
• jcam import_ssp no longer stops partway through creating plans when JCAM reports a system with no categorization or system type, a new plan now gets its organization at creation, and one organization that cannot be read no longer stops the import
• JCAM control inheritance import again writes the plan lineage and inherited control records the RegScale inheritance views read
• FedRAMP CIS/CRM import now sets the inheritance model on control objectives and rolls it up to the control implementation
• Control matching now skips a missing, blank or non-text control ID instead of crashing the import
• Help text for the Axonius combine_data_parts and file_stats commands, and corrected descriptions for pull_data and pull_data_axonius
• Negated CLI flags (--no-x) now accept both snake_case and kebab-case spellings
• Settings supplied through environment variables are no longer written into init.yaml, so a secret in the environment can no longer overwrite a secret-store reference on disk
• A secret passed to regscale config --param is no longer written to the debug log
• Prisma Cloud imports no longer drop vulnerabilities whose published or fix dates are millisecond timestamps
• Issues whose asset identifier list is too long for the field now say how many identifiers were left out
• Scanner imports no longer silently drop every vulnerability when the RegScale tenant lookup fails
• GitHub SBOM sync no longer fails when the security plan already has component mappings, and the client-side outdated-issue closure and control objective lookup by catalogue no longer fail on every call
• JCAM import no longer stops when a FISMA rollup would move a security plan under a different parent; that plan is skipped and reported in the run summary
• Axonius v2 sync no longer fails on Axonius 6.1, and synced assets and findings now include hostname, IP, OS, CVE, severity and other details
• Fixed debug log issue in login and api modules.
• JCAM inheritance import no longer resets provider controls to not inheritable, and skips inheritances that name a plan as its own provider
• Updating an existing Security Plan no longer fails when the instance has disabled plan fields; those fields are skipped with a warning
• Asset imports, including Nessus, no longer fall back to slow one-by-one uploads when the same host appears more than once in a file
• QRadar compliance assessments now state why each control passed or failed and recommend how to fix it, instead of only the result
• Trivy and Grype imports now link vulnerabilities to their scanned assets
• DevSecOps hints, example manifests and the regscale-devsecops GitHub Action now match the commands and configuration keys the CLI actually reads, and unread module keys log a warning
• An invalid RegScale token no longer appears in login error messages, and devsecops run collect jobs no longer create an init.yaml in the working directory or refuse to publish a bundle whose configuration file differs only in line endings
• QRadar assess-compliance now creates issues for failed controls when complianceCreation is set to Issue or POAM
• Wiz inventory sync no longer fails when no project ID is supplied, and several integrations no longer fail on null values returned for optional fields
• Microsoft Defender for Cloud resource sync no longer fails on subscriptions with more than about 96,000 resources
• Microsoft Defender syncs now follow relative pagination links from the Defender API instead of sending them to the RegScale server
• Records queued for batch saving, such as Splunk Data records and Jira or SonarCloud issue updates, are no longer dropped when disableCache is enabled
• GCP runs now warn when a configured service account credential is invalid, name the rejected setting and the reason, and stop with an error when no configured credential is valid instead of continuing on a different credential
• regscale evidence start now creates the assessment for each project listed in list.json, instead of stopping with an error or attaching one program's results to another project
• Platform version checks now treat an internal build of the RegScale platform (one that reports a build number and date instead of a release version) as a development build rather than as a very new release. Features that stay off on development builds, such as linking one issue to multiple controls, are no longer switched on against these servers, and a server that reports an unrecognized version no longer causes a version-parsing error.
• Updating an existing task under a parent record that already has tasks no longer fails
• Installing the CLI now requires a PyJWT release free of the known critical and high severity vulnerabilities

Bug Fixes and Usability Enhancements

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[Action Required] Legacy service account tokens expire 30 days after upgrading to 6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade to 6.34.4.0. After the upgrade, RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, check that service account's roles and application access.

Rich Text Editor Upgrade: The Rich Text Editor has been replaced to provide more reliable formatting. Bulleted and numbered lists, tables, links, and text copied from Word now behave more consistently. Content you've already saved in these fields will not be modified.

Preset Configurations: When profile layering is disabled, the preview now clearly shows which catalogs and profiles will be excluded from the install.

[6.49.8] - 2026-09-29

Fixed

• Axonius v2 asset sync now works with older Axonius versions such as 6.1 and no longer fails with a bad request error

[6.49.5] - 2026-09-28

Added

• Added an about command to the Axonius v2 integration to show connected instance details

Fixed

• Axonius v2 asset sync pagination now sends valid requests, fixing full asset sync