Release Notes

Continuous Coverage Expansion - January 2026 Update

Starting from mid January 2026, Bitsight customers will begin to see an increase in findings discovered by Bitsight (powered by Groma enhancements). With Continuous Coverage Expansion January update, our customers can expect:

✔ Broader visibility into their attack surface, more findings, more assets

✔ 90-day incubation period to review and remediate the findings before they become rating impacting

Any updates arriving from Groma under “Continuous Coverage Expansion” are global for all customers and Bitsight inventory entities.

Continuous Coverage Expansion - December 2025 Update

Starting from mid December, Bitsight customers will begin to see an increase in assets and findings discovered by Bitsight (powered by GIA enhancements). With Continuous Coverage Expansion, our customers can expect:

✔ Broader visibility into their attack surface, more findings, more assets

✔ A 90-day Grace period for the newly discovered domains to allow time to review and remediate the findings before they become rating impacting

Any updates arriving from GIA under “Continuous Coverage Expansion” are global for all customers

Dynamic Remediation: Web Application Security

Web Application Security findings that previously had to complete their lifetime when an asset is taken offline (such as removing a DNS record) are now marked as remediated. They stop impacting the rating as soon as the asset is detected as offline. Depending on the existing findings, remediation may impact (positively or negatively) the risk vector grade and/or the headline rating.

Framework Intelligence

Enables security and risk teams to upload vendor documentation (e.g., SOC 2 reports, Cyber Assurance Policies) and receive a compliance assessment mapped to frameworks like SIG LITE 2025. It leverages generative AI to surface control gaps, summarize evidence, and support faster, more scalable third-party assessments.

Assignments

A centralized view in the Vendor Risk Management application that enhances accountability for Internal Questionnaires, ensures timely completion, and simplifies progress tracking.

History Tab

A History tab in the Finding Details sheet for the Findings Table. It shows what happened to that finding (identified by the rolled-up ID). History is conveyed by:

• User-requested rescans
• Issue Tracking

User-requested rescans

An instant response with the results of a rescan. Applicable for TLS/SSL Configurations, Open Ports, and Server Software.

[SPM] Subsidiaries page

• Show or hide unsubscribed subsidiaries.
• More streamlined subsidiary data export.
• Reflects rating impacting and non-impacting risk vectors.

Latest Updates

Features Bitsight Pulse Market Level Threat Intelligence in addition to Emerging Security Events.

Guest Network Exclusion

Remove guest networks from the rating with no loss of attack surface visibility. The exclusion lasts for a renewable 1-year period.

Rescanned Findings

As part of the Dynamic Remediation initiative, the Rescanned Findings card in the My Company Dashboard shows the number of findings per status and the total number of findings that had a rescan requested.

Ratings Change Alert Category

Toggle between points or percentage. Be alerted when security ratings decrease or increase by a set percentage or number of points. This is useful for monitoring general fluctuations in a company or country's cyber security posture.

Issue Tracking

• Remediation status, users assigned to remediate findings, and finding comments with the same rolled up ID can now propagate throughout the same ratings tree.
• Enable automatic finding rescans when findings are resolved (Remediation Status = Resolved).

Emerging Security Events Card

Includes Dynamic Vulnerability Exploit (DVE) information.

Identity Intelligence Preview Card

Detects and provides, on average, more credentials than the standard Exposed Credentials data. Identity Intelligence also supports password policy filtering, email exclusions, and correlation with identity providers (IdP).

Internal Documents

Drag and drop to bulk upload documents.

Vendors

Monitor vendors flagged during assessments and use Continuous Monitoring subscriptions while adding vendors.

Connections – Revoke connections without restriction and have full control of your data. Revoke connections from:

VRM App:Vendors

TMH App:Connections

• Severe and Material FindingsBitsight filter set. Available for SPM, CM, and Insurance findings.
• Vulnerability Evidence – Available in Third Party Assets in the Security Performance Management application and in Critical Assets in the Continuous Monitoring application.
• Portfolio Dashboard – Critical Assets Exposure card.

• New TLS/SSL Certificate Finding Fields – Added All Sources and My Company's Sources fields.
• Security Ratings Timeline – Rating increases are included in the timeline.
• TMH/VRM User Roles – Vulnerability Response Outreach user role, which allows you to send questionnaires from the Continuous Monitoring application.

• Trust Score Adjustment – Increase or decrease the calculated Trust Score based on relevant information.
• Instant Insights – Generative AI to extract a document's contents, analyze, and then summarize the contents into deep and actionable insights.

• Operational Technology Exposure Intelligence – Highlights operational technology (OT) risk and provides global visibility of exposed industrial control system (ICS) devices across supported protocols.
• TLS/SSL Certificates & TLS/SSL Configuration Findings – Details on TLS/SSL Certificates and TLS/SSL Configurations findings.

• Risk Remediation – Use the Risk Remediation forecast to create a forecast using your RRPs.
• Findings – Most findings are no longer sampled. Companies with over 10 million findings still have sampled findings.

• Assessments – Assessments are now available in the Security Performance Management application.
• Vulnerability Detection – Incorporated Exploit Prediction Scoring System (EPSS), which estimates the likelihood that a software could be exploited. The higher the percentage the more likely it is to be exploited.
• TMH App: Documents – Share documents (share all & selective sharing).

• Artifacts – 'NATF Energy Sector Supply Chain Risk' added to questionnaires.
• Assessments Overview – A comprehensive view of your assessments, providing insights into the top 5 results for upcoming, ongoing, and completed assessments.

• Subsidiary Improvement – Patching Cadence risk vector added to Subsidiary Improvement plan.
• Risk Analytics – New color them option added to the Risk Analytics page.

• class="app-cm"Continuous Monitoring Findings – Filter by multiple assets.
  • Multi-select the assets you want and care about from the Assets page [Infrastructure ➔ Assets] and open them in the Findings page as filters.
  • Use filter sets to save your selection from the Findings page, so you can open this filter with the same assets whenever you return to the Findings page.
• Filter Sets – You can now create filter sets for multiple assets in the CM and SPM apps.

Emerging Security Events card:

• The card stays hidden: Now, when you click “hide” on a card, it stays hidden even if you leave the page and come back.
• Save space: Hidden cards mean more room for other important info on the dashboard.
• New events still visible: Don’t worry, you won’t miss new threats. The hidden card shows the number of new events, and they’ll still automatically expand for everyone when new info appears (like a new vulnerability).

Infrastructure data quality & collection improvements:

• Increased asset discovery capability.
• Improved data quality.

Knowledge Base:

• Leave comments at the bottom of an article to provide feedback on our knowledge base content.
• Get a count of matches (grouped by category) when doing a text search.
• Small changes to the visual design.

• Benchmark Groups – Group companies for benchmarking. They have the same metrics and are interchangeable with peer groups.
• Risk Analytics – Filter by tiers or folders.

Filter Sets – Bitsight filter sets.

• Bad and warn findings
• Findings that impact the grade
• New findings

• Assets – Directly tag individual assets from the Assets page.
• Findings – The Impacts Risk Vector Grade field indicates whether or not a finding currently impacts a risk vector grade. Filter findings that currently impact or no longer impact risk vector grades.

• Vulnerability Catalog – No longer available. Users should now use the Vulnerability Catalog report.
• Infrastructure: Attribution & Assets – No longer available. All data is available on the Infrastructure page.
• Infrastructure – Released.
• Findings – Use rolled up ID as a finding identifier.

• Ratings Tree – Filtering within the SPM app.
• Exposed Credential Data – The Domains field no longer include expired domains. It includes only the currently active and owned domains.

• “TPRM” renamed to “Continuous Monitoring.”
• Design updates:
  • App switcher moved to the top of the menu on the left.
  • Expand/collapse the menu using the toggle on the bottom left.