Release Notes

Continuous Coverage Expansion - January 2026 Update

Starting from mid January 2026, Bitsight customers will begin to see an increase in findings discovered by Bitsight (powered by Groma enhancements). With Continuous Coverage Expansion January update, our customers can expect:

Any updates arriving from Groma under “Continuous Coverage Expansion” are global for all customers and Bitsight inventory entities.

Continuous Coverage Expansion - December 2025 Update

Starting from mid December, Bitsight customers will begin to see an increase in assets and findings discovered by Bitsight (powered by GIA enhancements). With Continuous Coverage Expansion, our customers can expect:

Any updates arriving from GIA under “Continuous Coverage Expansion” are global for all customers

Dynamic Remediation: Web Application Security

Web Application Security findings that previously had to complete their lifetime when an asset is taken offline (such as removing a DNS record) are now marked as remediated. They stop impacting the rating as soon as the asset is detected as offline. Depending on the existing findings, remediation may impact (positively or negatively) the risk vector grade and/or the headline rating.

Framework Intelligence

Enables security and risk teams to upload vendor documentation (e.g., SOC 2 reports, Cyber Assurance Policies) and receive a compliance assessment mapped to frameworks like SIG LITE 2025. It leverages generative AI to surface control gaps, summarize evidence, and support faster, more scalable third-party assessments.

Assignments

A centralized view in the Vendor Risk Management application that enhances accountability for Internal Questionnaires, ensures timely completion, and simplifies progress tracking.

History Tab

A History tab in the Finding Details sheet for the Findings Table. It shows what happened to that finding (identified by the rolled-up ID). History is conveyed by:

• User-requested rescans
• Issue Tracking

User-requested rescans

An instant response with the results of a rescan. Applicable for TLS/SSL Configurations, Open Ports, and Server Software.

User Roles – None role.

[SPM] Subsidiaries page

• Show or hide unsubscribed subsidiaries.
• More streamlined subsidiary data export.
• Reflects rating impacting and non-impacting risk vectors.

Latest Updates

Features Bitsight Pulse Market Level Threat Intelligence in addition to Emerging Security Events.

Archer Integrations – Integration with Bitsight Vendor Risk Management data and Connector V1.0.

TMH App: Documents – Upload or download questionnaires directly in the Documents page. Get key offline editing and storage functionality for your data.

Tag Inheritance – Enable or disable tag inheritance from the Account Preferences tab.

Guest Network Exclusion

Remove guest networks from the rating with no loss of attack surface visibility. The exclusion lasts for a renewable 1-year period.

Rescanned Findings

As part of the Dynamic Remediation initiative, the Rescanned Findings card in the My Company Dashboard shows the number of findings per status and the total number of findings that had a rescan requested.

Ratings Change Alert Category

Toggle between points or percentage. Be alerted when security ratings decrease or increase by a set percentage or number of points. This is useful for monitoring general fluctuations in a company or country's cyber security posture.

Ratings Preview – Prepare for the 2025 Ratings Algorithm Update (RAU).

Issue Tracking

• Remediation status, users assigned to remediate findings, and finding comments with the same rolled up ID can now propagate throughout the same ratings tree.
• Enable automatic finding rescans when findings are resolved (Remediation Status = Resolved).

Emerging Security Events Card

Includes Dynamic Vulnerability Exploit (DVE) information.

Identity Intelligence Preview Card

Detects and provides, on average, more credentials than the standard Exposed Credentials data. Identity Intelligence also supports password policy filtering, email exclusions, and correlation with identity providers (IdP).

Internal Documents

Drag and drop to bulk upload documents.

Vendors

Monitor vendors flagged during assessments and use Continuous Monitoring subscriptions while adding vendors.

Connections – Revoke connections without restriction and have full control of your data. Revoke connections from:

VRM App:Vendors

TMH App:Connections

Portfolio Risk Matrix – Stoplight (green, yellow, red) color theme.

Products by CPE Report – The Products by CPE report provides fourth party data. Use this to search for vendors, products, and versions by Common Platform Enumeration (CPE).

Internal Information – Internal information about a vendor.

Company-provided infrastructure now has a 60-day grace period before it impacts your rating.

Unsubscribe from the company search and Companies tab of the Access Control page.

• Severe and Material FindingsBitsight filter set. Available for SPM, CM, and Insurance findings.
• Vulnerability Evidence – Available in Third Party Assets in the Security Performance Management application and in Critical Assets in the Continuous Monitoring application.
• Portfolio Dashboard – Critical Assets Exposure card.

• New TLS/SSL Certificate Finding Fields – Added All Sources and My Company's Sources fields.
• Security Ratings Timeline – Rating increases are included in the timeline.
• TMH/VRM User Roles – Vulnerability Response Outreach user role, which allows you to send questionnaires from the Continuous Monitoring application.

Help Menu – Access help content (Knowledge Base and Bitsight Academy), specified by the opened application.

• Trust Score Adjustment – Increase or decrease the calculated Trust Score based on relevant information.
• Instant Insights – Generative AI to extract a document's contents, analyze, and then summarize the contents into deep and actionable insights.

Jira Integration – Allows users to integrate the SPM application and Jira, creating Jira tickets directly from the Findings Table.

• Operational Technology Exposure Intelligence – Highlights operational technology (OT) risk and provides global visibility of exposed industrial control system (ICS) devices across supported protocols.
• TLS/SSL Certificates & TLS/SSL Configuration Findings – Details on TLS/SSL Certificates and TLS/SSL Configurations findings.

Data Residency – Specify your operational region for storing, processing, and managing your Vendor Risk Management and Trust Management Hub data.

• Risk Remediation – Use the Risk Remediation forecast to create a forecast using your RRPs.
• Findings – Most findings are no longer sampled. Companies with over 10 million findings still have sampled findings.

Security Performance Management application – Re-organized the menu.

Anecdotes.ai – Manage compliance programs by automating evidence collection, providing real-time insights, and allowing easy customization of frameworks and controls.

Company Overview & Executive reports localized into Japanese [ja].

Company Overview & Executive reports localized into German [de] and Spanish [es].

Executive Summary – A detailed, cumulative report that provides a holistic view of the vendor portfolio.

Public Disclosures Risk Category – DNS incidents are now separated into incidents and findings based on how they're detected.

Financial Quantification – New Results Comparison view. Results delivery is now automated.

SPM Alerts – New SPM alerts experience, including multiple new alert types.

• Assessments – Assessments are now available in the Security Performance Management application.
• Vulnerability Detection – Incorporated Exploit Prediction Scoring System (EPSS), which estimates the likelihood that a software could be exploited. The higher the percentage the more likely it is to be exploited.
• TMH App: Documents – Share documents (share all & selective sharing).

Findings – Infrastructure tags are displayed in its own column instead of being below each finding.

Peer Analytics – Compare Patching Cadence performance with your peer group.

• Artifacts – 'NATF Energy Sector Supply Chain Risk' added to questionnaires.
• Assessments Overview – A comprehensive view of your assessments, providing insights into the top 5 results for upcoming, ongoing, and completed assessments.

Forecasting – Forecast Patching Cadence findings.

My Company Dashboard – Exposure metrics.

Email Preferences – Be notified when a company you're monitoring is deactivated.

Artifacts – ISO 27001:2022 questionnaire available as an artifact.

Email Preferences – New Vulnerability Notifications available for all subscription types.

Portfolio Dashboard – Vendor Discovery card added.

My Company Dashboard – Vendor Discovery card added.

Requirements – Add [Assessment Setup ➔ Requirements] and view [Vendor Profile ➔ Requirements] alternate requirements in the Vendor Risk Management application.

Underwriting Guidelines – Include exposure data (vulnerabilities & vulnerability groups).

Data Vault – Get underlying data behind Bitsight Security Ratings without the Cyber Insurance application.

• Subsidiary Improvement – Patching Cadence risk vector added to Subsidiary Improvement plan.
• Risk Analytics – New color them option added to the Risk Analytics page.

Vendor Risk Management Application – Internal Questionnaires page.

• class="app-cm"Continuous Monitoring Findings – Filter by multiple assets.
  • Multi-select the assets you want and care about from the Assets page [Infrastructure ➔ Assets] and open them in the Findings page as filters.
  • Use filter sets to save your selection from the Findings page, so you can open this filter with the same assets whenever you return to the Findings page.
• Filter Sets – You can now create filter sets for multiple assets in the CM and SPM apps.

Provisional Ratings – Once mapped, auto-subscribing is a 1-step process down from 2, just like Bitsight curated ratings.

Emerging Security Events card:

• The card stays hidden: Now, when you click “hide” on a card, it stays hidden even if you leave the page and come back.
• Save space: Hidden cards mean more room for other important info on the dashboard.
• New events still visible: Don’t worry, you won’t miss new threats. The hidden card shows the number of new events, and they’ll still automatically expand for everyone when new info appears (like a new vulnerability).

Connections – Add vendors in bulk.

Infrastructure data quality & collection improvements:

• Increased asset discovery capability.
• Improved data quality.

Vendor Risk: Overview – Collaboration panel replaced with Asset Geolocation panel.

Vulnerability Groups – classifies vulnerabilities in Vulnerability Detection based on common frameworks and events, to make zeroing in on the correct exposures easier and provides a more acute way of prioritizing which vulnerabilities to prioritize remediation or outreach on.

Knowledge Base:

• Leave comments at the bottom of an article to provide feedback on our knowledge base content.
• Get a count of matches (grouped by category) when doing a text search.
• Small changes to the visual design.

Findings – Tag assets from the Findings Table.

Financial Quantification – Major update adds frequency, annualized risk, and peer comparison capabilities.

Risk Analytics: Risk Vectors Overview – Get a breakdown of the 13 risk vectors with cybersecurity incident data from the Marsh McLennan study.

• Benchmark Groups – Group companies for benchmarking. They have the same metrics and are interchangeable with peer groups.
• Risk Analytics – Filter by tiers or folders.

Web Application Security Risk Vector – TLS Errors on Page Resource Fetch assessment deprecated.

Vendor Discovery – automatically surface your vendors in the Continuous Monitoring application.

Risk Analytics – An industry-first portfolio view into third-party vendor risk. Contextualize and prioritize risk insights from a third-party ecosystem.

Filter Sets – Bitsight filter sets.

• Bad and warn findings
• Findings that impact the grade
• New findings

Findings – Download up to 100,000 rows of findings data.

• Assets – Directly tag individual assets from the Assets page.
• Findings – The Impacts Risk Vector Grade field indicates whether or not a finding currently impacts a risk vector grade. Filter findings that currently impact or no longer impact risk vector grades.

Microsoft Azure Sentinel Integration – Bring Bitsight data and tools into existing security program workflows in Sentinel.

Client/Vendor Access Program – Cyber Insurance clients can register for the Client/Vendor Program.

Vendor Risk: Overview – Released.

• Vulnerability Catalog – No longer available. Users should now use the Vulnerability Catalog report.
• Infrastructure: Attribution & Assets – No longer available. All data is available on the Infrastructure page.
• Infrastructure – Released.
• Findings – Use rolled up ID as a finding identifier.

• Ratings Tree – Filtering within the SPM app.
• Exposed Credential Data – The Domains field no longer include expired domains. It includes only the currently active and owned domains.

Risk Remediation Plan – Available for Patching Cadence.

Add Assets – Available for Group Admins.

Cloud Infrastructure for AWS – Navigation available in Attack Surface menu.

Attack Surface Analytics – Exposure insights.

Emerging Security Events – Card available in the Latest Updates panel in the My Company Dashboard.

• “TPRM” renamed to “Continuous Monitoring.”
• Design updates:
  • App switcher moved to the top of the menu on the left.
  • Expand/collapse the menu using the toggle on the bottom left.