| Tags | Feature |
|---|---|
| AST | App & Target Vuln View for Code Repository & Artifacts Target view grouped by apps and teams. |
| Integration, Jenkins, GitHub Actions | Non Harness CI (Jenkins & GHA Support) Native onboarding for Non Harness CI - Jenkins and GitHub Actions. |
| AI, Triage | Triage Agent AI-powered agent that determines if a finding is a likely false positive or likely true positive by leveraging LLMs to understand real-world risk beyond CVSS scores. |
| Onboarding, Get Started | Get Started A new Get Started workflow to onboard third-party integrations - Github Actions, Jenkins. |
| AI, Orchestration | LLM as a Scanner Orchestration Orchestrate LLM-based scanners natively in STO pipelines. |
| AI, Remediation | Remediation Agent AI-powered agent that remediates security findings with suggested fixes and automated workflows. |
| SBOM, Compliance | SBOM & Compliance Visibility Add SBOM and Compliance Tabs in the Target view page |
| Runtime, Visibility | Code to Runtime Visibility End-to-end vulnerability traceability from code to runtime, powered by the Security Graph. |
| Integration, Checkmarx, Mend | Bi-directional Support for Checkmarx and Mend Manage Checkmarx and Mend scans and findings from STO while keeping source projects in sync, and reduce duplicate workflows across tools. |
| Deduplication, Scanner | Scanner Deduplication Roll up findings from multiple scanners into a single issue so the same vulnerability is not tracked more than once. |
| Tags | Feature |
|---|---|
| Data Handling | Target Deletion Allows deletion of unwanted targets/artifacts vulnerability data to reduce noise. |
| Runtime, Visibility | Code to CD Inventory Graph with Runtime Signals Extend the Code to CD Inventory Graph with runtime signals so teams overlay live service health and exposure data on the code-to-deploy graph and prioritize production fixes. |
| AI, Remediation, SCA | Auto PRs for SCA Remediation Create PRs for SCA issues using AI suggestions for direct dependency upgrades (JS/TS, Python, Java). Transitives excluded. |
| Integration | Orca Integration Native integration with Orca. |
| Risk Scoring, Prioritization | Harness Risk Scoring Combine severity, exploitability, reachability, and environment data into a single score so security teams can prioritize the riskiest issues across services. |
| Reachability, Runtime | Runtime Reachability via STO Distinguish vulnerabilities that are actually reachable at runtime from theoretical issues so teams apply risk-based remediation and more focused policies. |
| Tags | Feature |
|---|---|
| SAST, DAST, Correlation | SAST to DAST Correlation Correlate SAST and DAST findings so teams see how a single underlying flaw manifests in code and at runtime. |
| Integration, ServiceNow | Exemption Management via ServiceNow Native ServiceNow integration for exemption management. |
| Reachability, Vulnerability Prioritization | Reachability based Vulnerability Prioritization Prioritize vulnerabilities on Harness risk score - formualted on CVSS, EPSS, static and runtime Reacability, etc. |
| Visibility, AppSec | Issues List - Org/Account A centralized, prioritized vulnerability list for the AppSec persona at the Org/Account scope. |
| Integration, Dastardly | Dastardly Integration Support Dastardly with Orchestration, Extraction, and Ingestion modes, with Built-in scanner workflow step under DAST. |
| Integration, CrowdStrike | CrowdStrike Integration Native integration with CrowdStrike. |
| Vulnerability, Governance | Extraction and Ingestion mode support for Base Image detection Ability to see base image vs. app layer vulnerabilities and govern pipelines. |
| SAST, .NET | Native .NET Scanning Support Scan .NET services natively in STO without relying on external tooling. |
| Tags | Feature |
|---|---|
| AI, Remediation, GitLab, Bitbucket | Auto PR Support for GitLab and Bitbucket Create pull requests from Harness AI remediation for GitLab and Bitbucket. |
| Ticketing, Integration, Exemption | Auto Create Jira Ticket on Exemption Request Automatically create a Jira ticket on exemption request using a configured template. |
| Integration, Cortex Cloud | Cortex Cloud Integration Native Integration with Cortex Cloud. |
| Analytics | Product Usage Analytics A centralized analytics dashboard showing STO usage trends, adoption, and engagement across all security scans. |
| Exemption | Exemption Workflow Revamp Revamp the exemption workflow with configurable rules based on severity, customizable exemption periods per severity level. |
| AI SKills | AI Skills for AI-powered IDEs Expose STO capabilities as AI-powered skills via the Harness MCP Server, enabling security workflow automation directly from AI-powered IDEs. |
| Visibility, AppSec | Open and Remediated Issues Trend Visibility into active and remediated issues trend across Targets in a Project. |
| Infrastructure | Linux ARM64 Support Adds Linux ARM64 infrastructure support for all STO steps, enabling broader platform compatibility and flexibility. |
| FedRAMP | Support Nexus scanner in FedRAMP Add native ingestion-mode support for the Nexus scanner in FedRAMP environments. |
| FedRAMP | Support Prisma Cloud scanner in FedRAMP Add native ingestion-mode support for the Prisma Cloud scanner in FedRAMP environments. |
| Visibility, Dashboard | Project level Security Dashboard Redesigned STO overview page to get security posture across the Project via graphs, trends, summary. |
| Delegate | Delegate 3.0 Support Extend STO steps to execute on Delegate 3.0. |
| Override Severity | Manually override severity Ability to manually override the severity of an issue across all the targets at Project scope. |
| EPSS | Exploit Protection Scoring System (EPSS) Provide EPSS score in addition to CVSS score for better vulnerability prioritization. |
| Integration, Qwiet AI | Native Integration with Qwiet AI Native integration with Qwiet.ai scanners aka Harness Secruity Scanners for SAST/SCA/Secret. |
| External Policy Failures, Severity | Map External Policy Failures to severity Map external policy failures ingested from 3rd party scanners to a severity instead of INFO level issues. |
| Usability, Filtering | Filters on Exemption page Provide filters for users to narrow down exemptions based on all the supported criteria. |
| Vulnerability, Governance | Base image vs App layer vulnerability Ability to see base image vs. app layer vulnerabilities and govern pipelines. |
| Visibility, Platform | Fix: Handle vulnerabilities for Aborted/Resume executions Aggregate security scan results from all stages/executions including aborted, resumed pipeline executions. |
| Notifications, Platform | Exemption Notifications Notify developers and AppSec teams via email, Slack, Microsoft Teams, or a custom webhook about pending, approved, and expired exemption requests. |
| Platform, RBAC | Download Issues Data as CSV from Vulnerabilities Tab Enable RBAC-honoring download of issues CSV from Vulnerabilities Tab, add API, and deep-link to Pipeline Execution Summary Dashboard with execution ID. |
| AI, Visibility | AppSec Chatbot AI chatbot to help with STO use cases. |
| Visibility, AppSec | Issues List - Project Centralized, prioritized vulnerability list for AppSec persona with ticket creation for tracking at Project scope. |
| Cross Module | Native support in IDP Native STO support via the Harness IDP module score-cards. |
| RBAC | STO support in Harness Resource Group Ability to configure granular access to security test results within the pipeline view via the Harness Resource Group. |
| Exemption Management | Approval/Rejection comment Enable AppSec users to add contextual comments when approving or rejecting an exemption request. |
| FIPS, Compliance | FIPS support for STO Ability to leverage STO steps in Harness Pipeline within FIPS enabled SMP environment. |
| Platform, Exemption | Exemption at Occurrence Level Exempt specific occurrences of issues without exempting the entire STO issue. |