April 2025

Description:
Aptori now integrates  EPSS Version 4 (Exploit Prediction Scoring System) to deliver smarter, data-driven vulnerability prioritization. Each issue is dynamically updated with the latest EPSS scores, helping teams focus remediation efforts on the vulnerabilities most likely to be exploited in the wild. By combining Aptori’s contextual analysis with EPSS threat intelligence, security teams can make more informed decisions and reduce time spent on low-risk findings.

EPSS scores are continuously refreshed, ensuring your risk assessments stay current as threat landscapes evolve.

Where to Find It:
EPSS scores are displayed directly in the Issue Details view and are included in exports and reports. Learn more about EPSS v4 and how it enhances vulnerability management in our blog post.

Who Can Use It:
Available to all users with access to issue data and reports.

‍

Description:
Aptori now delivers comprehensive vulnerability mapping across a broad range of industry standards, compliance frameworks, and attack taxonomies—helping security and compliance teams prioritize remediation, accelerate audits, and understand threat context more effectively. With this enhancement, every reported issue is automatically mapped to the most relevant frameworks, offering deeper insight into both technical risk and regulatory impact.

This unified mapping ensures that teams not only see what’s wrong, but also understand why it matters, where it’s exploitable, and how it aligns with compliance mandates.

What’s Included:

• OWASP Top 10 – Categorizes issues by the most critical web application risks
• MITRE CWE Top 25 – Identifies issues by common software weaknesses
• NIST Frameworks – Maps to controls in NIST SP 800-53 and the NIST Cybersecurity Framework (CSF)
• HITRUST CSF – Aligns with security requirements for healthcare and regulated industries
• HIPAA Security Rule – Maps technical issues to required administrative and technical safeguards
• PCI DSS – Connects vulnerabilities to payment card industry security requirements
• CAPEC – Links each issue to known attacker behaviors, techniques, and exploitation patterns

Where to Find It:
Compliance and taxonomy mappings are displayed directly in the Issue Details view, and included in exports, reports, and integrations with tools like Jira and GitLab.

Who Can Use It:
Available to all users with access to issue and compliance data.

Description:
Aptori now supports integration with multiple Jira servers, enabling organizations to manage cross-team and multi-instance workflows more effectively. Users can configure several Jira server connections within the platform and map individual Aptori projects to their corresponding Jira projects, ensuring seamless issue tracking across diverse teams and environments.

This feature is particularly useful for large enterprises or teams operating in complex, multi-Jira environments, allowing centralized security findings to be synchronized with the appropriate issue tracking systems.

Where to Find It:

• Organization Owners can configure multiple Jira servers under Settings → Organization → Jira Servers
• Project mappings can be managed within each Aptori project by selecting the associated Jira server and target Jira project

Who Can Use It:

• Organization Owners can add and manage Jira server configurations
• Organization and Group Owners, as well as Group Maintainers, can manage Jira-to-Aptori project mappings

Description:
The new Policy Editor enables users to create, manage, and apply custom security policies using the Rego policy language. These policies extend the power of the Aptori Sift engine by allowing organizations to define rules tailored to their specific security, compliance, or coding standards. Once authored, the policies are stored in the Aptori platform and can be dynamically fetched and included in Sift configurations, ensuring that all relevant custom checks are executed during CI runs.

This feature empowers teams to enforce organization-specific rules, detect violations beyond built-in analyzers, and scale policy-driven security testing across the SDLC.

Where to Find It:
Accessible in the Aptori platform under Policies. Policies can be linked into Sift configurations via the policy_evaluator section.
Details and schema examples are available in the Policy Evaluator documentation.

Who Can Use It:
Users with permission to manage Sift configurations and platform policies.