Changelog

Verify AI is now front and center!

🧠 Verify AI findings now appear on the Compliance Dashboard, with a new Verify AI Status tab in Monitoring to track flagged evidence and trends over time.

🤝 Trust Chain now keeps everyone in the loop. Vendors get a welcome when their account is created and a heads-up when a customer assigns them evidence. Evidence owners are notified of new assignments, completed assessments get a confirmation, and a digest of overdue items helps nothing slip through.

🗒️ Questionnaire answers now show where AI-generated responses came from, and exports can include the source documents.

📦 SBOM creation is smoother. Repositories are listed alphabetically, project names fill in from the repo you choose, and duplicate project names are a thing of the past.

🔎 Evidence is easier to work with. Atlas (beta) lets you choose which connection to use when you have more than one for a service, Markdown files preview as formatted documents, and large spreadsheets open without the wait. Collection issues also surface as visible alerts so they get caught early.

🧰 We also added resiliency across audit exports, file uploads, and navigation.

Stay on top of evidence collection with these updates to the evidence repository, Trust Chain vendor alerts, attachment metadata, and more:

📅 Evidence now keeps a fixed collection date for audit integrity while the effective date stays editable. New filters also let you sort the Evidence Repository by Verify AI status and narrow the Control Library to criteria currently in scope.

✅ You can now require a manager to sign off on evidence attachments before an item counts as complete, a clear human checkpoint that works with or without Verify AI.

🤝 Trust Chain keeps vendors on track with a refreshed invite email, due date and expiration reminders, and alerts when a Verify AI review is ready.

🤖 Atlas (beta) got a round of polish and short feature videos to help your team get up to speed. Security Assistant changes and self-assessment score resets now show up in the Activity Log, and bulk owner changes send notifications just like single updates.

🔐 Admins can now set a session inactivity timeout for their organization.

🛠️ We also improved reliability across evidence collection, notifications, self-assessment scoring, and custom framework imports.

Major overhaul of SBOM Manager, Trust Chain digest emails, AI Risk Management, and more. Here's an overview of what we updated in GRC v2.115.0:

🤝 Trust Chain does more of the chasing for you. Send vendor invitations with a welcome message in your own words, group large evidence requests into named lists, and let automated login reminders and weekly digests keep things moving without you logging in to check.

🌐 Our external vulnerability scanner now maps a vendor's full public footprint, discovering subdomains automatically instead of checking the apex domain alone.

📋 NIST AI RMF is live. If you're building or buying AI, the framework is available now with criteria mapped to controls and ready for evidence collection.

🔌 Slack evidence collection goes deeper, collecting user group membership as evidence for access reviews. Note: we now support GitHub App auth for GitHub integrations too.

🤖 Atlas keeps getting sharper. Action items now show the full context behind a referenced resource, a collection script that fails can be regenerated without restarting the workflow, and 33 new AWS scripts joined the shared registry for everyone.

📎 The Public Evidence API now accepts direct file uploads, so external systems can push evidence straight into Strike Graph.