Skip to main content

Changelog

Notable platform updates, new features, and improvements to ConcertoGRC.

July 2026​

AI Document Extraction​

  • AI document extraction output is now normalized before validation, guarding against null and edge-case responses from the model

Evidence Uploads​

  • Evidence-request file uploads now enforce a single target per upload for consistency

Trust Center​

  • Automated deploy workflow added for the Trust Center public site

Report Templates​

  • Report template creation form now resets properly on cancel

June 2026​

Platform Visual Refresh​

  • Coral (#FF4561) promoted as the primary brand accent color across the platform
  • New Hanken Grotesk heading font, updated shadow and radius scale, and refreshed button styling
  • Sidebar navigation overhauled with updated layout and visual hierarchy
  • Status badges in tables default to text-only styling; stat cards use bolder tint variants
  • 170+ hardcoded color values replaced with CSS variables for consistent theming

Incident Response -- Full Redesign​

  • Free phase movement: incidents can transition between any status without artificial workflow gates
  • New Dispatch Board landing page with stat cards, urgency sort, and preset filter views (My Incidents, Critical/High, Open)
  • Breach determination record with audit trail and AI-suggested notification recipients
  • IR Team Roster section for managing response team composition
  • Custom fields and documentation mode on the incident detail page
  • Slack and employee portal incident intake now route through the shared create service, activating call trees, playbooks, and embedding indexing consistently

Policy Lifecycle Overhaul​

  • Policies now auto-publish on approval (the only publish path); manual publish removed
  • Version-aware acknowledgments track which policy version each user acknowledged
  • Review-anchored date advance prevents overdue status on policies with a future review date
  • Trust center, knowledge base, and acknowledgment sends are gated on the published version
  • Review date drift indicator surfaces policies approaching their next review

Identity & Access -- Sync Coherence​

  • Personnel status changes now enforce a state machine (prevents invalid transitions)
  • IdP-vs-local policy enforced on field writes: identity-provider-managed fields cannot be overridden manually when sync is active
  • Group membership provenance tracking and prune audit trail on sync
  • Drift detector surfaces sync discrepancies with directional context (IdP vs. platform)
  • Access lifecycle event history: events emitted at all grant and review-decision sites with full audit trail
  • Revocation bridge status tracking with waive and retry endpoints

Vulnerability Scanning -- Lifecycle Hardening​

  • Scan launches are now admitted as a single atomic decision: quota, concurrency, and execution records are serialized per organization so simultaneous launches can no longer exceed configured limits
  • Quota and concurrency are now counted in engine-executions: a Full Assessment launch (6 engines) requires 6 free monthly scan units and 6 free concurrency slots up front, or the launch is rejected with a clear reason
  • The default concurrent-scan limit increased from 2 to 6 so a full-assessment preset fits in a single launch
  • Stuck-state recovery: automatic reaping for scans stuck in PENDING, failed-push, or max-duration states
  • Report accuracy improved: severity, engine, and target filters applied; resolved and accepted findings excluded from reports

External Assessments -- Finding Store​

  • Assessment reports are now built from finding records rather than synthesized from clause conformity attributes
  • Finding lifecycle includes finding numbers, non-conformity status tracking, and severity classification
  • Admin and auditor write paths unified onto a single finding model
  • N/A clauses excluded from coverage and conformity denominators

Autosave -- Write-Path Hardening​

  • Cross-record bleed fixed: pending autosaves no longer leak when the open record changes mid-flight
  • On save failure the edited value is preserved and marked dirty instead of silently reverting
  • Exit and tab-close flushes use a cached token with keepalive to ensure the final save survives navigation

Trust Center -- Security Hardening​

  • Single resolver path for all public-surface reads (direct, admin, portal) backed by snapshot, preventing content drift
  • Subscriber double opt-in with re-confirm flow and per-subscriber delivery ledger with at-most-once guarantee
  • Preview tokens are now stateless HMAC-signed (survive multi-instance restarts)
  • Anonymous vulnerability disclosure submissions no longer persist IP addresses
  • Access revocation endpoint with token re-checks on each privileged read

Training & Phishing -- Reliability​

  • Durable per-recipient outbox drainer with leased send and global SES rate limiter
  • Content and answer-key snapshot frozen at first open so mid-campaign edits cannot change a started learner's score
  • Quiz retake cap frozen into the snapshot and enforced by atomic reservation
  • Offboarding reconciliation waives open training assignments for terminated personnel
  • Magic-link re-issuance endpoint for expired training links
  • Campaign lifecycle integrity: final-poll-then-delete, per-campaign halt isolation, event-time timestamps

Vendor Management -- Lifecycle Coherence​

  • Server-side risk tier recompute on review completion (ignores client-supplied scores)
  • Next review date set automatically on all vendor creation paths
  • Attestation window scoped to the current review period
  • Lapsed-attestation state on vendor detail with review wizard warning

RBAC -- Per-Organization Role Model​

  • Per-organization role model is now live: membership in an organization equals access to that organization
  • Org-scoped roles issued via memberships endpoint
  • Membership-issuance helper covers all creation paths (invitation, import, sync, manual, etc.)
  • JWT attribute validation added with support for role attribute changes

Integration Evidence Pipeline​

  • Identity provider 2FA evidence uses a tri-state model (PASS / ERROR / UNKNOWN) rather than failing open when status is indeterminate
  • Auto-collected evidence files receive the evidence-request link on create and de-duplicate on re-collect
  • Unified sync executor drives both scheduled and manual syncs; manual sync returns 202 with poll-by-ID status
  • Multi-account AWS evidence filenames qualified by account ID to prevent overwrites

Compliance Core​

  • Occurrence lifecycle: currentUntil computation fixed; evidence-task completion now triggers control-status recalculation
  • Terminal statuses (SKIPPED/MISSED) blocked from generic update to prevent accidental state changes
  • Dashboard denominator rule: NOT_APPLICABLE and COMPENSATING controls excluded from all rate surfaces
  • Task deduplication via database-level partial unique indexes

Dashboards & KPIs​

  • Vulnerability dashboard rewritten with live SLA derivation and severity consolidation
  • Module dashboards (compliance meetings, KPIs, training, scanning, operator scoreboard) updated to shared denominator rules
  • Per-product scope calculation added for multi-product organizations

Employee Portal​

  • Internal fields (internal notes, assigned-to, reviewed-by) excluded from portal-facing API responses
  • Vendor request rejection-then-reset loop: re-notifies approvers and clears previous decisions
  • Expired-link re-acknowledgment flow for policy acknowledgments via portal sessions

Multi-Product Enrollment​

  • Enrollment dialog now offers org-wide vs. product-scoped selection when products exist
  • Backfill-scope endpoint for adding a newly created product to existing scoped controls

Artifact Integrity​

  • Report generation wrapped in compensating transactions: S3 upload failure rolls back report and version rows
  • CSV exports now strip formula-injection characters
  • Report preview HTML sanitized against stored XSS
  • Frontend download awaits job completion before showing success

Report & Digest Pipeline​

  • Period derivation rewritten as deterministic, timezone-aware with quarterly schedule re-anchor
  • Shared send pipeline: delivery status tracking, failed-email retry, inline HTML persistence
  • Evidence auto-filing: evidence records created when reports generate

Mutation Persistence​

  • Snapshot-based rollback for optimistic mutations (status, reorder, date) across multiple hooks
  • Field-level error surfacing: errored custom fields show a red ring indicator across all detail panels
  • Framework link/unlink dialogs stay open on failure instead of silently closing

Test-Once Shared Controls​

  • Cross-framework test-once clusters now appear in a top-level "Shared Objectives" section in external assessments

May 2026​

AI Model Cards & Governance Documentation​

  • Published AI Model Cards with detailed guardrails, human oversight controls, and data handling documentation for all 36 AI features
  • Expanded AI Features documentation with complete feature catalog across Orchestrator, Auto-Suggest, Analysis, and Generation categories

Platform Security Documentation​

  • Published Platform Security overview, Privacy Policy, Terms of Use, Acceptable Use Policy, Service Level Commitments, and Shared Responsibility Model
  • All policies available at Platform Security

Documentation Site Launch​

  • Launched public documentation site at docs.concertogrc.com
  • 46 pages covering all platform modules with screenshots and workflow guides
  • Full-text search, dark mode support, and mobile-responsive layout

Platform-Wide UI Refresh​

  • Redesigned shared layout with a new slate theme, updated typography, and consistent navigation across all modules
  • Dashboard redesigned with compact tile layout, posture trendline, multi-color sparklines, and full-width charts

Onboarding Redesign​

  • Completely rebuilt onboarding experience with a guided setup wizard, Getting Started dashboard, and orientation flow
  • New completion page with animated progress sequence

Single Sign-On -- Per-Tenant Microsoft SSO​

  • Email-first login flow that detects tenant SSO configuration and routes to the correct identity provider
  • Per-tenant Microsoft Entra ID (OIDC) registration so each organization connects its own directory
  • Redesigned SSO and MFA settings page with clearer provider status and configuration
  • Tenant-level MFA enforcement with a guided enrollment modal for users who have not yet configured MFA

Vendor Management​

  • Threaded comments on vendor requests and lifecycle tickets for in-context discussion
  • Per-stage approval notes with auto-posted decision comments so reviewers see the full trail
  • File attachments on vendor requests
  • Requester response workflow so vendors and requesters can reply within the approval flow
  • IRC filter dropdown and tier-change visibility on vendor assessments

Vulnerability Scanning -- HostedScan Integration​

  • Migrated scanning infrastructure to HostedScan with 9 scan engines (Nuclei, OWASP ZAP, Nmap, SSLyze, OpenVAS, and more) available through 4 presets: Web App, Network, SSL/TLS, and Full Assessment
  • New Reports tab with on-demand .docx report generation and download history

Training Module Improvements​

  • Bulk operations for campaigns and assignments (start, pause, complete, delete in batch)
  • Improved slide list with type-color coding, content previews, and drag-and-drop reordering

Tabletop Exercises -- Presenter Redesign​

  • Cinematic presenter view with a redesigned facilitator experience
  • Observer-appropriate messaging and read-only view for non-participant admins
  • Exercise start is now gated to facilitators with a visible readiness indicator

Infrastructure and Cloud Diagrams​

  • New diagram creation dialog with three workflow paths
  • Workspace gallery with product grouping
  • Promote security findings directly to remediation actions or risk register entries
  • Per-integration workspace auto-creation

Status Reports​

  • Configurable report sections with per-section options and program health override
  • Multi-section HTML email renderer with in-app preview before sending
  • DOCX section selection pre-populated from tenant report configuration

Task Management​

  • Tasks can now be deleted from the dashboard
  • Completion guards ensure tasks tied to access reviews, policy acknowledgments, and vendor reviews follow their parent workflow

Projects and Initiatives​

  • Redesigned initiative cards, sidecar detail panel, and task list layout
  • Progress bars and assignee avatars in table views

Questionnaires​

  • Owner field on Knowledge Base entries to identify subject-matter contacts

Framework Management​

  • Framework unenroll with a preview of affected controls and automatic evidence cleanup

Customer Management​

  • SLA report pagination for large report sets
  • Notifications inbox for SLA and engagement alerts
  • Bulk contract uploads with file streaming and title sanitization

April 2026​

Employee Portal -- Incident Reporting​

  • Added 5-step incident report wizard to the Employee Portal
  • Employees can report security incidents with severity, category, and description
  • Reports are routed to the tenant's incident response workflow

Vulnerability Scanning -- OWASP ZAP Integration​

  • Added OWASP ZAP as a second scan engine alongside Nuclei
  • ZAP provides DAST scanning for application-level vulnerabilities (SQLi, XSS, CSRF)
  • Findings are triaged or promoted to Vulnerability records with source tracking

Endpoint Management -- Jamf Pro Integration​

  • Added Jamf Pro as a third MDM provider alongside SimpleMDM and Microsoft Intune
  • Syncs Apple device inventory with encryption, firewall, and passcode compliance tracking

March 2026​

Cost Management Dashboard​

  • Per-tenant resource consumption tracking across AI/Bedrock, S3, SES, API requests, and integrations
  • Usage alerts with configurable thresholds and CSV export

February 2026​

Identity Provider Integration -- Google Workspace​

  • Added Google Workspace directory sync via Admin SDK
  • Domain-wide delegation setup with per-field sync policy
  • MFA detection, auto-escalation, and 5 evidence reports

Phishing Simulation Module​

  • Campaign management with template editor, recipient selection, and scheduling
  • GoPhish integration for SMTP delivery and click/submit tracking
  • Auto-remediation creates training campaigns for clickers

Security Awareness Training​

  • AI-generated training modules with slides, quizzes, and scenarios
  • Campaign management with auto-enrollment, reminders, and completion tracking
  • Phishing simulation integration for targeted remediation training

January 2026​

Migration Wizard​

  • One-time data migration tool for onboarding from Airtable, Vanta, Drata, Secureframe, Sprinto, or CSV
  • Session-based workflow: authenticate, fetch, preview with field mapping, execute, review results
  • AI-powered column-to-field mapping suggestions

Identity Provider Integration -- Microsoft 365​

  • Microsoft Entra ID directory sync with one-click admin consent
  • Auto-populates AccessPersonnel and AccessGroup records
  • Per-field sync policy (IdP-managed vs. local), email-based dedup, MFA detection

Tabletop Exercise Module​

  • Scenario-based tabletop exercises with multi-phase inject delivery
  • Facilitator and participant views with real-time progression
  • AI-generated scenarios from topic prompts

December 2025​

Business Impact Assessment Module​

  • BIA records with criticality scoring and dependency mapping
  • AI-powered environment import generates BIA records from text descriptions
  • Vendor and risk cross-linking

Customer Commitments Tracking​

  • AI-powered commitment extraction from customer contracts
  • Source-clause traceability with verbatim quote references
  • Obligation tracking with status and owner assignment

Inbound Questionnaire Management​

  • Receive, assign, and respond to customer security questionnaires
  • Knowledge base with AI-assisted response suggestions
  • Multi-reviewer workflow with status tracking

November 2025​

Risk Register Enhancements​

  • AI-powered risk register generation from environment descriptions
  • Inherent and residual scoring with 5x5 heat map visualization
  • Framework control mapping for risk-to-control traceability

Vendor Management -- AI-Assisted Due Diligence​

  • AI-powered vendor risk assessments from questionnaire responses
  • Legal review of vendor privacy policies, terms, and DPAs
  • Vendor URL auto-discovery for trust center and privacy policy links

Recurring Activities Overhaul​

  • Occurrence-based workflow with cadence-driven task generation
  • Evidence request linking for recurring evidence collection
  • Overdue detection with task synchronization

For questions about specific releases, contact support@concertocompliance.com.