Audit Trail records now capture every SAST triage change with before-and-after values, actor, timestamp, bulk-action indicator, and triage method—giving release owners defensible evidence for risk acceptance and remediation decisions.
Audit evidence moves closer to the engineering workflow
Checkmarx One 3.62 closes an important governance gap in manual and bulk SAST triage. Severity, state, and note changes are available through the Audit Trail API, including whether similarity-based or attack-vector-based triage was used.
For regulated teams, this supports a clearer chain of custody for findings that are downgraded, marked not exploitable, or otherwise dispositioned. It also makes post-incident review less dependent on screenshots, exported spreadsheets, or individual recollection.
Audit coverage now also includes Analytics and Reporting activity. Actions initiated by users, APIs, integrations, and automation are logged through the centralized audit framework with a standardized schema.
Operationally, security leaders should consider:
- Mapping audit events to internal control statements.
- Defining review requirements for bulk triage actions.
- Retaining API-derived evidence alongside release approvals.
- Testing whether SIEM and GRC integrations capture the new events.
One risk view across security engines
Risk Orchestration consolidates scan results from Checkmarx security engines into a single, severity-organized table. Teams can investigate findings, review affected files and lines, and act without repeatedly switching scanner views.
The value differs by role:
- Developers can focus on the affected code and available fix guidance.
- AppSec managers can monitor trends, triage activity, and scan initiators across projects.
- Security executives gain a centralized view for prioritizing exposure, including internet-facing assets.
This is a workflow change, not merely a dashboard addition. Enterprises should decide which queues remain scanner-specific, who owns cross-engine prioritization, and how Risk Orchestration metrics will be reconciled with existing KPI reporting.
AI-assisted triage requires operating controls
AI Triage & Remediation is now generally available, with a free trial available through Checkmarx sales. AI Triage assesses reachability and exploitability to separate theoretical findings from concrete risk. AI Remediation generates suggested fixes, creating pull requests automatically for eligible GitHub Code Repository Integration projects or providing in-product guidance for other project types.
Supported activation paths include:
- Manual initiation from Risk Orchestration.
- Automated AI Triage after scans, based on account or project criteria.
- GitHub pull-request workflows for automatic triage and requested remediation.
There are material boundaries to plan around. The capability supports SAST and SCA, but launch from Risk Orchestration is currently SAST-only. Automated pull-request creation is limited to GitHub Code Repository Integration projects. AI Remediation cannot be started through automatic configuration.
Both capabilities consume Checkmarx Credits. The new Credit Consumption Overview provides remaining balance, rolling 30-day use, top consumers, action-level distribution, and projected depletion. This gives platform owners the data needed to set budgets and avoid unplanned interruption of approved workflows.
AI supply-chain security reaches pipelines and governance records
AI Supply Chain Security gains practical delivery controls in 3.62. Teams can define global and project-level include and exclude rules to limit scans to relevant paths; excludes take precedence, and revised rules apply to later scans.
The scanner is now available as a standalone CLI scan type and is supported by the June Azure DevOps and GitHub Actions plugins. This allows AI component discovery to be included in established pipeline patterns rather than maintained as a separate process.
The release also adds:
- AI-BOM export from scan results or API in CycloneDX format.
- LLM risk assessment with consistent UI, API, and CLI results.
- Modeling of LLMs, SDKs, APIs, frameworks, agents, and MCP components in the AI-BOM.
These capabilities support an inventory discipline for AI dependencies. Security and architecture teams should define who reviews AI-BOMs, where exports are stored, and how identified components feed third-party risk, architecture review, and compliance processes.
More precise SCA controls and dependency intelligence
Policy Management can now combine Net New with SCA-specific rules. A release gate can therefore target a meaningful condition: a pull request introduces a new vulnerability in a production dependency.
Net New applies only to Code Repository Integration projects and refers to vulnerabilities introduced into the protected branch by the pull request. It does not mean every finding first observed in a scan. That distinction matters when designing fair gates that control new exposure without blocking delivery on accumulated technical debt.
Other SCA updates include:
- Improved npm v7+ peer-dependency resolution for more complete dependency trees.
- A package risk intelligence API for batch vulnerability and malware queries, up to 100 packages per request.
- A package upgrade recommendation endpoint for integration with SBOM and inventory tooling.
- A corrected Legal Risks widget that removes non-risk "Unknown" categories.
- Removal of an empty Containers tab when no container findings exist.
CLI 2.3.54 also supports --sbom-first with SCA Resolver to generate a CycloneDX 1.6 JSON SBOM immediately after dependency resolution. Combined with --no-scan, teams can generate an SBOM without submitting a Checkmarx scan. This can help separate inventory generation from scan scheduling where governance or cost models require it.
Administration, confidentiality, and delivery reliability
Checkmarx One 3.62 adds a non-dismissible tenant-level Confidential header banner with custom text. Exported PDF reports now carry the same confidentiality label on every page. This is useful where application-security data must be visibly classified both inside the platform and after distribution.
IAM user management receives better sorting, filtering, column control, group visibility, and CSV export. Administrators can filter by status, authentication provider, role, and group, then export the view they are actively reviewing. This makes periodic access review less manual.
The release also introduces an API to disconnect a project from its code repository integration and return it to a manual project. Teams can use this to manage repository lifecycle changes without a repository-to-repository migration.
Resolved issues address report generation, scheduled report delivery, analytics performance and filtering, repository scan consistency, container and SCA finding accuracy, scan lifecycle behavior, and IAM reliability. Release owners should still validate critical controls in their own tenant, especially where integrations, custom policies, or large result sets are involved.
Recommended adoption priorities
- Enable and test Audit Trail API collection for SAST triage and reporting events.
- Pilot Risk Orchestration with a defined cross-engine ownership model.
- Set AI credit budgets and project eligibility before enabling automated AI Triage.
- Add AI Supply Chain Security to selected CI workflows and establish scope rules.
- Update SCA pull-request policies to target net-new production dependency risk.
- Review confidential labeling and report-distribution controls with compliance stakeholders.
How Merito helps
Merito helps enterprises put Checkmarx One 3.62 capabilities into governed delivery workflows. We assess current policies and integrations, design audit evidence and AI-usage controls, tune SCA and AI supply-chain gates, and define operational reporting that engineering and leadership can act on.
The objective is measurable: reduce avoidable triage effort while preserving traceability, accountable approvals, and release decisions that stand up to audit.
Merito is an authorized Checkmarx reseller and services partner. Our Checkmarx One team can scope licensing, sizing, and rollout for 3.62, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.