INTRODUCTION
This update for Checkmarx SCA standalone customers appears minor in versioning. In enterprise environments, it affects two areas that drive business outcomes: structured risk governance and pipeline reliability.
The shift from simple ignore actions to structured risk management strengthens auditability and executive reporting. Resolver improvements increase automation stability across complex CI/CD estates.
SHIFT FROM IGNOREVULNERABILITY TO MANAGEMENT OF RISK API
WHAT CHANGED
The legacy IgnoreVulnerability and UnignoreVulnerability APIs are being deprecated. The new Management of Risk API allows teams to:
- Apply multiple vulnerability states such as Open, In Progress, Accepted Risk, Mitigated, False Positive
- Attach comments and business context to each state change
- Capture decision history programmatically
This transforms SCA triage into structured risk lifecycle management.
ENTERPRISE RISK AND GOVERNANCE IMPACT
CISOs and risk committees require evidence of active risk decisions. A binary ignore model does not reflect enterprise governance expectations.
With the Management of Risk API, organizations can:
- Standardize vulnerability states across SCA programs
- Enforce mandatory justification comments for Accepted Risk
- Link decisions to ticket IDs, change records, or risk owners
- Generate audit-ready logs for regulatory reviews
This supports enterprise risk frameworks and improves board-level reporting on open source exposure.
DEVSECOPS WORKFLOW INTEGRATION
Structured states enable stronger automation:
