Category Archives: Release

New in Dradis Pro v5.4

Dradis Pro v5.4 focuses faster editing and improved QA. Evidence now carries QA states so your team can track what has been reviewed; Roslin can draft report sections for Content Blocks straight from your project’s full content; and List fields render as selects, so the values you have defined for a field persist as dropdowns wherever it is edited.

Here’s what’s new!

QA for Evidence

Dradis Pro v5.4 adds QA states to Evidence, so your team can track review status before a report goes out the door. Mark each piece of Evidence as it moves through review, and keep draft material out of client-facing deliverables — Excel and Word exports now only include Evidence that has been published.

To try it, open a piece of Evidence and set its QA state from the Evidence view.

Echo for Content Blocks

Content Blocks now have their own Roslin agent tab, so you can draft report sections without leaving the block. Ask Roslin to draft a section — an executive summary, a methodology, a scope note — and it works from the full content of your project, Issues and Evidence included, not just what is already in the block. This makes it easier to keep recurring report sections current without writing them from scratch every time.

To try it, open a Content Block, head to the Roslin tab, and ask it to draft the section.

List Fields as Selects

List fields now render as selects when editing existing Issues, Evidence, and Content blocks. Instead of retyping a value or copying it from elsewhere, you pick from the same list of options every time – so the values you have defined for a field actually persist across the project instead of drifting between records.

To try it, open any existing Issue, Evidence, or Content block with a List field and edit it – the field now presents as a dropdown.


Release Notes

  • Echo: add a Roslin agent tab to Content blocks, to draft report sections from the full project content
  • Editor: render List fields as selects when editing existing Issues, Evidence, and Content blocks
  • Issues: warn user if another user is currently editing the record
  • QA: Add QA states to evidence
  • Webhooks: Add Evidence, Node and Note CRUD events
  • Upgraded gems:
    • mail, rubyzip
  • Bug fixes:
    • BI: send Results Portal contributors to their portal home instead of logging them out when they click the Dashboard breadcrumb
    • Word: fix screenshots exporting with border when the width is set to 0px
  • Integration enhancements:
    • DevOps:
      • Add support for numeric (integer and double) Work Item fields.
      • Add support for required fields
    • Jira:
      • Add support for float custom fields when sending issues to JIRA
      • Add support for multiselect custom fields when sending an issue to Jira
  • Reporting enhancements:
    • Exports: only include published evidence in Excel and Word reports

Not using Dradis Pro?

New in Dradis Pro v5.3

Dradis Pro v5.3 focuses on smoother workflows and better collaboration. Echo conversations are now shared and interactive; CSV and ServiceNow integrations gain reusable field mappings; and Gateway HTML and PDF exports are now available directly from your projects.

Here’s what’s new!

Echo Multiplayer Chat

Echo conversations are now shared, ongoing threads instead of one-off prompts.

In Dradis Pro v5.3, you can start a conversation with Roslin from a saved prompt on an Issue and continue from there with follow-up messages. Ask for a revision, add more context, clarify a point, or challenge part of the response without having to start again from scratch.

The conversation is also visible to everyone with access to the project. Replies appear live as they are generated, so teammates viewing the same Issue can follow the discussion in real time and add their own messages to the thread.

This makes it much easier to refine findings collaboratively, with the full conversation kept in one place instead of split across separate Echo sessions.

To try it, open an Issue, head to the Echo tab, choose a saved prompt, and start the conversation.

CSV Field Mappings

With Dradis Pro v5.3, recurring CSV imports no longer require you to map the same columns by hand every time.

CSV imports now integrate with the Mappings Manager, allowing you to define how each CSV column maps to your Issue and Evidence fields and reuse that configuration on future uploads.

When a project is associated with a Report Template, Dradis saves the mapping for that CSV structure. The next time you upload a file with the same column headers, the saved mapping is applied automatically.

This makes recurring imports much quicker to process, while also helping keep imported data consistent from one upload to the next.

ServiceNow Field Mappings

Dradis Pro v5.3 makes sending findings to ServiceNow much more streamlined.

Dradis Pro v5.3 adds ServiceNow to the Mappings Manager, so you can define how your Dradis fields map to ServiceNow fields instead of filling them in manually each time you create a Vulnerable Item.

Mappings are available across the Application, Container, and Vulnerability Response modules. Once configured, the mapped fields are populated automatically whenever a Vulnerable Item is created from Dradis.

You can also use Liquid in your mappings, giving you more control over the content sent to each ServiceNow field rather than simply copying a Dradis field as-is.

This makes repeated exports to ServiceNow faster and more consistent, especially when your team follows the same field structure across projects.

To set it up, head to “Mappings Manager” → “ServiceNow” → “New ServiceNow Mapping” and define how your Dradis content should map to ServiceNow.

Gateway PDF Exports

Gateway’s themed HTML reports are no longer limited to the Results Portal. With Dradis Pro v5.3, you can generate them directly from your project.

Head to the Export tab, select HTML / PDF, and choose the Gateway theme you want to use. Dradis generates the same themed HTML output available through Gateway, ready to view in your browser or print to PDF — alongside your existing Word, Excel, and CSV export options.

For PDF reports, we recommend the Athena theme. It was designed with printable reports in mind: the browser view resembles the finished report, while print-specific styles remove interactive elements such as the comment box when you save or print it as a PDF.

You no longer need to go to the Results Portal just to produce this output, making it useful when you want a polished PDF deliverable without sharing the project through Gateway with contributors.


Release Notes

  • Dashboard:
    • redesign author dashboard with contextual widget panels and What’s New feed
    • add CTA cards and onboarding view for authors without active projects
  • Issue Library:
    • point to the library in the Issue import empty state when it doesn’t have entries yet
  • Users:
    • allow Admins to request 1:1 training for new users
  • Cards:
    • add option to move a task to a different list
  • Upgraded gems:
    • rails, rails-html-sanitizer, websocket-driver
  • Bug fixes:
    • Echo:
      • Preserve line breaks in streamed Ollama responses for models that emit them as standalone tokens
      • Remove a stray leading blank line from streamed responses
      • Send only completed conversation turns to the AI provider, so a failed or in-progress reply can no longer break the next one
      • Show a generic message when a reply fails instead of surfacing the provider’s raw error
      • Return a graceful error instead of a server error when a chat session is started with a blank prompt
    • Kit import:
      • correctly associate the imported project with its Word report template when multiple export integrations are enabled
    • Navbar:
      • apply white-label styling to the theme toggle so it stays visible in white-labeled contributor portals
    • REST API:
      • Return a 404 instead of a server error for project-scoped endpoints requested without a valid project
  • Echo enhancements:
    • Add multiplayer chat sessions on Issues — start a conversation from a saved prompt, follow up with more messages, and watch Roslin’s reply stream live to everyone viewing
  • Integration enhancements:
    • Burp:
      • Add Type as an available Issue field
    • CSV:
      • Add support for the Mappings Manager
    • Gateway:
      • Use theme rendering for Project export to HTML/PDF
    • Projects:
      • Fix error handling of the package upload when an invalid template is found
    • ServiceNow:
      • Add support for the Mappings Manager
    • VSTS:
      • Add support for Work Item attachments
  • REST/JSON API enhancements:
    • Content Blocks:
      • Add Recent Activity entry for API edits
      • Set the author field to the authenticated user when creating notes and evidence

Not using Dradis Pro?

New in Dradis Pro v5.2

Dradis v5.2 touches a wide array of functionalities. List fields bring ordered value sets to Issue prioritization and sorting, the ServiceNow integration gets broader coverage across modules, and the CVSS Calculator gets a redesign built around the workflow of actually scoring a finding.

Here’s what’s new!

List Fields and Multi-Column Issue Sorting

Not every Issue field fits neatly into score-based sorting alone. Severity ratings, new vs existing vulnerabilities, remediation priority, OWASP category, and more are values worth sorting issues by that a CVSS score alone doesn’t capture.

The new List field type lets you define an ordered set of values for an Issue field, so “Critical > High > Medium > Low” (or whatever set makes sense for your methodology) is captured as a label to sort by. Once defined, List fields can work alongside numeric fields or even other List fields as sort criteria. You can now sort Issues by multiple fields at once, in a defined order, and get precise control over how findings are prioritized and ordered in your reports.

This is particularly useful when a single sort key isn’t enough: sort by OWASP category first, then by a custom List field for remediation urgency, then by CVSS score, and your report comes out exactly as your reviewers expect it.

You can even define colours for lists, so you can specify font colours or table cell background colours to match your list preferences.

ServiceNow Vulnerable Items

The ServiceNow integration has historically created Vulnerable Items in a single module. With v5.2, that coverage expands: Vulnerable Items are now created across the Application, Container, and Vulnerability Response modules.

If your ServiceNow environment spans more than one of these modules, you’ll now get broader coverage without any extra configuration on your end — the integration handles the routing automatically based on where the vulnerability applies.

CVSS Calculator Redesign

The CVSS Calculator has a new two-column layout with a sticky results panel, so your score stays visible as you work through the metrics instead of scrolling back and forth to check it.

Severity badges give instant visual context as you adjust metrics, and a one-click button copies the vector string straight to your clipboard — no more selecting and copying text by hand when you need to paste the vector elsewhere.


Release Notes

  • UI: add dark mode support to the login and setup wizard pages
  • Issue Library: default imported issue state to draft
  • Kits: new default Welcome kit option
  • Report templates: allow sorting issues by list fields in addition to numeric fields
  • Upgraded gems:
    • concurrent-ruby, crass, faraday, msgpack, net-imap, nokogiri, puma
  • Integration enhancements:
    • CVSS Calculator: redesign with two-column layout, sticky results panel, severity badges, and vector string copy
    • ServiceNow: create Vulnerable Items under Application, Container, and Vulnerability Response modules
  • Reporting enhancements:
    • Report Templates:
      • Add List field type for issue fields to define ordered value sets
  • Add support for multiple ordered sort fields for issues

Not using Dradis Pro?

New in Dradis Pro v5.1

v5.1 is a focused release. Echo gets its first Agent, more LLM providers, and inline grammar checking. Business Intelligence gains a date field type. Also included are a raft of bug fixes.

Here’s what’s new!

Writing quality checks with Roslin

Report writing is where the work lives. The content your clients receive reflects the care your team put in, and a single typo in a critical finding can undermine that impression before they’ve finished reading it.

Roslin is our first Echo Agent — a configurable assistant that extends Echo beyond prompts and into the editing experience itself. Connect it to a LanguageTool instance (self-hosted or local) and it checks grammar, spelling, and style inline as you work. Issues are highlighted directly in the findings editor, with suggestions shown in context and one-click replacements. Dismissed suggestions are remembered per-browser, so they won’t surface again on your next visit.

The grammar and spell check side of Roslin runs entirely on LanguageTool, which means your finding content never has to leave your network to use it. If you also configure an LLM provider on the agent, Roslin picks that up for AI-assisted writing too — the two capabilities are independent and can be enabled in any combination.

To get started, visit Tools → Echo → Agents and click Edit next to Roslin. The Roslin setup guide walks through the LanguageTool configuration.

Echo for more providers

Echo launched with Ollama — a great option for teams that want local, private LLM processing. With v5.1, you can now also connect to OpenAI, Anthropic, and Google Gemini as provider options.

Each provider is configured separately under Tools → Echo → Providers, giving you a named connection with its own API key, endpoint, and default model. You can have multiple providers configured at once and choose between them per agent or per use case. If you prefer to keep everything on-premises, Ollama remains fully supported.

For cloud providers, be aware that your finding content will be sent to the external service as part of each prompt. If data residency matters for your engagements, Ollama is still the right choice.

Full provider setup details are in the Echo Providers guide.

Date fields in Business Intelligence

Business Intelligence custom properties have supported text and numeric values since launch. v5.1 adds a dedicated date field type.

That means you can now store structured date values — engagement start dates, remediation deadlines, retest windows — as first-class BI properties rather than free-text workarounds. Date fields behave like other custom properties: they are available in your dashboards, filterable, and can be tracked across projects over time.

If you have existing date values stored as text fields, now is a good time to migrate them over to take advantage of proper date filtering.


Release Notes

  • DataTables:
    • Add sticky table toolbar that tracks below the navigation bar when scrolling
  • Mail:
    • Add support for SMTP configuration via environment variables for Docker deployments; smtp.yml remains supported for VM deployments during the deprecation transition
  • Business Intelligence:
    • Add date custom property type
  • Upgraded gems:
    • addressable, erb, faraday, net-imap, nokogiri, rack
  • Bug fixes:
    • Contributors:
      • Don’t show license expiry warning for contributor users in notifications view
    • Field validations:
      • Fix false ‘Field is empty’ errors by ensuring Liquid drops can access associations
    • Fields:
      • Show a visible border on dropdown fields in the editor
    • Issue Library:
      • Show dropdown fields when creating entries from a template
    • Projects:
      • Count all user nodes instead of only root nodes on the projects index
    • Liquid:
      • Stop stripping comparison operators from Liquid tags in issue and evidence fields
  • Echo enhancements:
    • Providers: add OpenAI, Anthropic, and Google Gemini as LLM provider options alongside Ollama
    • Add inline grammar checking via LanguageTool
  • Integration enhancements:
    • Audit: track when a report or kit is downloaded
    • Gateway: track when a deliverable is downloaded

Not using Dradis Pro?

New in Dradis Pro v5.0

This is an exciting release. We’ve kept working on the basics: making the reporting engine even more poweful (image and paragrapha alignment, border styling, image sizing), GitHub style in-line comments, dark mode,…

At the same time evolving the platform for what comes next: faster and easier deployments and upgrades, fine grained API access to unlock agentic workflows, built in context-layer so you can Bring Your Own LLM.

Have a look, let us know what you think and what you build on top of the platform.

Enjoy!

Docker deployment

Dradis is now available for Docker. No more dealing with hypervisors or downloading hefty VMs and upgrade files. All Dradis add-ons for your subscription level will also be pre-installed, so setup, configuration, data migration, and upgrades should be a breeze. Getting started with Docker couldn’t be simpler:

curl -fsSL https://get.dradis.com | /bin/bash

Dark mode

A much-requested feature is here at last. You can now enable dark mode across Dradis, or the auto mode that switches between light and dark mode based on your system preferences. Eye strain will be less of a factor after extended Dradis use!

Dradis Echo: Configurable user prompts

Dradis Echo, which lets you connect your Dradis instance to a local LLM, can now have custom prompts defined by you. Create prompts, define their scope, save, and use them wherever you want.

Business Intelligence for contributors

Read-only Contributor users in Dradis can now be given access to even more features and data within Dradis. The latest addition is access to Business Intelligence data for projects to which they have been assigned. For example, perhaps a project manager needs to see trends of recurring issues over multiple retests for a single client, but you have no other need to give that person a paid license seat. Simply add them as a contributor user, assign them permissions for the projects they need to look at, and they will be able to see all they need on the results portal.

Inline Comments in QA

For teams using the Quality Assurance feature in Dradis, some feedback we have heard frequently is that inline comments would be helpful to discuss specific items among the reviewer and tester(s). Now you can do so, with the QA inline comment feature. No more hunting through comment sections for relevant discussions – go line by line and open threads as necessary.

Personal Access Tokens

We reworked API keys so that you can now have scoped Personal Access Tokens (PATs). Instead of using keys that belong to one user but have that user’s access across the board, you can now have a scoped PAT with limited, granular, specific access. Create tokens at will for your API integrations, giving Create, Read, Update, and/or Delete permissions to each individual content type in Dradis. Set expiry dates and conditionals if you like, and create as many as you would need.

Release Notes

  • Activities:
    • Remove ActivityTracking for Issues and use EventPublisher
  • Background jobs:
    • Migrate recurring tasks to SolidQueue
  • Business Intelligence:
    • Allow author/contributor access to Business Intelligence
  • Docker:
    • Integrations: Include assets for all integrations regardless of enabled/disabled status
    • Update Dockerfile and add Docker Compose config file to enable Docker deployment
    • Update default attachments, templates and themes locations to storage/
  • Echo:
    • Add configurable, reusable prompts for Issues
  • Forms:
    • Improve visibility of form actions
  • Kits:
    • Include ‘sort_field’ in export to preserve issue sorting on re-upload
  • Layout:
    • Add light/dark/auto theme toggle to support dark mode
  • Nodes:
    • Add more types and icons
    • Rename upload and parent node types and add distinguishing icons
    • Update associated evidence, notes and child nodes’ updated_at columns on node merge
    • Warn on node merge that methodology will not be copied
  • Profile:
    • Update default user avatar
  • QA:
    • Add inline comment threads for Issues
  • Report Template Properties:
    • Validate sort field is numeric
  • Results Portal:
    • Manage project access and contributor assignments
  • Sidebar:
    • Add resize functionality
    • Keep sidebar open when editing issues in large viewports
    • Display validation when creating and editing issues
  • Textile:
    • Add support for paragraph alignment
    • Add support for image resizing, alignment, and borders
  • Usage tracking:
    • Send the on/off event always
  • Webhooks:
    • Add Issue CRUD webhook events
    • Add Project CRUD and state transition events
    • Add Results Portal Project CRUD webhook events
  • Wizard:
    • Mark as done after Kit step, without waiting for the background job
    • OWASP kit: add with 3 report template variations
    • Red Team kit: add with MITRE ATT&CK methodology and kill chain report
    • Welcome kit: update with OWASP Top 10:2025 methodology
  • Upgraded gems:
    • faraday, nokogiri, rack
  • Bug fixes:
    • Configuration:
      • Require integer settings to be positive numbers
    • Issues:
      • Render ‘Default’ option in New issue dropdown when issue fields are defined in the Report Template
    • Whitelabling:
      • Fix logo not appearing after uploading a new one in the admin settings
  • Integration enhancements:
    • Azure Authentication:
      • Add to integrations manager
    • Duo:
      • Disable engine by default
    • Gateway:
      • Add Athena and Orion themes
    • Okta:
      • Add to integrations manager
    • SAML:
      • Add to integrations manager
    • Scheduler:
      • Add light/dark/auto theme toggle to support dark mode
  • Reporting enhancements:
    • Word:
      • Remove support for the “Description” content control for Cards
      • Support textile alignment, image size, and image borders on export
  • REST/JSON API enhancements:
    • Personal access tokens:
      • Add multiple, per-user, scoped tokens for agentic workflows
    • Issues:
      • Add support for search
    • Issue Library Entries:
      • Add support for search
  • Security Fixes:
    • Low:
      • Authenticated (author) persistent cross-site scripting on smart combo component

Not using Dradis Pro?

New in Dradis Pro v4.19

Introducing Dradis Echo

Now AI integration is available (and entirely optional!) for Dradis. With Dradis Echo, you can deploy your preferred LLM in Ollama – a framework that lets you run LLMs locally, no external connections at all necessary – to work with Dradis. Use it to summarize raw scanner output, rewrite tester notes into executive language, enhance remediation advice, and more!

Webhooks for Dradis Gateway

You can now use Webhooks to carry out actions based on events in Gateway. Contributor requests, remediation progress, and project completions can trigger automated actions across your security stack. For example, kick off an onboarding flow when a client submits a project through Gateway, post Slack updates on new events in Gateway projects, or sync your ticket status across Jira, Azure DevOps, or ServiceNow.

While only Gateway webhooks are supported in Dradis v4.19, we plan to support other types of events in the future!

IssueLibrary improvements

We have also launched a series of improvements to the IssueLibrary. You can now upload CSV files to the IssueLibrary to bulk-import your own set of custom issues. You can bulk-delete issues in the IssueLibrary view. And finally, now when you go to add an IssueLibrary entry to a project, you can see each entry’s QA status, so you don’t import an unreviewed work-in-progress by accident!

Release Notes

  • Editor:
    • Add inline code and highlight code buttons to the toolbar
  • Layout:
    • Improve primary action visibility for Evidence, Issues, Methodologies, Notes, and Node Properties
  • Navigation:
    • Move Trash and Project Configurations in main navigation bar
  • Contributors:
    • Add a dashboard with Gateway, Remediation Tracker, and Notification widgets
  • Hera:
    • Improve primary action visibility and add view description
  • Projects:
    • Add user select-all functionality in project creation
  • Webhooks:
    • Add event-driven webhook implementation
  • Upgraded gems:
    • faraday, rack, rails, uri
  • Bugs fixes:
    • Editor:
      • Add disabled button styling
    • Datatables:
      • Ensure correct record ordering when applying sorting
    • Kits:
      • Restore the functionality of the ‘Add mappings from kit’ option
    • Notifications:
      • Remove the duplicate breadcrumb link shown in project notifications
    • Sidebar:
      • Prevent the toggle button from being covered by the scrollbar
  • New integrations:
    • Webhooks:
      • react to server-side events in your other systems
  • Integration enhancements:
    • Gateway:
      • Add activities tracking
      • Add event instrumentation for webhooks
  • Issue Library:
    • Add bulk delete action for entries
    • Import entries to the library using a CSV file
    • Import published entries to projects when using QA

Not using Dradis Pro?

New in Dradis Pro v4.18

Business Intelligence Dashboard updates

We get many feature requests about the Business Intelligence Dashboard, and now the first batch is ready! You can now see year-over-year trends of activities and custom properties, and lists of your most common issues across projects. Get a clearer look at changes over time at a glance.

The Mappings Manager lets you keep multiple different mappings for different templates across tools. Now we have also made it easier to copy existing template mappings to new or updated templates when you upload them. When you upload a new Kit, you can select the mappings to apply or copy:

Copy existing mappings to new templates

When you upload a new template (e.g., when you have updated a template and you want to move to the newer version), you can choose to copy existing mappings or to create new ones:

This will get you up and running with updated templates quickly and easily!

Release Notes

  • Activities:
    • Include methodology name in all methodology actions
  • Business Intelligence:
    • Add Custom Properties view
    • Add Dashboard view with Year-Over-Year insights
    • Add sub-navigation
  • Font:
    • Improve font weight consistency for international characters
  • Layout:
    • Add custom error pages
  • Issuelib:
    • Update entry edit UI to match issue edit UI
  • Mappings:
    • Add an option to copy existing mappings when uploading kits or report templates
  • Rails:
    • Upgrade Rails version to 8.0.2.1
  • Ruby:
    • Upgrade Ruby version to 3.4.4
  • Upgraded gems:
    • resque, rexml, selenium-webdriver, thor
  • Bug fixes:
    • Combobox:
      • Prevent forcing the selection of the first available option for multi-select forms
  • Integration enhancements:
    • Azure DevOps:
      • Replace OAuth with Microsoft Entra ID

Not using Dradis Pro?

New in Dradis Pro v4.17

White-labeling

Admin testers can now add a custom logo and brand color in the Instance Settings view. Contributors will see this logo and color in the Dradis UI, providing a white-labeled experience that reflects your brand identity.

Simply click on the cogwheel to the top right, click Instance Configuration, then White Labeling, and set your preferred logo and brand colour.

Now your Contributor Login page will be branded with your logo and colour scheme.

MITRE ATT&CK calculator

We have added a new MITRE ATT&CK calculator, based on the MITRE ATT&CK matrices for Enterprise, Mobile, and ICS (more details: https://attack.mitre.org/). You can now add MITRE ATT&CK metrics to Issues from the MITRE tab.

Once you select a Tactic, the calculator will load the associated list of Techniques, followed by Sub-Techniques based on your selection. You can include Enterprise, Mobile, and ICS data all within the same Issue.

Additionally, the calculator is available as a standalone tool from the Tools menu in the top navigation bar.

Kit downloads

Report templates can now be downloaded as a Kit, including report template properties and mappings. This makes it easier to share and reuse report templates while maintaining all of the associated context.

Release Notes

  • Activation:
    • Add offline activation option for when online activation fails
  • Active project cards:
    • Display the most recently updated Methodology
    • Render empty states instead of hiding content
  • Admin settings:
    • Add ability to white label contributor-facing views
    • Update UI to match other settings-related UIs
  • Analyzer:
    • Add support for multi-word fields
  • Calculators:
    • Add MITRE ATT&CK
  • Contributors:
    • Use Contributor login by default
  • Hera:
    • Update brand colors
    • Add sub-navigation icons to improve consistency
  • Jobs:
    • Add /jobs view to view and manage background jobs
  • Logs:
    • Update logs to use string UIDs
  • Mailer:
    • Fix email footer incorrectly redirecting to tester login
  • Profile:
    • Add click-to-reveal functionality for the API token
  • Report Templates:
    • Add option to download a kit for each report template
  • Upgraded gems:
    • nokogiri
  • Bugs fixes:
    • Avatars:
      • Fix avatars disappearing after enabling/disabling an integration
    • Calculators:
      • Render Calculator links in tools menu
    • Quote Selector:
      • Scroll to comment box in Safari after selecting quote content
  • Word:
    • Only process scoped issues in node content controls
    • Don’t create an analytics event when validating the project
  • Integration enhancements:
    • Gateway:
      • Add dynamic project title to Ares theme
    • Issue Library:
      • Update issues import to be more consistent with the table search
    • LDAP:
      • Enable installation and editable configuration through the Tool Manager
    • Nessus:
      • Ignore entries that have blank values
    • SAML:
      • Add name_identifier_format in the config generator and default to ’emailAddress’ instead of ‘unspecified’
  • Reporting enhancements:
    • Adjust the default styles for unordered bulleted lists
    • Excel:
      • Track failed job states using JobTracker
    • Filters:
      • Fix filters with double quotes (“) not catching the correct values
    • Word:
      • Track failed job states using JobTracker
  • REST/JSON API enhancements:
    • Export: Add endpoints for exporting and downloading Word/Excel reports
    • Upload: Add endpoint for uploading tool outputs

    Not using Dradis Pro?

    New in Dradis Pro v4.16

    New visual redesign

    Our designers have been working to completely overhaul the application interface to be more modern and integrated. Both the main interface and the individual projects view now use the same visual style, and you have access to all the application’s sections from the project view, so now you can go straight to your mappings or IssueLibrary from your project, rather than having to go through the Dashboard first.

    Gateway Services and Questionnaires

    As we continue to improve the features and possibilities of the Dradis Gateway, we have now created a new Services section of the portal. Here you can create questionnaires, which you can then send to Gateway Contributors. For example, you could use a questionnaire to establish the scope and goals of a penetration test before starting a Dradis project for them. On the basis of their responses, you can create a new project for their team right from the questionnaire results.

    MFA with one-time passcodes

    We have now created our own multi-factor authentication integration, Dradis OTP. You are no longer limited to using DuoWeb for free MFA in Dradis. With Dradis OTP, you can create and scan a QR code to use for MFA in whichever MFA app you prefer.

    Audit logging

    By popular request, we have created the Dradis Audit integration, which tracks activity in Dradis on a deeper level than the Recent Activity tabs and gathers it in one place. Your logs for the whole Dradis instance are now easily accessible for your security, compliance, and accountability needs.

    Release Notes

    • Contributors:
      • Add an intermediate login page to prevent Microsoft Safe Links from consuming the one-time token
      • Add Notification Settings link
    • Forms: Add a combobox for selecting, filtering, and creating options
    • Hera: Add new layout with redesigned navigation
    • Navigation: Replace Turbolinks with Hotwire
    • QA:
      • Add project states and QA stats in the active projects card
      • Add View History link when viewing Issues/Content blocks
      • Add a ‘Reviewer’ role for publishing Issues/Content blocks
      • Automatically go to the next record after reviewing
    • Revisions: Show state changes in the revisions view
    • Usage Tracking: Track the choice of toggling on/off
    • Upgraded gems:
      • capybara, mysql2, net-imap, nokogiri, paper_trail, rack, rails, rails-html-sanitizer, rexml, rspec-rails, selenium-webdriver
    • Bug fixes:
      • Report Templates: Make the uploaded template available in the “copy template properties” select menu for subsequent template uploads
    • New integrations:
      • Dradis Pro OTP: two-factor authentication using OTP
      • Dradis Pro Audit: enable tracking of key actions for improved visibility and compliance
    • Integration enhancements:
      • Azure DevOps: Add support for ‘Iteration Path’ and ‘Tags’ fields
      • Burp: Fix HTML importer associating issues in the wrong node
      • Dradis Plugins: Default to ‘Draft’ state on tool upload
      • Gateway:
        • Add overview of projects using active project cards
        • Services: Implement Services and Questionnaires to initiate a pre-project process
      • Issuelib: Update syntax of default entries
      • Netsparker: Add support for Additional Websites as nodes
      • Nexpose: Fix UnorderedList/OrderedList formatting to work with Textile
      • PDF Export: Add table of contents
    • Reporting enhancements:
      • Export: Default export button to ‘All’ if all records in project are in ‘draft’ state
      • Word: Fix links containing special characters by no longer double escaping
    • REST/JSON API enhancements:
      • Nodes: include Node properties

    Not using Dradis Pro?

    What We’re Watching at Black Hat Asia 2025 (And Where to Find Dradis)

    We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

    Catch us here:

    🧪 Dradis @ Black Hat Arsenal  
    Business Hall – Arsenal Station 3
    📅 April 3, 10:05am-11:20am

    Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

    📍 See our Arsenal session

    When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

    🔐 Briefings We’re Watching

    🚗 DriveThru Car Hacking: Fast Food, Faster Data Breach

    Speakers: Alina Tan, George Chen, et al
    Tracks: Privacy, Network Security
    A real-world case study of how a popular drive-thru system was compromised—leading to credential theft, data exfiltration, and a full system takeover. (Search the schedule page for the talk title)

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#drivethru-car-hacking-fast-food-faster-data-breach-43514

    🧠 Tinker Tailor LLM Spy: Investigate & Respond to Attacks on GenAI Chatbots

    Speaker: Allyn Stott
    Tracks: AI, Threat Hunting
    Learn how to detect and respond to attacks on GenAI chatbots, including jailbreaks, prompt leaks, and advanced threat scenarios targeting language model behaviors.

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#tinker-tailor-llm-spy-investigate–respond-to-attacks-on-genai-chatbots-44556

    ☁️ The Illusion of Isolation: How Isolation Failures in CI/CD Servers Lead to RCE

    Speakers: Tian Zhou, Yiwen Wang
    Tracks: Enterprise Security, Application Security
    Demonstrates real-world RCE attacks exploiting shared resources in CI/CD environments. Focuses on sandbox bypasses, namespace collisions, and cross-tenant abuse.

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#the-illusion-of-isolation-how-isolation-failures-in-cicd-servers-lead-to-rce-and-privacy-risks-43618

    🚀 Unveiling the Mysteries of Qualcomm’s QDSP6 JTAG: A Journey into Advanced Theoretical Reverse Engineering

    Speaker: Alisa Esage
    Track: Reverse Engineering
    An advanced reverse engineering walkthrough using QDSP6 JTAG on Qualcomm SoCs. Details undocumented memory regions, interface access, and mobile firmware analysis.

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#unveiling-the-mysteries-of-qualcomms-qdsp-jtag-a-journey-into-advanced-theoretical-reverse-engineering-44550

    📱 Watch Your Phone: USB-Based File Access Attacks Against Mobile Devices

    Speakers: Florian Draschbacher, Lukas Maar
    Tracks: Mobile, Exploit Dev
    A look at how attackers can access sensitive data on Android phones simply by connecting over USB—even when locked. Includes analysis of newly discovered file access vectors.

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#watch-your-phone-novel-usb-based-file-access-attacks-against-mobile-devices-43262

    🔥 One Bug to Rule Them All: Preauth RCE on Windows Server 2025

    Speakers: Zhiniang Peng, Lewis Lee
    Tracks: Exploit Dev, Platform Security
    Explores a novel pre-auth remote code execution vulnerability affecting Windows Server 2025, with a reliable exploitation chain and working proof of concept.

    Link: https://www.blackhat.com/asia-25/briefings/schedule/#one-bug-to-rule-them-all-stably-exploiting-a-preauth-rce-vulnerability-on-windows-server–44144


    🎓 Trainings Worth Highlighting

    🧬 A Complete Practical Approach to Malware Analysis and Threat Hunting Using Memory Forensics (Online)

    Trainers: Monnappa K A & Sajan Shetty
    Great for anyone bridging DFIR and reverse engineering in incident response.

    Link: https://www.blackhat.com/asia-25/training/schedule/index.html#a-complete-practical-approach-to-malware-analysis-and-threat-hunting-using-memory-forensics—-edition-online–42806

    🔐 Advanced Infrastructure Hacking

    Trainer: NotSoSecure / Tiago Carvalho
    Packed with practical labs for seasoned pentesters focusing on modern networks.

    Link: https://www.blackhat.com/asia-25/training/schedule/index.html#advanced-infrastructure-hacking–42864

    🤖 AI Red Teaming in Practice

    Trainers: Gary Lopez, Dr. Amanda Minnich (Microsoft AI Red Team)
    Learn how real AI systems get attacked—and how Microsoft red teams fight back.

    Link: https://www.blackhat.com/asia-25/training/schedule/index.html#ai-red-teaming-in-practice–43046


    🧑‍💼 From the Executive Summit

    🧠 Accelerating ML SecOps: Breaking Barriers, Fueling Innovation

    Speaker: Andrew Chen
    The opening keynote for the AI Summit—and a great signal on where the field is heading.

    Link: https://www.blackhat.com/asia-25/summit-sessions/schedule/index.html#opening-keynote–accelerating-ml-secops-breaking-barriers-fueling-innovation-44566

    💸 The War Against State Actors: Bleeding Edge Techniques Targeting Financial Services

    Speaker: Vivek Ramachandran
    If you’re defending high-value financial infrastructure, don’t miss this.

    Link: https://www.blackhat.com/asia-25/summit-sessions/schedule/index.html#the-war-against-state-actors-bleeding-edge-techniques-targeting-financial-services-44898

    🤖 LLM Firewalls: Are They the Future of AI Security?

    Speakers: Matthias Chin, Xiaojun Jia
    Fireside chat on securing AI models with perimeter-style defenses—what works, what’s hype?

    Link: https://www.blackhat.com/asia-25/summit-sessions/schedule/index.html#fireside-chat–llm-firewalls-are-they-the-future-of-ai-security-44576

    👋 Come say ‘Hi’

    If your team is tired of copying and pasting findings, fighting with Word templates, or working in silos—come see how Dradis makes reporting and collaboration painless.

    📍 Dradis @ Arsenal
    📅 Thursday, April 3 | 10:05am-11:20am
    🔗 Event link