We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Move Evidence

Previously, you could only move Notes from one Node to another. Now, we’ve extended this behavior to Evidence as well. Have an instance of Evidence that actually belongs to a different Node? Just open the instance of Evidence, click Move (it’s in the 3 dots icon in the top right of the screen) and move it to the correct Node. That’s it!

Download Report Templates

Do you need to make a report template update or send us a copy of the report template? What happens if you didn’t create the report template to begin with or the template is old enough that you don’t even know where your local copy could be hiding? Previously, SCP was your only option to download a copy of a report template on your instance. Now, just head to Templates > Reports in the header and click the download button next to any report template to get your own local copy.

IssueLibrary Templates + Comments

IssueLibrary entries are great! But, creating them from scratch can be a pain without a format to work with. Now, when you create your IssueLibrary entries, you can select a Note template. No more blank page paralysis or trying to remember whether that field is called “Recommendation” or “Recommendations”, you can select your Issue template and just populate it with the data that you need.

Then, once your IssueLibrary entries are created, you can use comments to have a conversation with the rest of your team. Ask questions, offer suggestions, or just leave celebratory emoji comments! 🎉

Release Notes

• Contributors:
  • Create a new Team (optionally) when creating a new Contributor
• Editor:
  • Insert an appropriate single or multiline tag for blockquotes and code blocks
  • Limit the content height for easier access to the Create/Update button
  • Quote text from comments and resource content (cards, evidence, issues, notes, etc)
• Evidence:
  • Create a new issue (optionally) when creating new evidence
  • Move evidence across nodes
• Liquid drops:
  • Add available_properties method to DocumentProperties drop
• Projects:
  • Sort templates by title in project form
• Project Validation:
  • Add missing attachments validation for Textile screenshots
• Report templates:
  • Add functionality to download templates
• Report Template Properties validation
  • Disable bulk validation in Issues and Evidence tables if the “Validation” column is hidden
  • Move bulk validation in Issues and Evidence tables to a background job
• Tables:
  • Add selector to change the number of records displayed
• Tylium:
  • Import CSS manifests from addons
  • Remove height restriction from code blocks
• Upgraded gems:
  • brakeman, nokogiri, puma, rails
• Bugs fixes:
  • Account Lockout:
    • Send password reset instructions on account lockout
  • Conflict resolver
    • Apply the correct warning when a conflict happens on edit
  • Custom Properties:
    • Remove Custom project properties header in team show
  • Document Properties
    • Allow document properties to have a value and be nested at the same time.
  • Methodologies:
    • Ensure boards don’t nest when the instance has been inactive
  • Nodes:
    • Remove extra HTML tag causing the methodology tab to break after a board is added
  • Tables
    • Prevent columns state from resetting
• Integration enhancements:
  • CVSS Calculator:
    • Settings: show/hide the calculator in the Issues view
    • Toggle between CVSSv3.0 and CVSSv3.1
  • Dread Calculator:
    • Settings: show/hide the calculator in the Issues view
  • Gateway
    • Deliverables:
      • Allow macro enabled word and excel filetypes
      • Allow the CSV filetype
    • Projects:
      • Add “Created” and “Updated” columns to the Gateway projects table
      • Show theme versions when selecting a project theme
    • Themes:
      • Atlantia:
        • Check for the existence of document properties before rendering the value
        • Remove newlines from issue titles
        • Show untagged issues
        • Wrap text in code blocks
    • Bug fixes:
      • Allow Authors to enable their own projects for Gateway
  • Issue Library:
    • Add comments to entries
    • Add subscriptions to entries
    • Create entry from note templates
    • Notify users of updates
  • Jira:
    • Bugs fixes:
      • Issue form: Prevent app from crashing when submitting without project or issue type
  • Nessus:
    • Add product_coverage & cvss3_impact_score as available Issue fields
  • Nexpose:
    • Update HTML tag cleanup to better cover UnorderedList and URLLink tags in the solution field
  • Qualys:
    • Add dd, dt support
    • Remove orphaned b tags
  • Remediation Tracker: Tickets: Create new categories and states (optionally) when creating new tickets
• Reporting enhancements:
  • Word:
    • Adds EvidenceCounter controls support to not nested in an Issue controls
    • Fixes exporting with missing attachments
    • Fixes invalid predicate error by escaping control characters in XML attributes
    • Fixes links inside inline controls
    • Fixes numeric values for non-range filters
    • Fixes “frozen string” error when exporting nodes without a services table
    • Move image captions to their own paragraph
• Security Fixes:
  • High: Authenticated author broken access control: read access to issue content

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Gateway Themes

One of the biggest changes in Dradis Pro v.4.0 is the move from a single HTML Gateway template to Liquid themes. Create a dynamic, info packed, theme to deliver assessment results dynamically in Gateway using Liquid. Multiple Gateway themes means each project can use a different theme that’s appropriate to the engagement. Two new Gateway themes are included with Dradis Pro v4.0 to get you started.

Liquid has a well supported and documented history for creating robust templates. This will make it easier for teams to create and support their own well organized, customized templates.

Are you currently using a customized Gateway HTML template? Reach out to our team with your existing template so we can help convert it to Liquid before you upgrade any production instances.

Downloadable Assets

In addition to reviewing the results of an assessment dynamically in Gateway, contributing users can securely download assets that have been added to their project. Deliver final reports, scope documents, and other assets directly from Gateway keeping everyone out of their inboxes and project details centralized.

Simple Team Setup

Getting started using Dradis Pro is simple. Once deployed to your environment, the super-admin for the instance is created during the first run and can quickly set up the rest of the team through this new guided walk-through.

Maximum Login Attempts

Configure the number of maximum login attempts to help prevent brute-force attacks on your Dradis instance. The default is set to 3 attempts before the account is locked. Admins can increase or decrease the number of attempts to align with their team’s policies.

Release Notes

• Projects:
  • Cleanup the New/Edit view
  • Create and remove the results portal from the Edit view
  • Dashboard: Add Default issue entry to menu when project is empty
  • If there is only one RTP, select it by default
• Setup: new initial Team and User wizard
• Teams: cleanup the New/Edit view
• Users: account gets locked after too many failed sign in attempts
• Upgraded gems: addressable, nokogiri, papertrail, puma
• Bugs fixed:
  • Better support for characters inside textile linked text
  • Display placeholder text for issue sorting dropdown when no field has been selected to remove confusion about default options that are not yet applied
  • Fix issue library entries action buttons not appearing due to caching
  • Fix revisions with “destroy” event not removed from the database after deleting a project
• Integration enhancements:
  • Acunetix:
    • Add support for Acunetix 360
    • Make Request and Response fields available at the Evidence level
  • Gateway 🍾
    • Moved project contributor assignment to Gateway management
    • Deliverable upload management
      • Your contributors can now download assets directly from your results portal!
    • Themes!
      • Gateway now supports theme management and the ability to apply different themes to different projects
  • IssueLib entries#index API now supports pagination
  • Nessus:
    • Add age_of_vuln, exploit_code_maturity, threat_intensity_last_28 threat_recency, and threat_sources_last_28 as available Issue fields
  • Nexpose:
    • Update HTML tag cleanup
  • Nipper:
    • Include multiple paragraphs when importing fields.
  • Remediation Tracker
    • Use Datatables for the Tickets#index table
• Reporting enhancements:
  • Word:
    • Add support for template syntax within resources exported in Word reports
    • Fix exporting node labels with links
• REST/JSON API enhancements:
  • Update the API to handle pagination
• Security Fixes:
  • Medium: Authenticated (contributor) information disclosure
    • After a contributor was assigned Gateway access to a project by an admin user they may retain access to the project after the projects team has been changed.

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

JIRA Sync

Details added to JIRA tickets will now sync back to Dradis Issues and Remediation Tracker tickets making it easier to keep all of the project details together to speed up remediation tasks.

Ruby 2.7.2 and Rails 6.1.1

Sometimes we have to roll up our sleeves and take care of the less flashy bits of development. In this version, it was due time to update Ruby, Rails, and a handful of other gems. There won’t be a noticeable difference on your side but this sets up the team to make future improvements.

Improved Caching

When the projects listing or Issue Library contained thousands of entries, it became slow to load and in some cases wouldn’t load at all. This update improves caching to make it much faster to load those long lists.

Release Notes

• Upgraded DradisPro to run on Ruby 2.7.2 and Rails 6.1.1
• Add view hooks for the export view
• Increase secondary sidebar width for medium viewports
• Projects page: Add caching to speed up slow loading when thousands of projects are present
• Upgraded gems: bundler, papertrail, rails
• Bugs fixed:
  • Correct position of sticky editor toolbar in fullscreen source view
• Integration enhancements:
  • Integrate JIRA ticket/status details into Remediation Tracker
  • IssueLib: Add caching to speed up the issuelib table when thousands of entries are present
  • Add remote JIRA Comments to Issues#show and Tickets#show
• Security Fixes:
  • Medium: Authenticated (admin) persistent cross-site scripting in Business Intelligence Custom Properties search

Not using Dradis Pro on your team?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

User on, User off

Users can be toggled between disabled and re-enabled. Disabled users cannot access the app, aren’t available to mention in comments, and will not receive notifications. Content from disabled users won’t be deleted and they will need to be re-enabled before modifying any permissions.

Word Report Export Tune-Up

Bunches of things happen under the hood in Dradis when you are kicked back waiting for the magic to happen to generate a Word report. Some of those inner workings got a tune-up to get Dradis in a better position for future improvements in this version. Imagine how excited we were when we saw some small performance gains as a byproduct of this refactor!

Fancy Output Logs

Export log files are not only fancier looking, but the updated formatting makes them much easier to review. Indents indicate nested items and coloured lines of text are a snap to scan to keep an eye out for any problems and when items finish successfully.

Change Project Owner

“Change is inevitable” and now, you can change project owners in Dradis. Project owners can be updated in both the web app on the “People on the Project” and through a new API endpoint.

Release Notes

• Disabled users enhancement
  • Allow admins to disable and re-enable users and contributors
  • Removed disabled users from comment mentions list
  • Stop disabled users from receiving notifications
• Main sidebar improvements:
  • Labels added under icons
  • Removed animations and transitions while expanding and collapsing
• Migrate bootstrap to v4
• Navbar dropdown menu’s are no longer locked to the right side of the browser
• New item menu in sidebar: isolate Default entry (from template) with a divider
• Update logo assets
• Project owners can now be updated
• Bugs fixed:
  • Christmas easter egg Santa hat blocking clicks on input element plugins
  • Rules Engine: make sure tag auto-complete works on page render
• New integrations:
  • dradis-nipper
• Integration enhancements:
  • Allow viewable image attachments for Gateway contributors
  • IssueLib: ability to seed with the starter set
• Reporting enhancements:
  • Performance:
    • Re-work Word export processing top to bottom
    • Faster hyperlink processing
    • Faster numbering processing
    • Faster screenshot processing
  • Remove unused nested content controls from all resource types (issues, content blocks, evidence etc.)
  • Introducing the new and improved servicesEntries and ServicesTable content controls with full support for filtering and sorting
    • When nested inside a Node control you can get direct access to Services attributes with a servicesEntries control, and child attribute controls eg. Protocol, State, Port, etc.
    • The existing services control that produces pre-formatted table-based data can now be labeled ServicesTable in your template
  • Enhance report export log in both the CLI, and Web Console
    • Indented log lines to enhance readability and make it simple to follow nested processing. ex. Evidence within a Node.
    • Colors! Make use of colours to show
      • Green: when processing is successful
      • Yellow: when filters filter out all resources
      • Red: when something bad happens like a control has no placeholder
• REST/JSON API enhancements:
  • Add new endpoint to update project owner

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

MS Word Filters – OR, NOT

Filtering content using OR and NOT hasn’t been possible until now! Now you can add OR and NOT operators to create a dizzying amount of control for your report output. As always, you can string together multiple filters to get the results you want to populate your report.

Imagine That!

We’ve added the ability to upload an image anywhere the editing toolbar appears. Dragging and dropping into the editing area works too, saving you a few steps to add images in your project to show evidence, support your statement, or even add a meme to your comment.

Even More Validation

Validating your project before generating it has long been available as a good step to preventing some of the most common report errors. Now, view additional validation in summary views and a panel to help avoid those errors as you are working with report content to catch problems early.

For an at-a-glance way to see what needs a bit more work, the issues and evidence tables include a column showing if that item contains the correct information.

Issues, evidence, and content blocks now have a validation panel that will highlight problems as you work.

Release Notes

• Add a validation panel for Issues, Evidence, and Content Blocks
• Add a validation column for Issues and Evidence table
• Auto upload attachments and screenshots without requiring the use of the staging area
• Cards, Evidence, Issues, and Notes now have their own attachment support
• Displays a notification badge in the browser tab when there are unread notifications
• Editor: Allow drag & drop, copy & paste, and direct image uploading
• Increase the node properties column size by changing it to LONGTEXT
• Layout: Breadcrumbs have a fixed position
• Upload Manager: better validation
• Bugs fixed:
  • Live filtering of templates (methodologies, notes & projects) via sidebar
  • Use absolute send times in notification emails instead of relative
• Reporting enhancements:
  • Excel: Fix report generation exceeding the maximum cell limit
  • Word: Add NOT and OR operation for filtering content control
  • Word: Allow non-English localization documents to be exported