Release Highlights

Platform

Cortex Cloud 1.2 introduces automation enhancements to strengthen responses.

Feature	Description
Expanded response actions	Use built-in commands, scripts, and playbooks across AWS, Azure, and GCP to accelerate issue resolution—from war room investigations to automated response for common risks like exposed S3 Buckets.

Cloud Posture Security

Cortex Cloud 1.2 introduces an all-new cloud attack surface management (ASM) add-on module and several enhancements to secure data, AI, and cloud configurations.

Feature	Description
Introducing Cloud Attack Surface Management (ASM)	The new Cloud ASM capabilities scan the internet to discover unmanaged assets, running external services, and external web applications across AWS, Azure, and GCP environments. With over 800 built-in rules, it detects exposed vulnerabilities, misconfigurations and other risk signals that increase your external attack surface.
OCI support	Gain visibility, compliance, and governance over assets and configurations in Oracle Cloud Infrastructure (OCI) environments.
Expanded network visibility and detection	View network configurations and security rules for AWS, Azure, and GCP instances. Detect outbound and east-west exposure for AWS EC2s, with built-in remediation guidance.
Trusted IP support	Define trusted public networks to suppress unnecessary internet exposure alerts for assets only reachable from approved sources.
Enhanced custom rule support	Create custom detections across identity, data, AI rules.
Amazon SageMaker support	Strengthen AI security with full asset inventory, risk insights, and supply chain protection—plus governance and compliance mapping for scalable development.
Identify inactive AI models	Detect stale AI models to reduce risk, cut cloud costs, and focus security efforts on what’s active.
Microsoft 365 support	Gain visibility into sensitive data in SharePoint and OneDrive, detect misconfigurations, and reduce the risk of data leaks.
MIP label integration	Use existing Microsoft Information Protection labels to prioritize remediation and streamline compliance with context-aware data classification.

Application Security

Cortex Cloud 1.2 introduces several enhancements across SAST, SCA, and CI/CD use cases.

Feature	Description
Generic SARIF Ingestion for SAST	Cortex Cloud now supports ingesting SAST findings from any third-party source that outputs in SARIF to centralize your AppSec visibility.
Software Composition Analysis (SCA) GA	SCA is now generally available, providing vulnerability detection, license compliance, SBOM generation and package operational risk for open source packages.
Software supply chain security	Gain full visibility across the developer ecosystem from VCS to CI/CD pipelines, highlighting different risks that may pose supply chain risk. This capability highlights security issues on VCS organization, CI instances, pipelines and users (Git users that can also be contributors).
Cortex Cloud IDE plugin	Identify and resolve IaC, SCA, secrets, and license issues early in the SDLC through seamless, comprehensive in-code scanning directly in the IDE. Cortex Cloud now integrates directly into VSCode and JetBrains.
AppSec CLI	Now available as part of Cortex CLI, AppSec CLI can be used for local scanning and as a step in the CI.
On-prem VCS connectivity support	The Cortex Cloud Broker now supports the Application Security Transporter as an applet, enabling the establishment of secure communication channels between the Cortex tenant and customer-managed VCS instances hosted on-premises.