{
  "summary": "Vendors are now their own entity: several systems from the same vendor share one vendor record with its jurisdiction, privacy policy, DPA, probes, contracts, contacts and questionnaires, and a system only overrides what differs. Triage gains two new discovery sources - allowed-connection logs from Palo Alto, Cisco ASA/FTD, Check Point, Zscaler, Cloudflare, Netskope and generic CEF/LEEF (over syslog or HTTPS push, managed in a new Log Sources tab), and the organisation's own DNS records (domain verification, SPF, MX, DKIM, DMARC, NS, CAA, SRV and CT-logged subdomains), which reveal vendors that never show up in proxy traffic. The Risk Register now raises contractual risks from vendors' terms, DPAs and uploaded contracts (lock-in, missing data export, liability cap, foreign governing law, short price-change notice, Art. 28 gaps), and flags DNS records and Content-Security-Policy sources still pointing at decommissioning or inactive systems, including script sources on unregistered domains. Vendor CSAF advisories are now scoped to the system's own products, matched through the vendor's SBOM or the product name, with an optional per-system product list; advisories about the vendor's other products no longer open risks. The system owner is notified when the vendor releases a fix for one of the system's vulnerabilities, and a new CSAF card on the system page counts the reported vulnerabilities per status. Saving a system no longer wipes fields the form doesn't send, such as SWG observations and approved data tags. An expired session now returns to the login page instead of a browser password dialog. Local AI mode now extracts contract and DPA data reliably on long runs. Allod VRM releases now publish CSAF security advisories."
}