Summer was about cutting noise. Q3 was about cutting the clicks it takes to get from “I need to test this” to “this is fixed.”

This quarter, we shipped 15 updates across the Astra platform. AI agents can now run your scans through Astra MCP. Scans launch from a single screen. Schedules apply to dozens of targets at once. And when a finding lands on your desk, it comes with the proof you need to act on it. Less setup. Fewer dead-end scans. Faster triage. Let’s walk you through what’s new.

1. Astra MCP: let your AI agents run security testing

Problem: Teams are moving routine work to AI agents, but security testing still needed someone to log in, click through the dashboard, and kick things off by hand.

Solution: Astra MCP connects your AI agents directly to the Astra platform. Agents can start and cancel scans, manage schedules, and generate and list reports. They can also guide you through login recording and HAR validation. Set it up from Settings in a few clicks, secured with OAuth.

Impact:

Trigger and manage scans from the AI tools your team already uses
Pull reports without opening the dashboard
Get guided help on the setup steps that usually slow teams down

2. A cleaner, faster dashboard

Problem: As more targets and scans piled up, finding what mattered on the dashboard took too long. And there was no easy way to tell how far along a pentest was.

Solution: We simplified the dashboard design and unified the filters across views. Pentests now show a progress timeline with an estimated time to completion. The dashboard also works better on mobile.

Impact:

One set of filters, everywhere
Clear visibility into where each pentest stands and when it will wrap up
Check on your security posture from your phone

3. Launch scans from one screen

Problem: Starting a scan meant moving through multiple steps. Teams working toward more than one compliance framework had to set up separate pentests for each.

Solution: The Start Scan flow now fits on a single screen. You can also apply multiple compliance objectives, such as SOC 2, ISO 27001, and PCI DSS, to a single pentest.

Impact:

Fewer steps between you and a running scan
One pentest that covers several frameworks at once
Less duplicate work during audit season

4. Improved Jira and Slack integrations

Problem: Connecting Jira and Slack across many targets was repetitive. Vulnerabilities that missed the first sync stayed out of your tickets, and expired tokens meant a support detour.

Solution: Setup is now easier across targets. A new sync option pushes previously unsynced vulnerabilities to Jira. Jira custom fields auto-fill, comment media syncs both ways, and you can replace tokens right from the dashboard.

Impact:

Every vulnerability makes it into your tracker
Screenshots and attachments stay in step between Astra and Jira
No more broken integrations because of an expired token

5. Schedule scans across targets at once

Problem: Setting up recurring scans one target at a time doesn’t scale when you manage dozens of assets.

Solution: Apply a single schedule to many targets in one go. The redesigned schedule editor includes a Monthly quick setup. You can also take action on multiple completed scans together.

Impact:

Set up continuous testing for your whole stack in minutes
Consistent scan cadence across targets
Bulk actions on completed scans instead of one-by-one clean-up

6. Set up API and mobile targets faster

Problem: API targets needed several separate steps before the first scan. And large mobile builds kept bumping into upload limits.

Solution: API target setup now happens in one step, covering authentication, scope, schedule, and definition files. Mobile targets now accept APK uploads up to 1 GB, up from the 300MB limit we introduced in summer.

Impact:

Go from new API to first scan without the back-and-forth
Test production-size mobile builds without trimming them down

7. Catch credential issues before testing starts

Problem: A scan that runs with broken credentials only tests the login page. Teams found out after the scan, and had to start over.

Solution: Astra now checks that your Postman collections and credentials can actually log in before testing begins, with results for each endpoint. This is available for API and web targets on selected plans.

Impact:

Spot authentication problems before they waste a scan
See exactly which endpoints passed or failed the login check
Better authenticated coverage, first time

8. Scan only the cloud that matters

Problem: Cloud environments are full of resources that don’t need testing. Scanning everything adds noise and time.

Solution: Use resource tags to choose which cloud resources get scanned and which ones to skip.

Impact:

Focus scans on production and in-scope assets
Leave sandbox and test resources out of your results

9. Triage faster with stronger proof

Problem: Developers push back on findings they can’t reproduce. Without evidence, triage turns into a debate.

Solution: Findings can now include validator screenshots or text proof. Eligible companies can download the HTTP messages behind a finding. Findings are also broken down per product, and failed scans can be deleted to keep your history clean.

Impact:

Hand developers the evidence along with the finding
Faster agreement on what’s real and what to fix first
A cleaner scan history

10. Cut noise without losing coverage

Problem: Excluding a noisy finding used to mean switching off the whole rule, which could hide real issues too.

Solution: You can now exclude findings by evidence type instead of by the entire rule. Exclusions can be paused and resumed whenever you need.

Impact:

Silence the false positive, keep the coverage
Revisit exclusions without recreating them

11. Other platform improvements

Not every update needs its own spotlight. These smaller ones still take friction out of your day:

More complete reports: Vulnerability summaries now list the affected components, and network reports list every in-scope device IP.
Target labels: Create and color-code labels, group them, assign them in bulk, and filter or select targets by label.
Activity Logs: See who changed what. Logs are searchable, filterable by action and entity type, and expand to show the exact fields that changed.
Smarter email alerts: Emails now include 7-day links to PDF reports, plus failure reasons with links to fix them.
Pre-scan connectivity check: Astra confirms a web target is reachable before the scan starts, so you don’t spend credits on a target the scanner can’t connect to.

Astra Security Blog

Message History

Delivery option(s)