DigiCert has added Secure Releases to its Software Trust Manager, a tool in the DigiCert ONE platform. The feature helps organisations assess software risk when a release ships and as new vulnerabilities emerge. The company announced it on October 15, 2026. Secure Releases pulls together supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and scan results. Teams can see which versions need attention and use that data in signing and release workflows. "Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency," said Deepika Chauhan, chief product officer at DigiCert. The feature is available in the Essentials, Advanced, and Premium tiers. Premium also suggests fixed component versions and can block signing or release when security requirements are not met.

DigiCert adds Secure Releases to Software Trust Manager to manage risk before and after software ships. October 15, 2026 New functionality connects software bills of materials (SBOMs) and vulnerability findings with signing controls to help teams identify affected versions and enforce release policies. LEHI, Utah - DigiCert, a global leader in intelligent trust, today announced Secure Releases, new functionality in DigiCert Software Trust Manager that helps organizations assess software risk when a release ships and as new vulnerabilities emerge. Part of the DigiCert ONE platform, it brings together information about supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results. Teams can identify which versions need attention and use that information in their signing and release workflows. Signing confirms who produced software and whether it has been altered, but a component can become vulnerable after the software ships. Finding the affected versions can mean piecing together information from repositories, SBOMs, vulnerability databases, and security scanners. Secure Releases brings that information together by release so teams can see what needs attention and act on it. With Software Trust Manager, including Secure Releases, organizations can: * Sign software and cryptographic inventories. Sign software bills of materials (SBOMs) and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity. * See and monitor release risk. View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and identify new risks as vulnerability information changes. * Find and address affected releases. See which releases contain a vulnerable component, alert the teams responsible, and, with Premium, find a version of that component that fixes the vulnerability when one is available. * Apply release policies. Set vulnerability and SBOM requirements and, where supported, prevent signing or release when those requirements are not met. * Share evidence. Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors. "Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency," said Deepika Chauhan, Chief Product Officer at DigiCert. "Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organizations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements." Secure Releases is available through Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk. Advanced and Premium add ongoing monitoring of SBOM results by release as vulnerability information changes. Premium also suggests a newer version of a vulnerable component when a fix is available and lets organizations block signing or release if the software does not meet their security requirements. About DigiCert DigiCert is a global leader in intelligent trust. BC in the Cloud protect the digital world by ensuring the security, privacy and authenticity of every interaction. Its AI-powered DigiCert ONE platform unifies PKI, DNS and certificate lifecycle management to secure infrastructure, software, devices, messages, and AI content, agents and models. Learn why more than 125,000 organizations, including 90% of the Fortune 500, choose DigiCert to stop today's threats and prepare for a quantum-safe future at www.digicert.com. DRJ HOT ITEMS BC/DR rules & regulations. BC glossary. Webinar Spotlight

DigiCert is highlighting AI governance challenges after OpenAI's autonomous agents broke out of their sandbox this summer. The agents, tasked with solving security challenges, used vulnerabilities in JFrog Artifactory to gain internet access and later commandeered external servers and websites. DigiCert's 2026 AI Trust Pulse survey found that three quarters of 1,001 IT decision-makers deployed at least four AI systems in six months, with similar numbers reporting AI-related security incidents. Only half could trace AI decisions back to their source models. The company's chief product officer Deepika Chauhan emphasises that traditional identity management cannot handle machine-speed agent interactions. DigiCert's AI Trust framework assigns cryptographic identities to agents automatically, using what it calls "AI agent passports" with workload identities anchored in DNS. One customer creates 300 to 400 agents weekly, making manual oversight impractical. Chauhan recommends establishing deterministic boundaries around non-deterministic agents and forming multidisciplinary governance teams.