Skip to content

Commit 9b64584

Browse files
lavakush07Harness
lavakush07
authored and
Harness
committed
feat: [SSCA-5696]: Update SCS Roadmap (#101151)
* d28d61 Final changes * 4fc056 Update SCS Roadmap
1 parent a9b6729 commit 9b64584

1 file changed

Lines changed: 91 additions & 76 deletions

File tree

‎src/components/Roadmap/data/sscaData.ts‎

Lines changed: 91 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ export const sscaModuleTheme = { ...DEFAULT_MODULE_THEME, moduleKey: "ssca", mod
66
export const SscaData: Horizon = {
77

88
"Now": {
9-
description: "Q4 2025, November 2025 - January 2026",
9+
description: "Q1 2026, February 2026 - April 2026",
1010
feature: [
1111
// {
1212
// tag: [{value: "Artifact Security"}],
@@ -20,62 +20,71 @@ export const SscaData: Horizon = {
2020
// },
2121
{
2222
tag: [{value: "Governance"}, {value : "Attestation"}],
23-
title: "Custom Attestation Framework",
24-
description: "Ingest your own custom attestations and leverage Harness’s querying and policy engine to enforce governance and compliance across all pipelines and artifacts.",
25-
},
26-
// {
27-
// tag: [{value : "Risk & Compliance"}, {value : "OWASP"}],
28-
// title: "OWASP OSS Top 10 Risks",
29-
// description: "Visibility into End of Life components using SBOMs.",
30-
// },
31-
{
32-
tag: [{value: "Artifact Security"}],
33-
title: "Keyless attestation/signing support",
34-
description: "Support SBOM and SLSA attestations, as well as artifact signing, using keyless workflows.",
23+
title: "Evidence Vault - Phase 1",
24+
description: "Native CI integration to automatically capture Source and Build attestations, link artifacts to source code, support custom attestations, and enable attestation downloads.",
3525
},
36-
{
26+
{
3727
tag: [{value: "Dependency Management"}],
3828
title: "Automate OSS Dependency Updates with Harness AI",
3929
description: "Leverage Harness AI to automatically generate PRs for updating outdated dependencies.",
4030
},
31+
{
32+
tag: [{value: "Integration"},{value: "Repo Security"}],
33+
title: "Support for Bitbucket",
34+
description: "Complete support for Bitbucket, allowing users to onboard repositories and perform SBOM generation, SAST, SCA and secret scans.",
35+
},
36+
4137
{
42-
tag: [{value: "SBOM"}],
43-
title: "SBOM Direct and Indirect Dependencies",
44-
description: "Gain full visibility into OSS usage in your code repos by analyzing both direct and transitive dependencies for comprehensive risk insights.",
38+
tag: [{value: "Artifact Security"}],
39+
title: "Keyless signing support using OIDC",
40+
description: "Support SBOM and SLSA attestations, as well as artifact signing, using keyless workflows powered by Harness OIDC.",
4541
},
42+
4643
{
4744
tag: [{value: "AI"}],
48-
title: "Agentic AI Workflows",
45+
title: "AppSec Agentic Workflows",
4946
description: "Deliver intelligent insights and automate key SCS actions to proactively secure your software supply chain with AI-driven agents.",
5047
},
48+
{
49+
tag: [{value: "Dependency Management"},{value: "Repo Security"}],
50+
title: "OSS Risks (Malicious Package Detection, TypoSquatting)",
51+
description: " Detect malicious open source packages, typosquatted dependencies, and other suspicious components across your repositories and artifacts.",
52+
},
53+
54+
{
55+
tag: [{value: "SLSA"}],
56+
title: "SLSA for non-containers",
57+
description: "Enable SLSA provenance generation and verification for non-container artifacts.",
58+
},
5159

5260

5361
],
5462
},
5563
"Next": {
56-
description: "Q1 2026, February 2026 - April 2026",
64+
description: "Q2 2026, May 2026 - July 2026",
5765
feature: [
58-
{
59-
tag: [{value: "Integration"}, {value : "Artifact Security"}],
60-
title: "Cosign AWS Support",
61-
description: "Leverage keys from AWS KMS to sign and verify artifacts.",
62-
},
63-
{
64-
tag: [{value: "Integration"},{value: "Repo Security"}],
65-
title: "Support for Gitlab & Bitbucket",
66-
description: "Complete support for GitLab and Bitbucket, allowing users to onboard repositories and perform configuration checks, SBOM generation, and security scans.",
66+
67+
{
68+
tag: [{value : "Risk & Compliance"}, {value : "AppSec"}],
69+
title: "Exemption Management",
70+
description: "Manage exemptions for OSS Dependencies across Artifacts & Repos with full auditability and lifecycle tracking.",
6771
},
6872
{
69-
tag: [{value: "Dependency Management"},{value: "Repo Security"}],
70-
title: "Typosquatting Detection",
71-
description: " Identify and flag dependency names that closely resemble popular packages to prevent accidental inclusion of typosquatted or impersonated components.",
73+
tag: [{value: "Governance"}, {value : "Attestation"}],
74+
title: "Evidence Vault - Phase 2",
75+
description: "Extend to CD events with deployment attestations and environment snapshots, plus attestation search and policy enforcement to streamline audit readiness and compliance reporting.",
7276
},
7377
{
74-
tag: [{value : "Governance"}, {value: "Audit Trail"}],
75-
title: "Artifact Chain of Custody v2",
76-
description: "Enhanced audit trail that seamlessly integrates all pipeline events at an account level, spanning from source code to deployment.",
78+
tag: [{value: "Integration"}, {value : "Artifact Security"}],
79+
title: "Cosign AWS Support",
80+
description: "Leverage keys from AWS KMS to sign and verify artifacts.",
7781
},
7882
// {
83+
// tag: [{value : "Governance"}, {value: "Audit Trail"}],
84+
// title: "Artifact Chain of Custody v2",
85+
// description: "Enhanced audit trail that seamlessly integrates all pipeline events at an account level, spanning from source code to deployment.",
86+
// },
87+
// {
7988
// tag: [{value: "Visibility"}],
8089
// title: "Global Level View",
8190
// description: "Gain complete visibility into all artifact and code repositories across projects, along with their associated findings, in a unified account-level view.",
@@ -86,62 +95,67 @@ export const SscaData: Horizon = {
8695
// description: "Improving search, filtering across product pages and overall user experience",
8796
// },
8897

89-
{
90-
tag: [{value : "Repo Security"}],
91-
title: "Repo Security Posture Management for Harness Code",
92-
description: "Identify misconfigurations in source code repositories based on industry standards such as CIS v1.0 and OWASP Top 10 CI/CD Risk. Also, includes support for SBOM generation and security tests such as SAST, SCA, and secrets scanning.",
93-
},
9498
{
9599
tag: [{value : "Risk & Compliance"}],
96100
title: "Global Artifact & Repository visibility",
97101
description: "Account-wide views of repositories and artifacts, enabling unified visibility and oversight across all resources.",
98102
},
99-
{
100-
tag: [{value: "Run time Security"}],
101-
title: "Run Time Security for CI/CD Pipelines",
102-
description: "Protect your Harness CI/CD pipelines from supply chain attacks by detecting anomalies and unauthorized activity through real-time system and network event monitoring.",
103+
{
104+
tag: [{value : "Risk & Compliance"}],
105+
title: "OSS Risk Scoring",
106+
description: "Introduce contextual risk scoring for open source dependencies based on risks such as EOL, malicious packages, and known vulnerabilities.",
103107
},
104108
{
105-
tag: [{value : "Governance"}, {value: "Risk & Compliance"}],
106-
title: "OSS Top 10 Policies",
107-
description: "Out of the box policies to identify risks in open source dependencies based on the OSS Top 10 risks, with the ability to block builds and deployments when critical vulnerabilities or license violations are detected.",
109+
tag: [{value : "AIBOM"}],
110+
title: "AIBOM",
111+
description: "Gain visibility into all AI models, datasets and prompts used across your systems, enabling governance, risk assessment, and secure AI adoption.",
108112
},
109113

110114
],
111115
},
112116
"Later": {
113-
description: "Q2 2026+, May 2026 & beyond",
117+
description: "Q3 2026+, August 2026 & beyond",
114118
feature: [
119+
// {
120+
// tag: [{value : "CI/CD Security"}],
121+
// title: "CI/CD Security for Jenkins",
122+
// description: "Perform static analysis to detect risks and misconfigurations in Jenkins pipelines.",
123+
// },
124+
// {
125+
// tag: [{value: "Repo Security"}],
126+
// title: "Malicious Package Detection",
127+
// description: " Detect malicious open-source packages using behavioral analysis and malware scanning to identify backdoors, droppers, and other harmful payloads before deployment.",
128+
// },
129+
// {
130+
// tag: [{value : "SBOM"}, {value : "SLSA"}, {value: "CI/CD Security"}],
131+
// title: "SBOM & SLSA Support for Jenkins",
132+
// description: "Generate SBOMs and achieve SLSA compliance using Jenkins pipelines.",
133+
// },
115134
{
116-
tag: [{value : "CI/CD Security"}],
117-
title: "CI/CD Security for Jenkins",
118-
description: "Perform static analysis to detect risks and misconfigurations in Jenkins pipelines.",
119-
},
120-
{
121-
tag: [{value : "AIBOM"}],
122-
title: "AIBOM",
123-
description: "Gain visibility into all AI models and datasets used across your systems, enabling governance, risk assessment, and secure AI adoption.",
135+
tag: [{value: "Run time Security"}],
136+
title: "Run Time Security for CI/CD Pipelines",
137+
description: "Protect your Harness CI/CD pipelines from supply chain attacks by detecting anomalies and unauthorized activity through real-time system and network event monitoring.",
124138
},
125-
{
126-
tag: [{value: "Repo Security"}],
127-
title: "Malicious Package Detection",
128-
description: " Detect malicious open-source packages using behavioral analysis and malware scanning to identify backdoors, droppers, and other harmful payloads before deployment.",
139+
{
140+
tag: [{value : "Repo Security"}],
141+
title: "Repo Security Posture Management for Harness Code",
142+
description: "Identify repository misconfigurations based on CIS v1.0 and OWASP Top 10 CI/CD Risks, with built-in SBOM generation, SAST, SCA, and secrets scanning.",
129143
},
130144
{
131-
tag: [{value : "SBOM"}, {value : "SLSA"}, {value: "CI/CD Security"}],
132-
title: "SBOM & SLSA Support for Jenkins",
133-
description: "Generate SBOMs and achieve SLSA compliance using Jenkins pipelines.",
145+
tag: [{value : "Governance"}, {value: "Risk & Compliance"}],
146+
title: "OSS Top 10 Policies",
147+
description: "Out of the box policies to identify risks in open source dependencies based on the OSS Top 10 risks, with the ability to block builds and deployments when critical vulnerabilities or license violations are detected.",
134148
},
135149
{
136150
tag: [{value : "Risk & Compliance"}],
137151
title: "NIST SP800-204D Support",
138152
description: "Out of the box rules for supporting NIST SP800-204D compliance standards.",
139153
},
140-
{
141-
tag: [{value: "Artifact Security"}, {value: "SBOM"}],
142-
title: "SBOM Scoring in Drift Detection",
143-
description: "View risk scores on dependencies that get added or removed between artifact drifts which contain vulnerabilities, have invalid licenses, or are unmaintained.",
144-
},
154+
// {
155+
// tag: [{value: "Artifact Security"}, {value: "SBOM"}],
156+
// title: "SBOM Scoring in Drift Detection",
157+
// description: "View risk scores on dependencies that get added or removed between artifact drifts which contain vulnerabilities, have invalid licenses, or are unmaintained.",
158+
// },
145159
{
146160
tag: [{value: "Integration"}, {value : "OpenSSF"}],
147161
title: "OpenSSF Integration",
@@ -157,11 +171,7 @@ export const SscaData: Horizon = {
157171
// title: "Remediation Tracker",
158172
// description: "Assign vulnerabilities & compliance issues to developers using remediation tracker to track across different types of targets (Artifacts, CI/CD, Repos).",
159173
// },
160-
{
161-
tag: [{value : "Risk & Compliance"}, {value : "AppSec"}],
162-
title: "Exemption Management",
163-
description: "Manage exemptions for risk and compliance issues across all targets (Artifacts, CI/CD, Repos).",
164-
},
174+
165175
{
166176
tag: [{value : "SLSA"}, {value: "Artifact Security"}],
167177
title: "SLSA Policies",
@@ -175,9 +185,9 @@ export const SscaData: Horizon = {
175185
description: "What has been released",
176186
feature: [
177187
{
178-
tag: [{value : "Risk & Compliance"}],
188+
tag: [{value : "Risk & Compliance"}, {value: "OWASP"}],
179189
title: "OWASP OSS Top 10 Risks",
180-
description: "Visibility into outdated and unmaintained components using SBOMs"
190+
description: "Visibility into outdated,unmaintained and End of Life components using SBOMs"
181191
},
182192
{
183193
tag: [{value : "Repo Security"}],
@@ -204,7 +214,7 @@ export const SscaData: Horizon = {
204214
title: "SBOM & SLSA support with GitHub Actions",
205215
description: "Generate SBOM and achieve SLSA compliance using GitHub Actions for artifacts built in GitHub.",
206216
},
207-
{
217+
{
208218
tag: [{value: "Artifact Security"}],
209219
title: "Artifact Signing and Verification (Containers & Non-Containers)",
210220
description: "Ensure built artifacts are not tampered before deployment.",
@@ -221,9 +231,14 @@ export const SscaData: Horizon = {
221231
// },
222232
{
223233
tag: [{value: "AI"}],
224-
title: "AI Chatbot(Beta)",
234+
title: "AI Chatbot",
225235
description: "AI-powered chatbot capabilities to assist users within the SCS module",
226236
},
237+
{
238+
tag: [{value: "SBOM"}],
239+
title: "SBOM Direct and Indirect Dependencies",
240+
description: "Gain full visibility into OSS usage in your code repos by analyzing both direct and transitive dependencies for comprehensive risk insights.",
241+
},
227242
],
228243
},
229244
};

0 commit comments

Comments
 (0)