Not a vendor committee. Not a private equity playbook.
DefectDojo came out of the OWASP community and never left it.
The people who build it are the people who run it in production. Every parser, every integration, contributed and maintained in the open.
A Slack where people actually answer.
The maintainers are in there. So are the people running Dojo across 10,000 organizations. Ask a real question, get a real answer.
Shipped in the Open
Every version ships its release notes in public, and the announcements that matter land right beside them. Expand a row for the detail.
AnnouncementSep 29, 2026
Fight AI with AI: DefectDojo Pro Is Now $100 a Month Plus 15 Cents per Finding
DefectDojo Pro moves to pay-as-you-go pricing: $100 a month, 15 cents per processed finding, and no seat counts, quotes, or sales calls.
Fight AI with AI: DefectDojo Pro Is Now $100 a Month Plus 15 Cents per Finding
- Full Pro feature set included, nothing held back for a higher tier
- Findings below your minimum severity are never counted
- Monthly spend limit set at sign-up and enforced by your instance
- Sensei billed only when used: $15 per fix PR, $30 per threat model
- Annual pre-pay saves 48% or more and bundles Sensei usage
ReleaseSep 28, 2026
DefectDojo 3.3.300
A feature-heavy release: the Pro UI in 27 languages, the 2026 rebrand with a color customizer, and Report Builder exports to CSV, Excel, and JSON.
DefectDojo 3.3.300
- Pro UI now available in 27 languages
- New brand colors plus an Appearance page with theme presets
- Report Builder exports to CSV, Excel, and JSON, with scheduled generation
- Code to Cloud Locations link container images to their repositories
- Exploit Maturity and Reachability are now manually editable
ReleaseSep 22, 2026
DefectDojo 3.3.100
A compliance-heavy release: PCI DSS, FDA, and EU regulatory packs, Sensei DAST scanning and AI Agent Red Teaming, and a new Command Center home page.
DefectDojo 3.3.100
- Compliance packs for PCI DSS, FDA cyber devices, and EU regulations
- Sensei Dynamic Scanning (DAST) launches Nuclei scans against verified targets
- AI Agent Red Teaming joins Sensei
- Command Center dashboard is now every user's home page
- Rules Engine 2.0 renamed Triage Engine
ReleaseSep 9, 2026
DefectDojo 3.3.0
A major platform release: cross-domain root-cause correlation, native PSIRT 2.0, a rebuilt asset model, and the classic UI retired in favor of the Pro Vue UI.
DefectDojo 3.3.0
- Cross-domain correlation groups findings into shared root causes
- PSIRT 2.0 folded natively into DefectDojo Pro
- Rebuilt asset model with versions, aliases, and typed relationships
- API v3 (alpha) debuts at /api/v3-alpha/
- Classic Bootstrap UI retired; Pro Vue UI is now standard
BlogSep 7, 2026
Getting Started with DefectDojo in 10 Minutes or Less
A hands-on tutorial that takes you from an empty instance to prioritized, assigned findings in ten minutes, minute by minute.
Getting Started with DefectDojo in 10 Minutes or Less
- Model your program with Organizations, Assets, Engagements, and Tests
- Import results from any of 500+ supported security tools
- Auto-enriched Priority, Severity, and Risk show what to fix first
- Push findings to Jira or GitHub Issues with auto-close
- SLAs, notifications, and reporting round out the first ten minutes
AnnouncementAug 27, 2026
DefectDojo Sensei Now Fixes Your Cloud Too: CSPM for AWS, Azure, and GCP
Sensei CSPM onboards AWS, Azure, and GCP accounts, scans them for misconfigurations, and fixes them by IaC pull request or a reversible Fix in Cloud.
DefectDojo Sensei Now Fixes Your Cloud Too: CSPM for AWS, Azure, and GCP
- Bulk-onboard cloud accounts with one read-only credential
- Posture findings land deduplicated and prioritized like any scan
- Fix in Cloud applies live changes through the provider API
- Every direct fix is human-approved, logged, and revertible
- Launch catalog covers public buckets, open security groups, and more
Learn Dojo from the people who built it.
Recorded webinars, 101-level training and working sessions. Start with Community Edition and scale when you need to.
Beyond the Hype: Using DefectDojo's MCP for 10X AI LLM Performance for Vulnerability Management
August Office Hours: Staying Compliant with the Cyber Resilience Act
My Anthropic Bill Made Me Do It
Why a security company hardened Kimi's coding CLI, and why we're giving the fork away.
Frequently asked questions
Is DefectDojo Community Edition really free?
Yes. Community Edition is free forever under an OSI license, with 500+ parsers, deduplication, and the full source. You host it yourself.
Where does the community live?
DefectDojo came out of the OWASP community. Day to day, the community lives in the DefectDojo Slack and on GitHub, where the roadmap, issues, and releases are public.
How do I contribute?
Open an issue or a pull request on GitHub. Parser contributions are the most common starting point: if your scanner is not supported yet, the parser framework is built for exactly that.
What is the difference between Community Edition and Pro?
Community Edition covers aggregation, deduplication, and the core workflow. DefectDojo Pro adds Priority and Risk auto-triage, Sensei AI scan and fix, MCP support, and dedicated support.