Mayo ASPM: development update · 2026-10-12

Mayo ASPM is being built to bring security scan results, prioritization, and policy workflows into one place. Recent work has advanced how teams can bring in scans, connect repositories and CI pipelines, and move from findings toward accountable action.

Bring scans into a shared workflow

The developing workflow supports importing reports in native scanner formats, alongside scans initiated through CI pipelines. Teams can also configure scheduled scans using UTC times. For organizations connecting their own infrastructure, a customer VM connector and private pull-request scan workflow are part of the product’s evolving scanning capabilities.

Repository onboarding is being shaped around a trusted inventory and clear ownership rules, so teams can understand what is being scanned and who is accountable for it.

Keep policies and follow-up scoped

Policy testing and ticket previews are designed to use inputs belonging to the relevant organization. The goal is to let teams evaluate policy decisions and review potential follow-up without mixing work across tenants. Jira setup is also being developed as part of that workflow.

Mayo is still in active development, and its public site is not live yet. This work is laying the groundwork for a connected application security workflow—from bringing scan results together to applying accountable rules and preparing follow-up.