❓ Frequently Asked Questions

Answers to common questions about DefectDojo Open-Source and DefectDojo Pro. Where the two editions answer a question differently, both answers are shown side by side.

Choosing an edition#

What’s the difference between Open-Source and Pro?#

Both editions share the same data model and the same parsers. Open-Source is free and self-hosted. Pro adds connectors, prioritization, a Triage Engine for automation, saved and scheduled reporting, AI features, compliance evidence, enterprise sign-on and commercial support. The Feature comparison covers every difference and why it matters.

Can I move from Open-Source to Pro and keep my data?#

Yes. You export your Open-Source database and uploaded files, and they are restored into Pro, which then upgrades the schema to its own version. Any 2.x release, and 3.0.200 or later, can be migrated.

Can Pro be self-hosted, or run without internet access?#

Yes to both. Pro runs on DefectDojo Cloud, or on your own infrastructure with Docker Compose or Kubernetes. An air-gapped instance makes no outbound connections; threat-intelligence data is loaded from a file instead.

Which Pro features need an add-on license?#

Sensei (AI code and cloud scanning with fixes, Threat Modeling, Sensei Advisor and the Triage Engine’s AI steps) and the PSIRT Advisory Engine. Entries for an unlicensed feature show a LOCKED badge in the sidebar. Everything else on the Feature comparison is part of Pro.

Why don’t I see a feature described in the docs?#

In Pro, check these in order:

1. Feature Flags. Many capabilities are switched on by an administrator under Feature Flags.
2. License. Sensei and PSIRT need an add-on license.
3. Permissions. The sidebar only shows the pages your role can open.
4. Deployment. A few settings exist only on self-hosted instances (for example Version Manager, and AI Model Settings unless your Cloud instance brings its own model) or only on DefectDojo Cloud (for example Firewall Rules).

In Open-Source, check that the page describes Open-Source: the edition switch at the top of the navigation shows the pages for the edition you choose.

Modelling your environment#

How should I map my organization to Organizations and Assets?#

Start from who fixes things and who reads the reports. Most structures follow one of three patterns, or a mix: one Organization per team, one per technology domain (applications, cloud, containers, networks), or one per business unit or product line. Access is granted per Organization and Asset, so a structure that matches ownership also makes permissions simple.

Plan your hierarchy walks through each pattern with examples, and the common use cases show how different teams have set it up.

What should one Asset represent?#

Whatever is fixed and released as a unit: usually an application, a service or a repository. Match it to how your scanners group results (projects, repositories, cloud accounts), so each scan lands on one Asset and reimports keep its history in one place. A hundred small Assets are easier to report on and assign than one Asset holding everything.

Can Assets have parents and children?#

Can one Asset belong to more than one Organization?#

Can DefectDojo build my hierarchy from a CMDB, Backstage, my code hosts or my cloud accounts?#

Can an AI assistant help me set up or reorganize my hierarchy?#

In Pro, yes, in two ways:

• Before you build anything, Plan your hierarchy has a copyable prompt for any LLM. It interviews you about your teams, systems, tools and reporting needs, then drafts a tree with its reasoning. It does not connect to DefectDojo.
• On a live instance, the MCP server’s Asset Hierarchy toolset lets your assistant explore the hierarchy, find orphaned Assets, duplicate names and empty Organizations, create Organizations and Assets, and move Assets under new parents. For example: “Run the hierarchy cleanup review and show me the orphaned Assets.”

The assistant works with your own permissions, and its changes apply immediately. Moving an Asset can change who can see it, so ask the assistant to tell you who gains or loses visibility before it makes a change.

How do I restructure many Assets at once without breaking anything?#

You can reorganize later explains what moves with an Asset and what stays put.

A connector created Assets in a default Organization. How do I sort them out?#

In Pro, open the Needs Attention list under Assets. It shows every Asset still sitting in a connector’s default Organization or missing the business data that drives priority, and lets you fix them in bulk. See Finish onboarding.

Should every scan get its own Engagement?#

Usually not. For automated scanning, use one long-running CI/CD Engagement per pipeline (or per branch) and reimport each new scan into the same Test, so DefectDojo can close findings that disappear and reopen ones that return. Use separate Engagements for distinct, time-boxed activities such as a penetration test or an audit. See Import from API for pipeline patterns.

Should I use Endpoints or Locations?#

What business information should I record on an Asset?#

Business criticality, whether it is internet-accessible, its production status, revenue and the number of user records it holds.

Getting findings in#

What tools are supported?#

What is the difference between Import and Reimport?#

• Import records a report as a single point-in-time event. Each import creates a new Test containing the resulting Findings.
• Reimport updates an existing Test with a new set of results. DefectDojo compares the incoming report with the Test, records the changes, and adjusts the Findings to match: new ones are added, ones no longer reported are closed, and ones that return are reopened.

Think of Import as recording a single receipt, and Reimport as keeping a running ledger. Use Import for one-off reports such as a penetration test, and Reimport for anything you scan repeatedly.

Deduplication also behaves differently: two separate imports into the same Asset label their duplicates against each other, while Reimport never creates a Finding it identifies as a duplicate within the Test.

How do I connect a CI/CD pipeline?#

Call the DefectDojo REST API from your pipeline to import or reimport each scan. Pro users can also use the Universal Importer and DefectDojo CLI, which wrap the API in a command you can drop into any pipeline, or skip the pipeline entirely with Upstream Connectors.

How can I troubleshoot import errors?#

First confirm that your tool is on the parser list and that the file is in the format the parser expects; comparing it with the sample files used by the parser’s unit tests is a quick check. Report formats sometimes change without warning, and the community welcomes contributions that keep parsers current.

In Pro, Diagnostics lists import failures alongside other integration errors, and the Universal Parser can read a report that no built-in parser supports.

How should I handle very large scan files?#

Where your tool allows it, export smaller reports split by project, application or other context. Smaller files import faster, and the split organizes your Findings the same way. Pro processes Findings in the background once a file is uploaded and validated; self-hosted Pro also has a configurable upload size limit.

Prioritization and triage#

What does a Finding’s status mean?#

Every Finding is either Active or Inactive. Other statuses, such as Verified, False Positive, Out of Scope or Risk Accepted, are applied as triage decisions. See Finding Status Definitions.

How is Priority calculated, and can I change it?#

Where do EPSS and KEV data come from?#

How does deduplication work across tools, and how do I tune it?#

DefectDojo compares a new Finding against existing ones using a hash of chosen fields, the tool’s own unique ID, or both. See How DefectDojo deduplicates findings across security tools.

What is a Root Cause, and how is it different from a duplicate or a Finding Group?#

• A duplicate is the same Finding reported twice; DefectDojo keeps one and marks the other.
• A Finding Group gathers related Findings within one Test, for example by component, so they can be ticketed together. It is available in both editions.
• A Root Cause (Pro) links distinct Findings across every Asset that share one fix: the same component version, CVE, cloud resource or container image. It is ranked by how many Assets it affects, so one upgrade can be planned once and tracked to every Finding it clears.

Can I automate triage decisions?#

How do I find out when a pipeline stops sending scans?#

In Pro, set Scan Cadence policies that say how often each Organization, regulation, criticality level or Asset must be scanned. Each Asset then shows as Compliant, Due, Overdue or Never scanned, with dated attestations for auditors. A Triage Engine rule can also alert you when an expected scan does not arrive. See Scan cadence policies.

Remediation, risk and SLAs#

How do I accept a risk, and can I require a second person to approve it?#

How are SLA deadlines calculated?#

How do I give engineers a list of fixes instead of thousands of findings?#

In Pro, two features do this:

• Root Causes group Findings by the fix that clears them.
• The Remediation Center turns open Findings into concrete remediation actions (upgrade this package, patch that host, change this setting), each due by the earliest SLA among its Findings. Campaigns roll one change up across every place it is needed.

Open-Source has no equivalent. Its closest feature, Finding Groups, bundles related Findings from a single Test into one Jira issue.

Can Findings sync both ways with my ticketing system?#

How can I delete Findings?#

We recommend keeping closed Findings as Inactive rather than deleting them: deleting a Finding removes its notes and history, which makes metrics and audit records incomplete. If you do need to delete Findings, you can:

• Run a Bulk Delete on the Findings you select.
• Call DELETE /findings/{id} through the API.
• Delete a parent object, such as a Test, Engagement, Asset or Organization. Everything beneath it is deleted too; the objects above it are kept.

Reporting and compliance#

Can I save a report and run it again, or on a schedule?#

Can I get reports as PDF, or as data for another system?#

Can DefectDojo produce FedRAMP POA&Ms or OSCAL files?#

In Pro, yes. Compliance maintains POA&M items from your Findings and freezes a monthly snapshot as the official FedRAMP POA&M workbook and as an OSCAL POA&M, validated against the NIST schema. EU evidence packs export OSCAL Assessment Results. DefectDojo does not generate a System Security Plan. See The POA&M Ledger.

Does DefectDojo help with the EU Cyber Resilience Act?#

In Pro, yes:

• CRA Article 14 reports track the 24-hour early warning, the 72-hour notification and the final report from the moment you become aware of an actively exploited vulnerability or a severe incident. DefectDojo prepares each report package; you submit it to the authority.
• Evidence packs collect evidence for the CRA’s vulnerability-handling requirements, and for DORA and NIS2.
• The PSIRT Advisory Engine publishes security advisories and VEX for your products.

Can I export an SBOM or VEX?#

In Pro, yes: CycloneDX and SPDX SBOMs for an Asset, and CycloneDX VEX from its Findings. See Exporting SBOMs and VEX. The PSIRT Advisory Engine also publishes CSAF advisories and VEX.

AI#

What can the MCP server do, and which AI assistants work with it?#

The Pro MCP server connects an AI assistant to your DefectDojo data. Out of the box the assistant can read and summarize Findings, Assets, Organizations, Engagements, Tests, users and roles. An administrator can add toolsets that let it build and schedule reports, create and share dashboards, and organize the Asset Hierarchy. The page has quick-start guides for Claude, OpenAI and Gemini, and any assistant that supports remote MCP servers over HTTPS can connect.

Open-Source does not include an MCP server.

Can an AI assistant see data I can’t?#

No. The assistant connects with your own API token, so every request runs with your permissions: it sees only what you can see and can change only what you can change.

Does DefectDojo send my data to an AI model, and can I use my own?#

Only when you use a Sensei feature, and those features are optional. The rest of DefectDojo runs without AI.

Sensei is never trained on your data. DefectDojo uses your data only to complete the request you made and keeps no copy outside your instance. Our AI provider does not train on your data either.

On DefectDojo Cloud, Sensei is an AI agent built by DefectDojo. It runs inside your dedicated DefectDojo instance and reaches its models within DefectDojo’s Google Cloud environment, using credentials unique to your instance. Your data is never mixed with another customer’s. We improve the models behind Sensei over time, and you get those updates without changing anything.

On self-hosted DefectDojo Pro, Sensei is the agent harness and you bring the model. Connect the provider you already use (Anthropic, OpenAI, Amazon Bedrock or Google Vertex AI) in AI Model Settings.

Model traffic goes directly from your instance to your own provider account and never passes through DefectDojo. Your provider’s data terms apply to those requests.

On DefectDojo Cloud, you can also bring your own model. This is an enterprise option: DefectDojo turns on AI Model Settings for your instance, and Sensei then runs only on the provider account you connect there. To request it, contact hello@defectdojo.com.

If you connect an AI assistant through the MCP server, the data it reads goes to that assistant, under that assistant’s terms.

Does Sensei change my code without approval?#

No. Sensei delivers code fixes as pull requests in your repository, which you review and merge like any other change. On repositories where you turn on hands-off mode, Sensei opens fix pull requests without waiting for someone to approve each one; the pull request still goes through your normal review. Fixes to cloud resources always need a person to approve them. See Fixing Findings with Sensei.

Can AI mark a Finding as a false positive?#

Not on its own. A Triage Engine rule can ask AI to review a Finding (Sensei license). The AI answers with a suggestion, such as Likely false positive or Not affected, and the suggestion waits in AI Proposals for a person to accept or reject it. A Finding’s status changes on the model’s word only if a rule author explicitly builds the rule that way.

Administration and access#

How does access control work?#

How do I set up single sign-on, MFA or SCIM?#

Where can I see who changed what?#

An integration stopped working. Where do I look?#

In Pro, open Diagnostics under Connect. It collects failures from connectors, ticketing, Jira, SSO, imports, rules and notifications in one place, with secrets removed. In Open-Source, check the logs of the uwsgi and celeryworker containers.

How do I keep DefectDojo up to date?#