LoginSign Up
← Back to all sparks
P

Prowler

INFRA · APIS
Velocity7.5

Open-source cloud security assessment and compliance platform

prowler.com ↗

Prowler's assistant decides what to do with findings; the patches keep the scanner honest

cloud-securitycspmlighthouse-aiagenticsupply-chaincompliance
◆Current state
Prowler is shipping a minor release roughly weekly with patches filling the gaps. The agentic layer, Lighthouse, has moved from explaining findings to acting on them, with named skills attached to individual findings and every write path bound to the asking user's RBAC. Alongside that, 5.39.1 fixes an install path that had been quietly broken: 5.38.0 declared a cryptography floor its own dependencies capped below, so pip install prowler silently resolved back to 5.37.1.
◆Where it's heading
Two tracks run in parallel and rarely overlap. The minor releases push the commercial agentic surface forward — triage skills, page context, the MCP tool set — while the patches defend the parts everyone uses: dependency resolution, container CVEs, and check correctness. That second track matters more than its version numbers suggest, because a security scanner reporting PASS when an API call failed is worse than one that errors. 5.39.1 fixes exactly that in the ECS task-definition checks, and makes the SES public-access check evaluate every identity policy rather than stopping at the first.
◆Prediction
Expect the next minor to extend Lighthouse skills to groups of findings rather than one at a time, with patch releases continuing to absorb Trivy and base-image CVE churn.

◆Recent moves

  1. 22h ago

    5.39.1 unbreaks pip install and stops two checks reporting false PASS

    A patch that matters more than its number. The headline fix is a broken publish: 5.38.0 declared cryptography 50.0.0 while alibabacloud-tea-openapi, oci and pyopenssl capped it below that, so pip install prowler silently fell back to 5.37.1 — users installing the scanner were getting a two-release-old one. Two check-correctness fixes ride along, both in the direction of not lying: ECS task-definition checks no longer PASS when DescribeTaskDefinition fails before evidence is gathered, and the SES public-access check now evaluates every identity policy, flagging mixed Allow/Deny for manual review.

    View source ↗
  2. 5d ago

    Lighthouse AI triages findings; Azure management-group onboarding

    ⚡ SPARK

    The third and sharpest beat of the Lighthouse arc. Actions in 5.35.0 and context in 5.37.0 still left a human deciding what a finding meant; a skill that judges whether a finding is real and closes it when it is not takes over the decision itself. Azure management-group onboarding lands in the same release and follows the AWS Organizations pattern from earlier in the summer.

    View source ↗
  3. 12d ago

    Compliance Watchlist and multi-domain SAML SSO

    Compliance Watchlist and multi-domain SAML are consolidation features rather than new detection: an org tracking many frameworks keeps one shared pinned list, and a single SAML configuration can now authorize a primary domain plus 19 more behind one ACS URL. Both sit on the paid side of the line 5.34.0 drew, continuing the pattern where the subscription tier absorbs organizational complexity while the scanner stays open source.

    View source ↗
  4. 14d ago

    Container CVE cleanup and an M365 false-FAIL fix

    A hardening release: the API image moves to Debian 13 and drops git, perl and pip, taking its critical CVE count from 18 to 4, while a microsoft-kiota deserialization bug that produced false FAILs on Entra Conditional Access guest-user checks is fixed. For a security vendor both halves are customer-facing — the image CVE count is part of what is being bought, and a false FAIL is a compliance result somebody already acted on.

    View source ↗
  5. 15d ago

    Lighthouse AI gains page context and the full MCP toolbox

    ⚡ SPARK

    This is the second beat of the agentic pivot that started in 5.35.0: Lighthouse now knows which page and finding you are looking at, and can reach every tool family the MCP server advertises, while MCP itself picks up integrations, users and roles. The assistant stops being a chat bolted onto the findings list and becomes the way the platform is operated.

    View source ↗
  6. 21d ago

    Finding Groups dispatch to Jira; Attack Paths query filtering

    Finding Groups and mixed selections can now go to Jira as either one grouped issue or separate issues, and Attack Paths hides queries confirmed empty for the selected scan so the query selector only offers paths that exist. Both are triage-throughput work aimed at teams that already have more findings than they can route — the same bottleneck Lighthouse is being pointed at from the other direction.

    View source ↗