The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running. We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.

BryanK 13 days ago

5

Secfix agent

💡

Feature Request

Please add the ability to select individual assets, potentially within the respective categories, rather than only asset categories, in the Risk Register's "Impacted Assets" section. This would enable more precise mapping and improve visibility.

David.N 5 days ago

1

Risk register

💡

Feature Request

Right now various documents in Secfix need to be tracked e.g. in Sheets/Docs (eg KPI Tracker). It would be great to be able to be able to host/edit those documents natively within Secfix and not have to use other tools

Marc Morone 12 days ago

💡

Feature Request

Allow customers to add applications detected by the Secfix Agent directly to the Vendor List. Customers could mark a detected application as approved and add it to the Vendor List with one click. Benefit: This would avoid manually recreating the list of applications already detected by the Secfix Agent.

m.gross 22 days ago

💡

Feature Request

When managing a primary information asset (e.g., the core process of "order processing"), it relies on secondary information assets (infrastructure, software, personnel). If I create a risk scenario for both the primary and the secondary asset, both risks are recorded but have no impact on one another (individual asset linking is currently not possible). If the risk scenario for the secondary asset worsens, the change in risk affects only that secondary asset, as I cannot link the primary information asset to the secondary one. In reality, however, a high risk associated with a secondary asset can potentially increase the risk to the primary asset as well. Such a link would allow for the propagation of risks and reflect the reality of the situation. Without this function, we have to painstakingly figure out for yourself which processes are linked to this asset and then re-evaluate the risk across the board. Note: Even if the risk would no propagate, the link is already helpful to identify connected assets.

Johannes Renk 13 minutes ago

Risk register

+1

💡

Feature Request

Introduce a Slack integration that allows users to receive notifications and complete relevant Secfix actions directly from Slack. Examples: Vendor Management: Notify users when a vendor review is due and allow them to approve it directly in Slack. Policies: Notify employees about policies requiring review/acknowledgement and allow them to acknowledge them in Slack. Training: Send reminders for outstanding security/compliance training. More generally, allow users to interact with relevant Secfix workflows directly from Slack. Expected Benefit Higher completion rates, faster responses, and less context switching between Slack, email, and Secfix.

olivier.welscher 21 days ago

💡

Feature Request

For the employees who didn’t have a match, adding employees from the HRIS sync takes three clicks each, with waiting for things to load in between. I'm working through a backlog right now and it adds up fast. In UI I cannot modify anything anyways, fields are locked so I feel I am doing unnecessary work that could be just done in bulk. What I'd like: Checkboxes on each row plus a select-all (right side would work well). Tick everything, untick what I don't need, then run one action: Add employee/s Mark out of scope

Arne Gebert 9 days ago

💡

Feature Request

https://docbee.com/demo-nexoware-docbee-itsm/ DocBee ist eine Business-Software die auf Lizenzbasis, Dienstleistungen und tägliche Arbeitsprozesse digitalisiert.

p.ngassa 9 days ago

Integrations

Hello, To train all people, we'd need the security awareness training to also be available in Portuguese. This is usually done via YouTube Studio → video → Subtitles → Languages. Machine-translated captions are completely acceptable on our end. If that doesn't work for SecFix, we could instead provide proper translated caption tracks in Portuguese, which would give a more precise, non-machine alternative. Please let us know how you'd like to proceed, so we can start using the SecFix training in other languages effectively. As a quicker interim solution, we will provide a full bilingual document with all questions and answers both in English and Portuguese, so our users can view the videos first, and then choose the options themselves. Best regards, Petru Faurescu

Petru Faurescu 12 days ago

Security awareness training

Languages

With version 4, PCI DSS now allows partial audits. Therefore it would be nice to have some (static) switches for not displaying the requirements, which are not in focus for an audit. This would also help with the overall fulfill degree. Switches would be appreciated for both, a whole Requirement section as well as a single line.

Frank Tiex 14 days ago

Frameworks page

💡

Feature Request

The Employees page comes with filtering, but does not have a sorting option like e.g. Computers. Is this by intention or got it lost accidentally? Especially sorting by Date would be helpful.

Frank Tiex 14 days ago

Employees

💡

Feature Request

Platform permissions can currently only be assigned individually, which makes access management cumbersome for larger teams. Requested Functionality Allow roles & permissions to be assigned to groups, so all group members automatically inherit the assigned role. A role assigned directly to an individual user should override the group-level role. Example: Top Management → Admin or ISMS Governance Council → Admin. This would make access management much more scalable and easier to maintain.

Michael Wachter 14 days ago

💡

Feature Request

No way to open-in-new-tab from evidences lists (or similar). Clicking into an item and going back resets scroll position to the top, losing place in a long list of evidences.

Melita Mujičić about 2 months ago

Manual evidence

💡

Feature Request

Regarding the bigger vendors (Google, AWS, Microsoft, Jira, etc.), automate the Security documents (ISO certificates, DPAs, etc.). Looking for those manually and choosing the right one can be a pain.

aj about 2 months ago

💡

Feature Request

https://www.topdesk.com/en/

jochem.baud 21 days ago

Integrations

Currently, failed checks show which resources didn't match, but passing checks show nothing. Usees need to the ability to seewhat was actually checked to prove scope to auditors (e.g., which AWS account/regions were checked for "CloudTrail enabled in all regions," which employees were in scope for security training).

Melita Mujičić about 2 months ago

Automated tasks

💡

Feature Request

HR integration to sync employee start end date etc.

Philipp Baldauf 27 days ago

1

People

+1

Integrations

Allow admins to define a single annual review date per framework for annual evidence renewals. Instead of calculating renewal dates based on each piece of evidence’s last upload date, all annual evidence could become due at a configurable interval before the review date (e.g., 1 month). This would prevent evidence renewal dates from being scattered across several weeks and make it easier to prepare for internal and external audits in one planned review cycle.

Bart Slaets 27 days ago

💡

Feature Request