The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running. We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.

BryanK 28 days ago

5

Secfix agent

💡

Feature Request

Currently, the software we use has to be maintained as part of the Vendor Management functionality. In my view, this is not factually correct and makes working with SECFIX unnecessarily complicated and less user-friendly than it needs to be. There are several reasons why the software list should be separated from Vendors: Software is an asset Software represents a supporting information asset in the context of ISO 27001. Therefore, it would be logical and appropriate to maintain the software inventory as part of the Assets section. Currently, this is not possible, as software has to be maintained within the Vendor Management as per the templates and our contact at Secfix. Software information is not accessible to non-admin users Users without administrator permissions cannot access the Vendor Management section. They only see the “My Task” page. As a result, the software inventory maintained there is not visible to our regular users within the platform. This forces us to maintain a second software inventory outside of SECFIX, which defeats the purpose of having a centralized inventory within the platform. At the moment, it is actually easier for us not to use SECFIX for managing our software inventory at all. The current approach makes the process unnecessarily complicated and requires us to maintain the software inventory outside of SECFIX. Suggested solution: Provide a dedicated Software / Software Assets section within the Assets area. This inventory should be accessible to users according to their assigned permissions and should be managed independently from Vendor Management. Vendor Management should remain focused on vendors and their associated risks, assessments, contracts, and security requirements, while the software inventory should be maintained as an independent asset inventory.

Johannes Renk 2 days ago

Vendor management

💡

Feature Request

Currently, the only options are to assign the SECFIX Security Awareness Training or to provide an in-house training course. However, in many cases, relying on a single type of training is not sufficient. As compliance requirements continue to evolve, it would be very useful to have the ability to distribute and manage additional training courses through the platform (for example, training for the EU AI Act or other topic-specific compliance requirements). Ideally, the platform could allow administrators to add an external training course simply by providing a link. The course could then be assigned to specific users or groups as a mandatory requirement, with the completion status tracked within the platform. This would make it possible to use SECFIX as a central platform for managing different security, compliance, and awareness training requirements without requiring every training course to be hosted directly within SECFIX.

Johannes Renk 2 days ago

Security awareness training

💡

Feature Request

Please add the ability to select individual assets, potentially within the respective categories, rather than only asset categories, in the Risk Register's "Impacted Assets" section. This would enable more precise mapping and improve visibility.

David.N 20 days ago

1

Risk register

💡

Feature Request

Currently, in order to assign a collaborator as an owner to a treatment task, they should also be assigned as an owner to the related risk. If they are not the owner of the risk, they can not be assigned as the owner of the treatment task. That makes no sense. The risk is owned by a lead, while the treatment tasks are maybe owned by others; we can not grant all employees access to everything. If I add a collaborator to a treatment task, he should then get access to that risk; otherwise, task ownership is senseless if this can just be the risk owner.

Jan Wagner 8 days ago

💡

Feature Request

Currently, when connecting the Jira integration, the "Default project" setting defaults to the first project returned from Jira rather than prompting the user to actively choose one. On instances with many legacy or unused projects, this can lead to tickets being created in the wrong project, especially if the connected user doesn't have permissions on that default project, which can look like a broken integration rather than a configuration issue. Suggested improvement: During setup (and when no project has been explicitly chosen yet), require the user to actively select a project instead of auto-selecting the first one in the list. This would prevent silent misconfiguration and make it clearer which Jira project is actually receiving synced tickets.

Kilian Maier 8 days ago

💡

Feature Request

I would like to share a small usability suggestion regarding the Secfix interface. For findings such as the Microsoft 365 checks, the action button is currently labeled "Remediate". Initially, both a colleague and I were hesitant to click it because it sounded like it would immediately apply changes to our environment. In practice, the button opens guidance and remediation instructions rather than performing the remediation itself. For that reason, a label such as "Instructions", "View Instructions", or "Review Remediation Steps" may better reflect the actual behaviour and help avoid confusion.

ivana.jendzic 9 days ago

Automated tasks

💡

Feature Request

Right now various documents in Secfix need to be tracked e.g. in Sheets/Docs (eg KPI Tracker). It would be great to be able to be able to host/edit those documents natively within Secfix and not have to use other tools

Marc Morone 27 days ago

💡

Feature Request

Allow customers to add applications detected by the Secfix Agent directly to the Vendor List. Customers could mark a detected application as approved and add it to the Vendor List with one click. Benefit: This would avoid manually recreating the list of applications already detected by the Secfix Agent.

m.gross about 1 month ago

💡

Feature Request

When managing a primary information asset (e.g., the core process of "order processing"), it relies on secondary information assets (infrastructure, software, personnel). If I create a risk scenario for both the primary and the secondary asset, both risks are recorded but have no impact on one another (individual asset linking is currently not possible). If the risk scenario for the secondary asset worsens, the change in risk affects only that secondary asset, as I cannot link the primary information asset to the secondary one. In reality, however, a high risk associated with a secondary asset can potentially increase the risk to the primary asset as well. Such a link would allow for the propagation of risks and reflect the reality of the situation. Without this function, we have to painstakingly figure out for yourself which processes are linked to this asset and then re-evaluate the risk across the board. Note: Even if the risk would no propagate, the link is already helpful to identify connected assets.

Johannes Renk 15 days ago

Risk register

+1

💡

Feature Request

Introduce a Slack integration that allows users to receive notifications and complete relevant Secfix actions directly from Slack. Examples: Vendor Management: Notify users when a vendor review is due and allow them to approve it directly in Slack. Policies: Notify employees about policies requiring review/acknowledgement and allow them to acknowledge them in Slack. Training: Send reminders for outstanding security/compliance training. More generally, allow users to interact with relevant Secfix workflows directly from Slack. Expected Benefit Higher completion rates, faster responses, and less context switching between Slack, email, and Secfix.

olivier.welscher about 1 month ago

💡

Feature Request

For the employees who didn’t have a match, adding employees from the HRIS sync takes three clicks each, with waiting for things to load in between. I'm working through a backlog right now and it adds up fast. In UI I cannot modify anything anyways, fields are locked so I feel I am doing unnecessary work that could be just done in bulk. What I'd like: Checkboxes on each row plus a select-all (right side would work well). Tick everything, untick what I don't need, then run one action: Add employee/s Mark out of scope

Arne Gebert 24 days ago

💡

Feature Request

https://docbee.com/demo-nexoware-docbee-itsm/ DocBee ist eine Business-Software die auf Lizenzbasis, Dienstleistungen und tägliche Arbeitsprozesse digitalisiert.

p.ngassa 24 days ago

Integrations

Hello, To train all people, we'd need the security awareness training to also be available in Portuguese. This is usually done via YouTube Studio → video → Subtitles → Languages. Machine-translated captions are completely acceptable on our end. If that doesn't work for SecFix, we could instead provide proper translated caption tracks in Portuguese, which would give a more precise, non-machine alternative. Please let us know how you'd like to proceed, so we can start using the SecFix training in other languages effectively. As a quicker interim solution, we will provide a full bilingual document with all questions and answers both in English and Portuguese, so our users can view the videos first, and then choose the options themselves. Best regards, Petru Faurescu

Petru Faurescu 27 days ago

Security awareness training

Languages

With version 4, PCI DSS now allows partial audits. Therefore it would be nice to have some (static) switches for not displaying the requirements, which are not in focus for an audit. This would also help with the overall fulfill degree. Switches would be appreciated for both, a whole Requirement section as well as a single line.

Frank Tiex 29 days ago

Frameworks page

💡

Feature Request

The Employees page comes with filtering, but does not have a sorting option like e.g. Computers. Is this by intention or got it lost accidentally? Especially sorting by Date would be helpful.

Frank Tiex 29 days ago

Employees

💡

Feature Request

Platform permissions can currently only be assigned individually, which makes access management cumbersome for larger teams. Requested Functionality Allow roles & permissions to be assigned to groups, so all group members automatically inherit the assigned role. A role assigned directly to an individual user should override the group-level role. Example: Top Management → Admin or ISMS Governance Council → Admin. This would make access management much more scalable and easier to maintain.

Michael Wachter 29 days ago

💡

Feature Request

No way to open-in-new-tab from evidences lists (or similar). Clicking into an item and going back resets scroll position to the top, losing place in a long list of evidences.

Melita Mujičić 2 months ago

Manual evidence

💡

Feature Request