docs: Add Pro vs OSS comparison for cross-product risk acceptances #13703
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
paulOsinski
approved these changes
Nov 13, 2025
| * **Cross-Product Risk Acceptances**: In DefectDojo Pro, you can apply a single Risk Acceptance across multiple Products. For example, if CVE-2024-1234 appears in 10 different products, you can create one Risk Acceptance that governs all instances of that CVE across your entire portfolio. | ||
| * **Bulk CVE Management**: Search for all Findings with a specific CVE or vulnerability ID, then apply a Risk Acceptance to all instances simultaneously, regardless of which Product they belong to. | ||
|
|
||
| **DefectDojo Open Source** implements Risk Acceptances at the Product level: |
Member
There was a problem hiding this comment.
In OS the risk acceptances are at Engagement level.
Contributor
There was a problem hiding this comment.
I'm the one that misspoke to @skywalke34 and told him it was Product level but, yeah, it's engagement level in Open Source.
Contributor
There was a problem hiding this comment.
I wanted to extend it to the Product level, but I have received no feedback about it #12361 (comment)
So, do you agree to redo to the product level?
mtesauro
approved these changes
Nov 14, 2025
Contributor
mtesauro
left a comment
mtesauro
left a comment
There was a problem hiding this comment.
Approved.
Assuming @skywalke34 addresses the requested changes from @valentijnscholten
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
documentation update: Clarifying the differences between DefectDojo Pro and Open Source for cross-product risk acceptances. Specifically, Pro supports CVE-level risk acceptance across products while OSS only provides for product-level risk acceptances.