DigiCert Adds Secure Releases to Software Trust Manager to Manage Risk Before and After Software Ships

DigiCert Adds Secure Releases to Software Trust Manager to Manage Risk Before and After Software Ships
New functionality connects software bills of materials (SBOMs) and vulnerability findings with signing controls to help teams identify affected versions and enforce release policies

LEHI, Utah — October 15, 2026— DigiCert, a global leader in intelligent trust, today announced Secure Releases, new functionality in DigiCert Software Trust Manager that helps organizations assess software risk when a release ships and as new vulnerabilities emerge. Part of the DigiCert ONE platform, it brings together information about supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results. Teams can identify which versions need attention and use that information in their signing and release workflows.

Signing confirms who produced software and whether it has been altered, but a component can become vulnerable after the software ships. Finding the affected versions can mean piecing together information from repositories, SBOMs, vulnerability databases, and security scanners. Secure Releases brings that information together by release so teams can see what needs attention and act on it.

With Software Trust Manager, including Secure Releases, organizations can:

• Sign software and cryptographic inventories. Sign software bills of materials (SBOMs) and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity.
• See and monitor release risk. View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and identify new risks as vulnerability information changes.
• Find and address affected releases. See which releases contain a vulnerable component, alert the teams responsible, and, with Premium, find a version of that component that fixes the vulnerability when one is available.
• Apply release policies. Set vulnerability and SBOM requirements and, where supported, prevent signing or release when those requirements are not met.
• Share evidence. Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors.

“Software signing proves where code came from “Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency,” said Deepika Chauhan, Chief Product Officer at DigiCert. “Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organizations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements.”

Secure Releases is available through Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk. Advanced and Premium add ongoing monitoring of SBOM results by release as vulnerability information changes. Premium also suggests a newer version of a vulnerable component when a fix is available and lets organizations block signing or release if the software does not meet their security requirements.

To learn more about Secure Releases in DigiCert Software Trust Manager, visit https://www.digicert.com/software-trust-manager

Read the blog: When yesterday’s code becomes today’s threat  

About DigiCert

DigiCert is a global leader in intelligent trust. We protect the digital world by ensuring the security, privacy and authenticity of every interaction. Our AI-powered DigiCert ONE platform unifies PKI, DNS and certificate lifecycle management to secure infrastructure, software, devices, messages, and AI content, agents and models. Learn why more than 125,000 organizations, including 90% of the Fortune 500, choose DigiCert to stop today's threats and prepare for a quantum-safe future at www.digicert.com.