Roadmap: 1.1 and 1.2

[f15hb0wn]

Analytics 1.1.0 was released on July 14, 2026 — see the release notes, the 1.1.0 tour video, and the documentation. 1.2.0 is out of design and development is underway. Below is the roadmap of features rolling out. Please feel free to add comments here or in Slack (if a member of PAB.)

WitFoo Analytics Roadmap — 1.1.0 (released) & 1.2.0 (in development)

Analytics 1.1.0 was released on July 14, 2026. 1.2.0 is out of design and development is underway. Below is the roadmap of features rolling out. Please feel free to add comments here or in Slack (if a member of the PAB).

At a glance

Release	Status	Scope
1.1.0	✅ Released — July 14, 2026	26 enhancements & fixes across 7 themes
1.2.0	🎨 Designed — development underway	16 epics: a major Reporter expansion, first-class AI/agent visibility, and MSSP multi-tenant capabilities

The throughline for 1.1.0 is from signal to evidence and decisive action — sharper investigations, audit-ready compliance (including the new Certify capability), scheduled report delivery, and broader data onboarding on a hardened multi-tenant foundation. 1.2.0 turns Reporter into a full reporting platform (SOC, board, identity, data-protection, MSSP, and AI-governance reporting) and gives the platform its first view of AI agents and cross-tenant operations.

---

✅ Analytics 1.1.0 — Released (July 14, 2026)

Building on the 1.0.0 GA (June 2026), 1.1.0 delivers 26 items across seven themes. Now generally available and rolled out to all tiers — release notes · tour video · docs.

Status key: ✅ Included · 🔨 First release (expanding in later versions) · 👀 Pending final sign-off

🔎 Investigation — sharper, more decisive triage

Reshapes the threat graph and entity investigation around the questions analysts actually ask, and helps the platform reason about which exposures are genuinely exploitable.

Feature	What it delivers	Status
One-click CVE explanations (#320)	Click any CVE in a report or on a host to see a full, plain-language explanation (severity, description, weakness type) — served offline, no internet required.	✅
Exploitability-aware threat scoring (#322)	A live vulnerability on a host connected to an outside asset now automatically raises incident suspicion and flags attacker and victim; a new "Weak Edge" view (CVE × technique × attacker × victim, with a jump to work units) toggles alongside Attack Chain.	✅
Verdict-first entity detail panel (#326)	The node/entity panel now leads with a clear verdict (e.g. "Suspicious · 39% · Medium"), then why-flagged / where-who / related / activity — values humanized, raw data behind an Advanced view.	✅
In-panel relationship pivoting (#327)	Search all of an entity's relationships from its panel and see a "Top relationships" shortlist, internal users first.	✅
The true target of an attack is always visible (#330)	The internal host under attack (e.g. a server being brute-forced) is no longer missing from a work unit's evidence and graph; attacker→victim is correctly linked.	✅
Readable controls on the detail panel (#323)	Fixed detail-panel buttons that could turn an unreadable white.	✅

🧭 Asset & Identity — a more trustworthy inventory

Every security and compliance decision rests on the platform's picture of who and what is on the network. That picture gets materially more accurate and searchable.

Feature	What it delivers	Status
Accurate internal-user classification (#324)	A user counts as internal/managed only when sourced from a real identity system (Entra ID, AD, Okta, Ping…); log noise and failed logins no longer inflate the count — restoring a trustworthy denominator for account-management controls.	✅
Open-port visibility on assets (#321)	Assets now carry the network services (open ports) observed on them, searchable and filterable from asset search (e.g. "which assets expose remote-desktop access").	✅
Full-scope range filtering (#346)	Min/max filters for an asset's port, vulnerability, and product counts now narrow the entire dataset, not just the results already on screen.	✅

🛡️ Compliance & Certify — continuous monitoring becomes evidence auditors accept

Moves WitFoo from "we watch your environment" toward "we help you prove it."

Feature	What it delivers	Status
Certify — audit certification packages (SOC 2 / ISO 27001 / CMMC) (#339)	Build an audit submission inside WitFoo: guided framework questions, attached supporting docs (malware-scanned), answers auto-populated from live data (findings, coverage, retention, RBAC, health), exported as one verifiable package for the auditor. Available on Pro/Max tiers.	🔨
One Auditor, many frameworks (#331)	The Auditor extends beyond CIS Controls toward all supported frameworks; first expansion adds PCI DSS v4.0 and Essential Eight.	🔨
ISO 27001 updated to the 2022 standard (#350)	Built-in ISO 27001 moves off the withdrawn 2005 edition to the current :2022 Annex A (93 controls) — the version auditors actually certify against.	✅
Honest compliance-readiness score (#348)	Partial control coverage is now counted as partial; a not-fully-met control no longer registers as a full pass, so the readiness % reflects reality.	✅

📤 Reporting & Data — reports that arrive on their own

Feature	What it delivers	Status
Scheduled report delivery (#325)	Schedule reports/dashboards as offline PDFs delivered on a cadence to notification channels — email gets the PDF attached; Slack/webhook get a link and summary. No one has to log in to generate them.	✅
Retention-ceiling visibility (#329)	The health dashboard now charts how old the oldest record is versus the enforced retention limit, per data type, so operators can plan against their ceiling.	✅

🔌 Integrations — broader onboarding, honest views

Feature	What it delivers	Status
LevelBlue / USM Anywhere ingest (#344)	Pull LevelBlue (AlienVault) USM Anywhere alarms and events directly into WitFoo via one API credential per tenant — MSSPs onboard clients with zero endpoint/agent changes.	🔨
VMware NSX-T log coverage (#341)	Correctly recognizes and classifies several NSX-T log sources that had been flooding the "unknowns" bucket at a customer site.	✅
Accurate Integration Health view (#347)	A raw log-server listener is no longer shown as an API-pull integration; only genuine integrations appear.	✅
Self-monitoring of ingestion quality (#340)	WitFoo's automated monitoring flagged a data-classification anomaly at a customer site and opened a tracked issue on its own — which is what surfaced the NSX-T gap above.	✅
vCenter Broker telemetry parser (#354)	A new parser for VMware vCenter Broker telemetry, queued for human sign-off before it is switched on.	👀

🧱 Reliability & Demo — dependable in production, compelling in the sales cycle

Feature	What it delivers	Status
Dependable operations dashboard (#328)	The Conductor dashboard no longer hangs on endless spinners — it shows data fast, fills charts from the last known-good view, marks stale data, and offers Retry on failure.	✅
Realistic, story-driven demo (#332)	Replaces random demo noise with a coherent scenario built around a believable regional-healthcare org facing realistic, technique-mapped attacks, so prospects see a world that mirrors their own.	🔨

🔐 Trust & Quality — protecting customer data and the platform itself

Feature	What it delivers	Status
Tamper-proof cross-cluster threat intel (#349)	Shared threat-intel messages between clusters are now cryptographically sealed end to end (body, not just labels), rolled out so mixed-version clusters keep working during upgrades.	✅
Verified access-control enforcement (#351)	Automated safeguards confirm every part of the platform enforces the correct permissions, and remaining gaps were closed.	✅
New permissions reach upgraded customers (#352)	New permissions (Certify, graph, automation) now converge to already-deployed environments on upgrade — no admin hand-editing roles.	✅
Quality & multi-tenant isolation hardening (#345)	A structured program closed test-suite blind spots — most notably strengthening one-tenant-can't-see-another isolation — plus coverage, mobile, accessibility, and resilience checks.	✅

---

🗺️ Analytics 1.2.0 — designed; development underway

1.2.0 is a major expansion of Reporter into a full reporting platform, alongside the platform's first view of AI agents and cross-tenant (MSSP) operations. These items are designed and in active development — scope and sequencing may still shift, and your feedback directly informs both.

Status key: 🟢 Planned for 1.2.0 · 🧱 Foundation (enables other items) · 🔬 Research / prerequisite-gated

🤖 AI & Agentic Visibility

AI agents — autonomous, tool-using LLM workloads that authenticate as non-human identities — are now real actors on customer networks, and today WitFoo has no way to see them. This is a greenfield capability grounded in what a log-ingesting SIEM can actually observe (egress, identity, DNS), not prompts or model internals.

Feature	What it delivers	Status
First-class AI agents in the graph (#357)	A new AI-agent entity type, agent relationships, detection from existing telemetry, and lead/enrichment rules — so teams can see which hosts and users run AI agents, what those agents can reach, and whether behavior looks like exfiltration, privilege abuse, or a runaway loop.	🧱
Agentic AI Usage Report (#360)	The CISO-facing answer to the board's three AI questions — what AI is running on our network, who does each agent answer to, and what data is flowing to it — plus AI-governance readiness (e.g. AI-system inventory obligations). Builds on #357.	🟢

📊 Reporter — a major expansion

Reporter today grades the security program (executive, compliance, cost). 1.2.0 adds report families that grade the SOC, the identity posture, the data, and the board/regulator view — each mining telemetry WitFoo already parses, and each modeled on what CASB/SIEM/GRC leaders ship today.

Report family	What it delivers	Status
Shadow IT / SaaS Discovery (#361)	Discover the cloud/SaaS apps people actually use: app inventory by users/volume/risk, sanctioned vs unsanctioned, risky OAuth grants, unsanctioned egress, and acceptable-use.	🟢
SOC Operations & Performance (#362)	Grade the SOC itself: MTTD/MTTR vs SLA, the alert funnel (raw → confirmed), analyst workload and case aging, automation effectiveness, and per-incident post-mortem export.	🟢
Coverage & Visibility (#363)	"Do we see what we should?": a MITRE ATT&CK coverage heatmap, log-source health (catch silently-dead sources), asset/EDR coverage gaps, and retention readiness.	🟢
Identity & User Behavior (#364)	Identity posture and threat: ISPM scorecard, log-observed MFA-coverage evidence (what insurers now demand), dormant and non-human-identity inventory, ITDR summary, and UEBA riskiest entities.	🟢
Data Protection & Insider Risk (#365)	What data left, where it went, and who moved it: egress by destination/app/country, cross-vendor DLP verdicts, and departing-employee/watchlist data movement.	🟢
Phishing & Email Security (#366)	A cross-product email report — phishing volume, user click-through outcomes, campaign clusters, and per-product catch/miss across the whole email stack in one pane. (Fastest-to-ship; reads from data already collected.)	🟢
Executive, Board & Regulatory (#367)	Speak to the boardroom and the regulator: a quantified-risk board pack (CRQ), plus support for SEC / NIS2 / DORA disclosure timelines and cyber-insurance readiness evidence.	🟢
Compliance & Audit Expansion (#368)	From point-in-time scoring to continuous, auditor-ready reporting: readiness-drift trending with regression alerts, a "map once, comply many" multi-framework crosswalk, cloud posture, schedulable evidence, and new Certify packages (HIPAA, PCI DSS 4.0, NIST 800-171).	🟢
Vulnerability & Exposure Expansion (#369)	Risk-based (CTEM-style) reporting: prioritize by what's actually exploited (KEV/EPSS), remediation-SLA burn-down and aging, and patch-compliance trending — instead of raw-severity lists.	🟢
Resilience & Third-Party Readiness (#371)	Backup/ransomware recovery readiness, pen-test finding-lifecycle tracking, vendor/third-party risk register, and zero-trust maturity. A research tier where each area's data prerequisite lands first, then the report.	🔬

🏢 MSSP & Multi-Tenant

Makes WitFoo a first-class fit for MSSPs and multi-division enterprises: branded, contract-grade reporting per client and the ability to see across the whole fleet at once.

Feature	What it delivers	Status
MSSP & Multi-Tenant Reporting (#370)	Turn Reporter into a delivery vehicle: branded/white-label scheduled reporting, monthly managed-service packs, SLA-attainment reports, and quarterly QBR packs per tenant — the artifacts that drive MSP renewals.	🟢
Multi-Tenant Combined Views (#372)	Cross-tenant comparison and aggregation across Reporter and Analytics — tenant groups, delegated analyst access, and honest fleet rollups, so an operator can answer "which tenant is trending worse?", "combined savings across the fleet?", and "every open critical across all clients" without switching orgs one at a time.	🟢
Multi-Tenant Demo Data (#373)	Extends the 1.1.0 scenario-driven demo engine to a believable MSSP client fleet, so the combined-view/MSSP story is demoable end-to-end.	🟢

🔐 Platform & Telemetry Security

Feature	What it delivers	Status
Proxy WFA telemetry through intel (#356)	Removes WitFoo's embedded telemetry-push credentials from the appliance binary; the appliance authenticates with its existing license key and intel relays logs/metrics upstream — shrinking the credential blast radius from "every binary on every appliance" to one controlled service, and enabling rotation and per-appliance revocation.	🟢

---

💬 How to give feedback

We'd value your input on priority and sequencing — especially across the 1.2.0 Reporter families and the AI-agent and MSSP tracks. A few prompts:

• Which 1.2.0 report families would move the needle most for your program in the next two quarters?
• For Certify and the compliance expansion — which frameworks/package types matter most (HIPAA, PCI DSS 4.0, NIST 800-171, others)?
• On AI governance (#357/#360) — is shadow-AI discovery and agent accountability a board ask for you yet?
• Anything missing from the roadmap you'd expect your SIEM to cover?

Add a comment below, or reach us in Slack if you're a PAB member. Thank you for helping shape the roadmap.

_{Sources: GitHub milestones 1.1.0 and 1.2.0 (16 epics). 1.1.0 was released July 14, 2026 and cascaded to all tiers. Roadmap compiled July 8, 2026; 1.1.0 status updated July 14, 2026.}

[Monologie]

@charles re #360, could be useful to understand privileges of AI agents (full, task based, JIT, PIM etc), whether they can deploy incremental agents, tiering of data they can reach and a correlation between that and data/privacy rules eg Privacy Act. Dont want to boil the ocean on it if an existing data source can provide a lot of the detail. This is the space i am working in with Cyera as well.
#348 thats excellent, will add credibility. In order to make the Reporter component fully complete, is there a way for manual updating of non-system derived controls that provide a more complete scorecard. It could be gamed by CISO's to inflate underperforming scorecards but could be a nice addition (eg uploaded Pen Test reports scanned by AI to analyse outputs, backup success reports, etc). Just as future thought as the backlog is significant already.

[f15hb0wn]

@Monologie great feedback, thanks. AI and Agentic features are pretty major. It touches the way Conductor processes messages (new connectors, parsers, logging), expanded Auditor features to interrogate cloud/hypervisors and AI providers, and an expanded graph to understand the physics of non-human agents. The 1.2 release will be a huge step forward but production testing will certainly lead to a number of feature requests as we learn from the user interactions.

That is good feedback on #348. We are tracking 4 dimensions of data 1) user assertion (moving to Certify feature in 1.1) 2) Graph detected machine evidence 3) Audit findings from configuration interrogation and 4) Vulnerability data from reporting sources. Your feedback makes me think there is room for a "Conflict Resolution" report when the dimensions disagree on compliance. It would point out things like "User reports MFA is in place but Okta shows it is only enable for Admins." That is a relatively high value feature with a small dev cost given the existing data architecture. I'll get something into scope for 1.3 and tag you when the research on it is complete.

Thanks again for the review!

[f15hb0wn]

1.1.0 has been released: https://github.com/witfoo/release-notes/blob/main/releases/1.1.0.md

[Monologie]

Presenting reporter to customers, the CVE vulnerabilities has been well received. Couple of other potential things:

1. While we highlight the control and the CVE, we only pull through what the CVE is. Is the task for remediating that CVE available to append? It would be great for the AI to pull out a SOC Manager/CISO Program of Remediation summary eg pass to the SOC team...here is what needs fixing and recommended fixes. (Update: I think i have actually found that in there when clicking deeper into the notice)
2. Tool consolidation: can the AI identify/make recommendations on which tools are redundant and potentially where increased focus should be applied. eg it would be good to understand if an application has (over a protracted period) never identified and mitigated an exclusive event. The Venn diagram does it a high level but presents a challenge to understand for this specific requirement. Happy to explain more if I am not clear.