Roadmap · updated October 2026
Six months to a SIEM.
The order is deliberate: finish the compliance frameworks first, then connect the Microsoft estate, then build the detection software on top of both. One milestone a month, and the SIEM portal live in April 2027.
01 · NovFrameworks first
02 · Dec to JanMicrosoft second
03 · Feb to AprSIEM third
Phase planOct 2026 to Apr 2027
Today · 13 Oct 2026
Milestones1 shipped · 6 planned
Month 00
Oct ’26
Shipped
The platform split into workspaces
- External scanning: surface scan, content discovery, vulnerability scan, deep scan
- Company workspace: the read-only Windows agent, fleets judged against the CIS Controls
- Compliance module: CIS Controls v8.1.2, adopted per account, progress per safeguard
- One central dashboard where every module's data meets, with its own sidebar per module
Month 01 · Next
Nov ’26
Frameworks, finished
Compliance that proves itself
- NIS2 and ISO/IEC 27001 catalogues next to CIS v8.1.2
- Evidence per safeguard: scan findings and agent checks attach as proof, automatically where they map
- Framework report export: a PDF an auditor can take away
- Owners and due dates on safeguards, so the work is assignable
Month 02
Dec ’26
Microsoft integrations
Identity and devices
- Sign in with Microsoft Entra ID
- Microsoft Graph: the user and device inventory lands in the Company workspace
- Intune compliance state per device, next to the agent's own CIS judgement
- Directory facts feed framework evidence (MFA coverage, dormant accounts)
Month 03
Jan ’27
Microsoft integrations
Security signals
- Defender for Endpoint: alerts and secure score into the dashboard
- Microsoft 365 and Exchange posture read and graded
- Signals map onto CIS and NIS2 controls as living evidence
- OSINT module v1: breach and credential exposure for your domains
Month 04
Feb ’27
SIEM build · 1/3
The event pipeline
- Log forwarding from the endpoint agent, syslog intake, Microsoft Graph security events
- One normalized event schema across every source
- Retention, storage and fast search over the event store
Month 05
Mar ’27
SIEM build · 2/3
Detection and alerting
- A curated detection-rule engine over the normalized events
- Correlation across sources: agent, Microsoft, external scans
- An alert queue with triage states, and mail / webhook notifications
Month 06 · Target
Apr ’27
SIEM build · 3/3
The SIEM portal, live
- The SOC dashboard as its own workspace: events, alerts, cases
- Light case management: assign, investigate, close, report
- Scheduled reporting for management and auditors
- First beta customers onboarded
Dates are targets, not promises; what actually ships each month is recorded in the changelog as it lands. The order will not change: frameworks first, Microsoft second, SIEM third.
CyberGuard