Where we're headed
What we are building now, what comes next, and what has shipped. CVERiskPilot is in alpha, so priorities can change.
Last reviewed September 2026
How to read this roadmap
- Shipped items show the quarter they shipped.
- Unshipped work has no date: Now is in progress, Next and Later are planned.
- A badge shows the lowest plan that includes a feature, or the plan intended for unreleased work. No badge means no plan is decided or the item covers the whole company.
Features on all plans still count against each plan's AI-call and API limits. See pricing.
In progress, 6 items
- NowPlan: Enterprise
Enterprise Single Sign-On
SAML and OIDC sign-in through WorkOS. Sign-in is built and deployed; each workspace's identity-provider connection is set up with our team during onboarding.
- NowPlan: Enterprise
SCIM 2.0 Provisioning
Create, update and deactivate users from your identity provider. The provisioning endpoint is built and being readied for identity providers; SCIM tokens in Settings and group sync are still to come.
- Now
Scanner API Connectors
Adapters for Tenable, Qualys, CrowdStrike, Rapid7 and Snyk are built, but the sync jobs that pull findings from them are not running yet. Today, export results from your scanner and upload the file; CLI and CI pipeline results appear separately on the Pipelines page.
- NowPlan: Pro
Vault Protocol: Signed Audit Evidence
Ed25519 signatures and Merkle inclusion proofs for audit log entries, with a signed audit export an auditor can verify independently. The signing and export code is built; production signing keys are still being set up.
- NowPlan: All plans
Private Triage Model (Corvus)
The next version of our private triage model, benchmark-gated before any release claim. Customer AI triage runs on external models today, under the same deterministic safety policy; routine cases move to the private model once it can serve at interactive speed.
- Now
Auditor Agent
An AI agent that drafts POAM entries, auditor justifications, evidence lists and "not exploitable because..." rationales for a single finding, citing controls from our compliance mapping. A person must approve each draft. It is in internal testing and not yet available in the product.
Planned, 16 items
Next, 5 items
- NextPlan: Enterprise
Self-Serve SSO Setup & Enforcement
Connect your identity provider from Settings without our help, require SSO for everyone in your workspace, and end a user's active sessions as soon as they are deactivated.
- NextPlan: All plans
Finding Lifecycle on Rescan
When a later scan of the same scope no longer reports a finding, its case moves to fix-pending-verification; a closed finding that reappears is reopened, with an audit-trail entry. Today cases are closed by hand or through Jira and ServiceNow ticket status, and the scan comparison report shows what changed between two uploads.
- NextPlan: All plans
VEX Import & Export
Read OpenVEX, CycloneDX VEX and CSAF VEX statements so findings a vendor marks "not affected" or "fixed" are handled at upload, and export your own dispositions as VEX documents. Today VEX dispositions can be recorded through the MCP server and Claude Code plugin.
- Next
Posture History & Trend Detection
A recorded history of compliance posture scores and automatic scan-over-scan trend detection, such as a finding newly added to KEV or a jump in EPSS, feeding the posture charts and executive summaries.
- NextPlan: Pro
Flux Pipelines: Automation Rules & Ownership Routing
IF/THEN rules, built in a visual editor, that route new findings, assign owners by asset, client, severity or tag, and send notifications as data arrives. Rule storage and a dry-run preview exist in the API today; the editor and the engine that applies rules do not. Cases are assigned by hand, singly or in bulk, until then.
Later, 11 items
- LaterPlan: Pro
Continuous Monitoring
Scheduled pulls from connected scanners, alerts when CISA adds a KEV entry that matches one of your existing findings, and notifications when your compliance posture changes. Today findings are checked against the KEV catalog when they are ingested or enriched.
- LaterPlan: Pro
Signal Engine: Real-Time Push Ingestion
Let scanners push findings to CVERiskPilot as they are detected, authenticated with an API key, with a live feed that updates the dashboard.
- Later
Fix Pull Requests & GitLab Support
Open pull requests that bump vulnerable dependencies, link pipeline results to the repository, branch and commit they came from, and comment on GitLab merge requests. The CLI already runs in GitLab CI as a plain command.
- LaterPlan: All plans
Interactive API Reference & SDK
A public interactive API reference, a TypeScript SDK, an API playground, and live delivery of outbound webhook events.
- LaterPlan: All plans
Control Mapping Beyond CWE
Findings map to compliance controls through their CWE today, so a finding without one (common for rule-based SAST and misconfiguration results) maps to no control. We plan to map from scanner rule IDs and other finding context, with each new mapping reviewed before it reaches production.
- Later
Cloud Posture Ingestion
Import findings from AWS Security Hub and Google Cloud Security Command Center so cloud misconfigurations get the same compliance mapping and triage as scanner results.
- Later
Asset Context Graph
Record which assets depend on or expose each other, so a finding's priority can reflect what an attacker could reach from it. Today prioritization uses each asset's own criticality, environment and internet exposure.
- LaterPlan: Enterprise
Sector-Tuned Triage Models
Triage tuned for sectors such as healthcare (HIPAA), defense (CMMC) and financial services (PCI DSS). We will specialize only once the base model passes its benchmark gates and customer demand justifies it. Today industry focus comes from choosing frameworks, for example with the CLI's healthcare, defense and payments presets.
- Later
Edge Protection, Penetration Test & Status Page
Serve production through a load balancer with a web application firewall, commission an independent penetration test, and publish a public status page.
- Later
SOC 2 Type II Report
We intend to undergo an independent SOC 2 Type II examination by a CPA firm. No auditor is engaged yet and the audit has not started. We track readiness with our own SOC 2 readiness tooling and will publish a timeline once the audit period is scheduled.
- Later
FedRAMP Authorization
We plan to pursue FedRAMP authorization for a government-cloud deployment of CVERiskPilot. That work has not started, and CVERiskPilot does not hold a FedRAMP authorization today. Mapping findings to FedRAMP Moderate controls is available on every plan now.
Shipped, 12 items
- Q3 2026Plan: All plans
Organization Data Export
Workspace owners can download their organization's data as a zip of JSON and CSV files, with secrets redacted.
- Q3 2026Plan: All plans
Require-MFA Policy
Workspace owners can require multi-factor authentication for every member. Members who have not enrolled are guided through authenticator-app (TOTP) setup with a QR code.
- Q3 2026Plan: All plans
Risk-Based AI Triage Routing
Triage requests are routed by risk across external AI models: routine cases go to a fast model, while high-stakes cases (such as KEV-listed findings with high EPSS) and low-confidence answers escalate to larger ones. A provider refusal is never retried or sent to another model, and every result passes the same deterministic safety policy.
- Q3 2026Plan: All plans
MCP Server & Claude Code Plugin
Connect Claude Code or another MCP client with an API key to read your findings, look up KEV and EPSS data, and record VEX dispositions with a CISA SSVC rationale. Dispositions that need approval land as pending records for a person to review; nothing is approved automatically.
- Q3 2026Plan: All plans
Redesigned Product Interface
A rebuilt product interface with a dark-first design, role-aware navigation and a command palette, applied across every product surface.
- Q2 2026Plan: Pro
Cortex AI Chat
Ask natural-language questions about your organization's findings, cases and compliance posture, answered from your own data.
- Q2 2026Plan: All plans
Horizon Developer API
API-key access to hosted AI triage for single findings and batches, usage and key endpoints, self-serve API keys in Settings, and a developer guide.
Read the developer guide - Q1 2026Plan: All plans
AI Executive Summary & Scan Comparison
Generate an AI-written executive summary of SLA performance, time to remediate and remediation trends from your live case data, and compare any two uploads to see new, resolved and unchanged findings.
- Q1 2026Plan: All plans
CI Pipeline Scanning
A GitHub Action and the @cveriskpilot/scan CLI scan dependencies, secrets and infrastructure-as-code in CI, fail the build above a severity threshold, comment on GitHub pull requests, upload SARIF to code scanning, and can send results to the Pipelines page in your workspace with an API key.
- Q1 2026Plan: All plans
Hash-Chained Audit Log
Security-relevant actions are recorded in a per-organization audit log in which each entry carries the hash of the one before it, so editing or removing an entry breaks the chain. Available on every plan; signing the chain is in progress.
- Q1 2026Plan: All plans
Billing, Roles & Onboarding
Stripe checkout, a self-serve billing portal and webhook-driven plan changes, a public pricing page, per-plan AI usage limits, role-based permission checks on authenticated API routes, a risk-exception approval workflow, guided onboarding, and Google and GitHub sign-in.
- Q1 2026Plan: All plans
Scan-to-Case Pipeline
Upload results in 11 scanner formats. Findings are enriched with NVD, EPSS and CISA KEV data, grouped into cases, and mapped through their CWE to controls in up to 13 compliance frameworks, on every plan during the alpha. Includes AI-assisted triage of individual cases and POAM generation with CSV, JSON and XLSX export.
Want to influence the roadmap?
Early users shape what we build next. Start a free workspace and tell us what you need.