Where we're headed.

Each organisation tailors the risk approval workflow to its own hierarchy, choosing who approves which type of risk, at what severity, and how many approval stages each severity warrants.

Each Annex A control and each risk decision can carry its evidence, such as documents, owner attestations and freshness indicators, inside every immutable Statement of Applicability and Risk Assessment version. Auditors receive a single, self-contained evidence package per version.

Building on the standards that already run side by side in the platform (ISO/IEC 27001, ISO 9001, NIS2 and its Portuguese transposition), one control implementation will be mapped across further frameworks such as SOC 2, DORA and NIST CSF, so audit work counts once and applies to every certification target.

One search at the top of every page, opened with Ctrl K, finding records across every module. Each person finds only what they would see in the module itself. People and the glossary are already searchable; the other modules join one by one.

Every list and page shares the same toolbar, search, filters, choice of columns and buttons, so moving between modules feels the same. Users, documents, change, access, incident, risk, third-party, project and governance screens already follow it.

Organisations made up of several companies run their ISMS in one place, with people, assets, risks, documents, incidents, suppliers and accesses filtered by company and a group view across all of them.

Microsoft Entra ID and Google Workspace added as sign-in options alongside the existing email and two-factor sign-in, simplifying onboarding for organisations standardised on those identity providers.

Subscribe to lifecycle events, such as risk transitions, mitigation deadlines, exception expiry and joiner, mover and leaver changes, through signed HTTPS webhooks delivered to customer endpoints, for integration with ticketing systems, SIEMs and custom automations.

Sign-in with platform and roaming authenticators, such as Touch ID, Face ID, Windows Hello and hardware security keys, added alongside the existing multi-factor methods as an additional, phishing-resistant option.

A public REST API for the platform's main resources, documented through an OpenAPI specification, with per-organisation API keys and scopes, for building custom workflows on top of the ISMS data.

Building on the NIS2 support already in the platform, dedicated support for DORA (Regulation (EU) 2022/2554): ICT third-party risk for the financial sector, with its incident-reporting workflow and control overlays mapped onto the existing ISO/IEC 27001 foundation.

Each control's live state, with owner attestation cycles, freshness indicators and a per-control evidence repository, shown in a dedicated dashboard inside the platform.

Automated user lifecycle synchronisation from the customer's identity provider through SCIM 2.0, native Okta integration, and the ability for one organisation to sign in users from several identity providers at once (employees, contractors and partners).

Built-in support for climate-related risks within the risk assessment, capturing climate considerations as part of the broader risk picture, in line with the 2024 amendment to ISO/IEC 27001.

Two-way Slack and Microsoft Teams integrations, with notifications, approval prompts from the channel, slash commands and digest summaries, so daily ISMS work happens where teams already work.