Planned features

Where Umbryx goes next. This page is directional, not contractual: no dates, no promises — items may be re-ordered or dropped. Everything listed is on the public side of the editions split unless noted otherwise.

AI

You bring the model — any OpenAI-compatible endpoint, including local ones; nothing leaves your perimeter without it. The platform contributes knowledge of the engagement and of its own tools:

• Auto-generated tool cards for the connected model.
• TTP playbooks tied to MITRE ATT&CK, with operator confirmation.
• Intel packs — importing target context for the model.
• Fully airgap-capable; all AI actions attributed and audited.

Reporting & operations

• Attack-path report with MITRE ATT&CK mapping — ships together with the workstation agent.
• Bug Bounty module: programs, submissions with statuses, payouts. Available in both editions.
• Unified DNS + phishing campaign pipeline.

Integrations

• Cobalt Strike support (there is none today).
• SSO via SAML, alongside the existing OIDC.

Platform

• Update server: signed manifests, release channels, offline bundles.
• Opt-in fleet analytics — instance metrics only, documented payload, never engagement content.
• One setup command (umbryx-setup) with snapshot-based rollback.
• Workstation agent: deeper terminal coverage, project policies in the terminal, AI hints (Enterprise).
• Detection coverage against the customer's SIEM — "were we caught?" (read-only; Enterprise module).
• Observer / client portal: read-only findings for the customer.
• Plugin SDK for writing custom modules.
• More firewall/router vendors in config import.

How features get prioritized

Directly from customer engagements: whatever a paying deployment needs first moves first. If something on this page matters to your team, tell us — sales@umbryx.pro.