Enrolment · fleet · policy
Enrolment tokens, fleet view, policy groups.
Roadmap
What's ready. What's next.
Sekeye is pre-launch. This page is where the timeline lives so nothing else has to hedge. The horizon beyond Next stays in the design-partner conversation.
Last updated · 2026-07-13
Working in dev Building now
MVP-ready
Working in dev today
Working in dev
Next
Closing the MVP
Building now
Drig · 9 collectors
Packages, browser + IDE extensions, MCP servers, AI agents, local models, apps, host, os-pkg-mgr. Linux measured; macOS + Windows compile-only for now.
Server-side matching
Snapshots stream to the backend. When the catalog updates, we re-match against every current inventory with no endpoint rescan.
Console
Fleet, inventory explorer, findings queue, campaign engine.
Six campaign templates
Historical incidents from Shai-Hulud 2.0 through the Hugging Face model campaign ship as one-click sweeps. Full IOC and rotation plan per brief.
Multi-source threat catalog
Public feeds — OSV, GHSA, CISA KEV, OpenSSF — plus Sekeye's curated additions. Signed bundles, four-hour freshness target at GA.
Alerting
Slack · Teams · email · webhook · Jira.
Offline licensing
Signed licence file, no phone-home required. Works in air-gap deployments.
Hardened transport
Per-endpoint identity, mutual TLS, and compact binary payloads. Replaces the interim TLS + Bearer + JSON path.
Remediation guidance
Per-finding upgrade paths + credential-rotation checklists per exposed endpoint.
GitHub App
PR-native lockfile bumps for npm / pip / gem / cargo.
Self-host + air-gap
Docker Compose for small fleets, Helm for larger. Runs disconnected from the internet with the offline licence. Same binary as SaaS.
Agent updater
Staged rollout, signed manifests, auto-rollback on failure.
Pre-pilot hardening
Stress-test the updater and fail-modes. Gates the design-partner cohort start.
MVP-ready
Working in dev today
Working in dev
Enrolment · fleet · policy
Enrolment tokens, fleet view, policy groups.
Drig · 9 collectors
Packages, browser + IDE extensions, MCP servers, AI agents, local models, apps, host, os-pkg-mgr. Linux measured; macOS + Windows compile-only for now.
Server-side matching
Snapshots stream to the backend. When the catalog updates, we re-match against every current inventory with no endpoint rescan.
Console
Fleet, inventory explorer, findings queue, campaign engine.
Six campaign templates
Historical incidents from Shai-Hulud 2.0 through the Hugging Face model campaign ship as one-click sweeps. Full IOC and rotation plan per brief.
Multi-source threat catalog
Public feeds — OSV, GHSA, CISA KEV, OpenSSF — plus Sekeye's curated additions. Signed bundles, four-hour freshness target at GA.
Alerting
Slack · Teams · email · webhook · Jira.
Offline licensing
Signed licence file, no phone-home required. Works in air-gap deployments.
Next
Closing the MVP
Building now
Hardened transport
Per-endpoint identity, mutual TLS, and compact binary payloads. Replaces the interim TLS + Bearer + JSON path.
Remediation guidance
Per-finding upgrade paths + credential-rotation checklists per exposed endpoint.
GitHub App
PR-native lockfile bumps for npm / pip / gem / cargo.
Self-host + air-gap
Docker Compose for small fleets, Helm for larger. Runs disconnected from the internet with the offline licence. Same binary as SaaS.
Agent updater
Staged rollout, signed manifests, auto-rollback on failure.
Pre-pilot hardening
Stress-test the updater and fail-modes. Gates the design-partner cohort start.
Beyond Next
Write actions, policy, explainable exposure, employee self-service.
The horizon is real and staged. We don't publish the plan here. Design partners see the sequenced backlog when the pilot starts. If you want that context now, talk to us.
Not on the roadmap
Deliberately out of scope.
Some things we're asked about but chose not to build. Either because the coverage exists elsewhere in your stack, or because the honest answer is 'not our surface.'
- ×Containers, kernel drivers, Office add-ins, network gateway pre-install blocking
- ×Code-level analysis / sandboxing / LLM verdicts on marketplace software
- ×Runtime EDR-style behavioural detection or process blocking (that's what we coexist with)
- ×"Agentless" mode. The agent is what enables self-hosted, air-gap, and offline buffering
Want a say in what ships next?
We're taking design partners. If your fleet fits the profile and you're open to a monthly feedback call, founding-partner terms are available.