The GovernSafe product roadmap
You shouldn’t need
ten portals to decide.
Cloud governance, compliance, vendor risk, endpoints and security testing belong in the same conversation. Our roadmap connects the evidence to the person who needs to act.
Explore the roadmapFrom findings to follow-through
What we’re connecting next
8 initiatives
Endpoint managementIn developmentEndpoint evidence to reviewed remediation
Bring device posture, patch gaps and hardening evidence into the administrator’s next action.
View initiative
Endpoint evidence to reviewed remediation
What this helps you do
Understand what needs attention, who uses the device and what to review before a change.
Scope & availability
GovernSafe device evidence alongside Intune context, with PowerShell generation and script analysis for admin review. Testing, approval and deployment remain administrator decisions.
Cloud governance & costIn developmentAccess and spend in the same decision
Connect licence recommendations with the account, access needs and evidence behind them.
View initiative
Access and spend in the same decision
What this helps you do
Review potential savings alongside the capabilities a person still needs to do their job.
Scope & availability
Clearer Microsoft 365 licence recommendations first: alternatives, capability checks and evidence gaps. Wider cloud coverage is part of the direction. Savings remain estimates until realised.
AI governanceIn developmentAI activity with an accountable owner
Connect observed AI and agent activity with the identities, permissions and people involved.
View initiative
AI activity with an accountable owner
What this helps you do
Investigate who owns an agent and what it can access, alongside the available device and cloud evidence.
Scope & availability
Supported Microsoft identity and audit metadata, with explicit coverage and freshness. A broader cross-provider service register and approval lifecycle remain under exploration.
Access & lifecycleNextOwner reviews that lead to a decision
Ask owners to review access, explain their decision and follow up when the review is overdue.
View initiative
Owner reviews that lead to a decision
What this helps you do
Keep the evidence and reasoning with the decision as people, permissions and resources change.
Scope & availability
Proposed first scope: SharePoint and Microsoft 365 group attestations, reminders and review history. Deeper content lifecycle and Power Platform ownership remain under exploration; access changes are a separate step.
Multi-cloud integrationsNextMore connectors. Shared context.
Extend coverage across cloud and business systems, and bring selected evidence into the tools teams already use.
View initiative
More connectors. Shared context.
What this helps you do
Carry useful context between workflows without rebuilding the same investigation in another portal.
Scope & availability
Build beyond the starting Microsoft, Google and AWS connectors. Proposed read-only API and MCP access for findings and inventory would retain workspace permissions and freshness. Connector coverage will vary.
Agentic complianceExploringPolicy gaps through to control evidence
Build on AI policy drafting and gap analysis with clearer links to control owners, evidence and follow-up.
View initiative
Policy gaps through to control evidence
What this helps you do
Help the person reviewing a policy see the operational work and evidence still needed behind it.
Scope & availability
Exploring connected policy reviews, control ownership and evidence follow-up. AI prepares drafts; owners approve them. A written policy is not proof that a control works.
Agentic TPRMExploringVendor risk through to access decisions
Extend name-and-URL vendor assessments into recurring reviews of the companies and apps a business trusts.
View initiative
Vendor risk through to access decisions
What this helps you do
Bring supplier evidence and gaps into the conversation about whether an app still needs its access.
Scope & availability
Build on existing vendor assessments beside Microsoft 365 app permissions and consent. Explore reassessment history and owner follow-up. Public evidence can contain gaps; an assessment is not a vendor certification.
Agentic pentestingExploringWeb findings through to verified fixes
Explore a tighter path from black-box web penetration testing to remediation evidence and authorised retesting.
View initiative
Web findings through to verified fixes
What this helps you do
Give teams a way to revisit a finding after a fix and understand what the new test evidence shows.
Scope & availability
Build on testing authorised targets from a URL without supplied source code. Remediation history and connected retest workflows are proposed; every test still needs an agreed target and scope.
Help shape what comes next
Where does your team
lose the context?
Show us where evidence, ownership or a decision gets lost between tools.