Enterprise Platform Roadmap

Every long-running task runs as a managed job: Discovery, Protection, Bulk Protect, Agent Upgrade, Firewall Sync, Backup, Restore, Report Generation, Connector Sync. Each job has progress tracking, retries, cancellation, logging, scheduling, history, and notifications. Admins launch a task and close the browser.

When you have 5,000 agents, “Connected / Not Connected” is useless. The operations manager’s first view every morning: 327 Agents / 318 Healthy / 5 Warning / 2 Updating / 2 Offline. Filterable by estate, region, profile, version.

State machine: Installing → Registering → Active → Updating → Maintenance → Degraded → Retired. Ghost entry prevention — retired agents purged cleanly. No stale records in the estate at 5,000-node scale.

Beyond “Connected.” Per-node: CPU, Memory, Mutation latency, Mutation failures, Heartbeat, Queue depth, Disk usage, Certificate expiry, DB health. Certificate expiry silent failures are one of the most common enterprise outage causes.

CAB (Change Advisory Board) mandate. Pause Mutation + Pause Alerts + Resume Automatically. Fields: Reason, Owner, Start, End. Without this: a kernel patch at 2 am triggers ACSE alerts across the estate, the SOC floods, and the ACSE team gets blamed. Auto-resume is scheduled through the Job Engine (#1).

Change History: Who changed what, when, why — Before/After diff, User, Timestamp, Rollback. Approval Workflow: Junior admin clicks Protect on 500 servers → Request → Pending Approval → Senior Admin → Approved → Deploy, the Deploy step running as a Job Engine (#1) job. ServiceNow integration for enterprises that already use it.

Nobody asks until disaster. Full ACSE config backup: PostgreSQL (encrypted pg_dump) + policies + SIEM config + RBAC roles + firewall credentials. Config-as-JSON import/export enables GitOps workflows. First real job type proven against the Job Engine (#1). All from the Administration panel.

SAML 2.0 and OIDC login for the admin console — Okta, Azure AD, Google Workspace, Ping Identity. Answers the question asked in the first procurement meeting: “can I log in with my corporate identity?” SCIM auto-provisioning, hardware MFA, and JIT access are the deeper security-review layer — see IAM-Full (#20).

Fine-grained, custom roles beyond the 3 fixed roles (Admin/Operator/ReadOnly). Admin-configurable AD Group → ACSE Role mapping table, two paths: claims-based (cloud AD, via the IAM-Core (#8) SSO token) and direct LDAP bind (on-prem / air-gapped AD, no cloud dependency — DRDO-compatible). AD-derived role wins when mapped; local role is the fallback when AD is absent or unmapped. Multiple mapped groups: highest-privilege wins (Admin > Operator > ReadOnly). Local override always permitted, logged to the SHA3-256 audit chain.

SOC Engineer: CPU, Latency, Mutation rate, Errors, Queue depth.
CISO/CEO: Assets Protected, Attack Attempts Blocked (from the existing AttackDefenceLog report), Compliance Coverage % and Unprotected Surface Count (from the Discovery Catalog — protected vs. discovered), Risk Reduction % (baseline definition pending).
Operations: Fleet health, version distribution, job status.
Built last in Tier 1 — needs #1, #2, #4, and the existing reporting module’s data to have anything to show.

Any operation that works on one node must work on N nodes. Bulk Protect, Bulk Policy, Bulk Upgrade, Bulk Remove, Bulk Reports. Transactional semantics: if 3 of 500 fail, what happens? Powered by the Background Job Engine (#1) with per-node results in the status panel.

Tag-based policy deployment: Apply SquidShield to all assets tagged PCI + Production. Dynamic groups auto-include newly discovered assets matching tag criteria. Tags: Finance, PCI, Production, Dev, Azure, AWS, DMZ, Critical, Database, SAP. How enterprise security platforms scale to 50,000 nodes without admin chaos.

5,000 servers on v0.3.0, v0.3.0 released. Actions: Upgrade (scheduled), Canary (1% first, watch metrics, expand), Rollback, Force Upgrade, Retry. Canary deployment is non-negotiable at enterprise scale — one bad update across 5,000 servers is a career-defining event. Ties into Agent Lifecycle (#3) and runs on the Job Engine (#1).

Severity tiers: Critical / High / Medium / Low. Lifecycle: Open → Muted → Acknowledged → Assigned → Resolved. Human-facing triage interface, separate from SIEM dispatch. SIEM gets raw events. Alert Centre is the SOC analyst workspace.

Table stakes for 24/7 SOC. Email, Microsoft Teams, Slack, Webhook, ServiceNow, Jira, PagerDuty. Configurable per alert severity and per estate. PagerDuty critical for on-call escalation. Routes Alert Centre (#14) events to where people already work.

The reporting module already generates 4 report types — Summary, EWMA Anomaly History, Attack/Defence Log, Audit Extract — as CSV/JSON on request. This adds the schedule: Daily, Weekly, Monthly, Quarterly, emailed automatically. CISO receives the Monday morning compliance summary without logging in. Low engineering effort on an engine that already works.

Create, Rotate, Expire, Revoke, Audit. Audit trail: which key, which user, which IP, when. Long-lived unrotated API keys are a common attack vector (Axios supply chain attack, 2021 — an ACSE case study subject). Automatic expiry with renewal notifications.

PostgreSQL HA streaming replication — database failover, answers the availability question for most evaluators. ~2 weeks of engineering; fits “before the second or third customer” better than a procurement conversation. Phase 3 — full multi-node Control Plane with leader election and load-balanced endpoints — is Tier 3 (#25).

The classifier itself is built (Wave 5 — 16-feature extraction, AnomalyClass Normal/Suspicious/Critical, pme/src/ml/mod.rs). What’s missing is training data: real, labelled anomaly telemetry from live estates, which only accumulates once pilot customers are running — not an engineering-readiness gate, a data-availability gate. Lands here, parallel to the second/third-customer timeline, and activates via ACSE_ML_MODEL_PATH in place of the stub classifier default.

Builds on IAM-Core (#8). SCIM 2.0 auto-provisioning and deprovisioning — employee leaves, access revoked automatically. TOTP/WebAuthn/hardware token MFA for all admin accounts. JIT (Just-In-Time) access with automatic privilege expiry. No permanent elevated privileges.

Every UI action must be API-accessible. OpenAPI spec served at /api/docs from the Control Plane — versioned, browsable, testable. Enterprise architects will not trust an undocumented API. One day of engineering. Terraform Provider for IaC. Prometheus Exporter for SRE monitoring. Webhooks for outbound callbacks.

Pre-configured policy profiles optimised for compliance frameworks: PCI-DSS, HIPAA, NIST CSF, Financial Services, Government, Defence, Cloud-Native, Kubernetes, Developer. Custom templates supported. Dramatically reduces onboarding time for regulated enterprises. Feeds the Compliance Centre (Tier 4, #26).

Search across assets, users, policies, alerts, and events in one box. Fields: Hostname, IP, Profile, User, Asset, Alert, Policy, JA3 fingerprint, Certificate. JA3 search is uniquely ACSE — no other security platform offers it. Put JA3 first in the field list, not last. Needs Alert Centre (#14) and Asset Tagging (#12) data to be worth building.

Lightweight internal model: Incident → Evidence → Timeline → Assign → Notes → Close, plus deep ServiceNow/Jira integration (#15). Enterprises with ServiceNow use it via integration. Enterprises without it use the ACSE-native view. We do not compete with ServiceNow. Needs Alert Centre (#14) and Notification Integrations (#15) in place first.

Full multi-node Control Plane with leader election and load-balanced endpoints, on top of the Phase 1 (#18) PostgreSQL replication. Avoids 3 months of distributed systems engineering by staging it here rather than attempting it in one pass.

Per-framework view: PCI-DSS, HIPAA, ISO 27001, SOC 2, NIST CSF, NIS2, DPDP (India). Each framework shows: Coverage, Gaps, Evidence. DPDP (Digital Personal Data Protection Act) is essential for Indian government and enterprise sales. Centrepiece for DRDO, CERT-In, and CISO board presentations.

Globally distributed enterprises: India, Singapore, London, US — single management dashboard. Each region has its own Control Plane for data sovereignty and low latency. Indian customer data cannot be processed in the UK — the architecture is designed for this constraint. Needs HA Control Plane Phase 3 (Tier 3, #25) first.

Discovery automatically builds a live topology: Internet → Firewall → DMZ → Load Balancer → App → VM/Server → DB → Storage. Asset dependency graph shows the blast radius of a compromise. No competitor shows this in a demo. ACSE becomes the system that understands your infrastructure, not just protects nodes in it.

Automated response workflows on alert triggers. One-click SOC actions: Isolate node, Trigger Defensive Leap, Rotate all surfaces, Pause mutation. PME-aware playbook engine — standard SOAR playbooks do not understand PME concepts. Integration path: Splunk SOAR and Palo Alto XSOAR. Dependencies (Alert Centre, Job Engine, RBAC) are all Tier 1/2 — kept here for engineering weight, a candidate to pull forward if prioritised.

One timeline for everything: 09:41 Node discovered → 09:42 Protected → 09:43 Policy changed → 09:45 Mutation anomaly → 09:46 Firewall updated → 09:47 SIEM event → 09:48 Report generated. The story of what happened to this node. SOC analysts use this during incident investigation. Makes ACSE feel complete.

Build connectors internally first: CrowdStrike (complementary, not competitive), Sentinel, ServiceNow, Jira, Splunk — extending existing Palo Alto, Cisco, Fortinet, QRadar. Open the marketplace to third-party developers when the customer base justifies it. Marketplace = developer ecosystem, not a v1 feature.