Cofferdam product roadmap
What is coming to Cofferdam, and the order it will arrive in. The Cofferdam page covers the core platform. Weighing it up against NetBox? Read the honest NetBox comparison.
What is coming, in order
The roadmap runs left to right: in progress now, next, then later. Delivered items are marked in green.
Select any item for more detail.
Device config drift review
Cofferdam knows the approved baseline for every device it manages and labels any device whose running configuration has moved away from it. Restoring drifted devices to their baseline, one at a time or in bulk, takes two people: one to request the restore and a different one to approve it. Optional automatic planning goes a step further and prepares the corrective change as a queued proposal for a person to review and approve; nothing touches a device without that approval, and proposals nobody actions simply expire.
Firmware vulnerability matching
Matches the vendor, product and firmware version of your devices against published vulnerabilities and advisories, including NVD, CISA KEV and CISA's ICS advisories. Findings land on the asset record, so you can see what is exposed and where it sits. Where an advisory does not state which versions it affects, or a device's update level cannot be told, the finding is shown and marked as uncertain rather than hidden. Everything runs against the inventory Cofferdam already holds: it does not read device configuration, and nothing scans your live plant equipment. It is switched on by an administrator, with each advisory source enabled separately or imported from file on an air-gapped site.
External secrets: HashiCorp Vault
Device credentials no longer need to live in Cofferdam at all. Cofferdam reads a credential from HashiCorp Vault when it is needed, holds it in memory only briefly, and never writes it to disk or the database. It works with Vault's KV version 2 secrets engine and signs in by token or AppRole. Your vault stays the single source of truth, with its own audit and rotation policies intact. It is set up by an administrator: one Vault connection, then each credential is pointed at its path in Vault.
External secrets: CyberArk (beta)
The same arrangement for CyberArk: Cofferdam reads a credential from CyberArk when it is needed, holds it in memory only briefly, and never writes it to disk or the database. CyberArk support is in beta.
Write-back: Modbus TCP and Siemens S7 (beta)
Write-back lets an operator write values to a Siemens S7 data block or to Modbus holding registers from Cofferdam, behind a two-person approval gate: the person who approves a write must be different from the person who staged it. It is in beta and switched off until you enable it.
Write-back: DNP3, IEC 104, EtherNet/IP
The deeper control protocols follow. DNP3 and IEC 104 carry select-before-operate control semantics that demand extra care. EtherNet/IP platforms are tightly coupled to vendor tooling. These arrive after the first wave has proven the approval path end to end.
Write-back: OPC UA
OPC UA write-back is planned and has not started. Cofferdam reads OPC UA devices today; writing to them will follow the industrial targets ahead of it, behind the same two-person approval.
SOCI CIRMP and AESCSF catalogues
The SOCI CIRMP catalogue maps Cofferdam's evidence collection and traceability matrix to the Security of Critical Infrastructure risk management program. It is the deepest of the seven catalogues in Cofferdam's compliance set, and one of the two delivered so far, alongside AESCSF. The catalogues map what Cofferdam itself evidences from the data it holds; they are not a compliance programme.
IEC 62443 and NERC CIP catalogues
With SOCI CIRMP and AESCSF delivered, the same treatment moves to IEC 62443 and NERC CIP, framework by framework: each catalogue is worked end to end before it is released.
NIST SP 800-82, EU NIS2, OT configuration hardening
NIST SP 800-82, EU NIS2 and the OT (operational technology) configuration hardening catalogue complete the set, following the same path as the catalogues ahead of them.
HPE OneView integration (beta)
Connects Cofferdam to HPE OneView and pulls your HPE server and enclosure inventory into the estate automatically, matching each server by serial number, and adds power draw and temperature readings from each sync to the same asset records.
ServiceNow CMDB integration (beta)
Links Cofferdam's assets to ServiceNow configuration items, matched by serial number or hostname, and syncs in the direction you choose. Pulling from ServiceNow fills blank fields in Cofferdam without overwriting anything already there; pushing updates the linked configuration items with Cofferdam's values. It can also raise ServiceNow incidents from Cofferdam alerts.
SAP S/4HANA Asset Management integration (beta)
For estates where SAP S/4HANA is the system of record for physical assets, this integration reads the SAP Equipment Master and links it to Cofferdam's hardware inventory by serial number or name, filling in missing manufacturer, model and serial details. Data flows one way, from SAP into Cofferdam.
Jira Assets and Freshservice integrations (beta)
Both keep Cofferdam's assets in step with the service desk's asset records, and both raise a ticket when Cofferdam reports a new alert: an issue in Jira Service Management, a ticket in Freshservice. Tickets are created only. Cofferdam does not update, comment on or close them.