Where COD is heading
This page shows what is new in COD, what we are working on and what we plan to do. We clearly separate what has been released, what is in progress and what is planned. Anything in progress or planned is not a commitment.
As of November 2026
From 3.0 to today and what we plan
The timeline starts with the released versions, each with month and year. The “Today” marker shows the state of this page. Our plans follow in rough order, without dates. None of this is a commitment.
In progress
- New user interfaceIn progress, not a commitment
- Sign in with a passkeyIn progress, not a commitment
- Firewall and VPN in the new interfaceIn progress, not a commitment
Next
- Passkeepr: restoring earlier versionsPlanned, not a commitment
- Documentation and dependencies on the assetPlanned, not a commitment
- Templates and checklistsPlanned, not a commitment
- Even finer permissionsPlanned, not a commitment
Later
- Logs in one placePlanned, not a commitment
- Several installations in one viewPlanned, not a commitment
- Reverting updatesPlanned, not a commitment
Solid line: released. Dashed line: planned items without a date, not a commitment. Select a version or a planned item to jump to its details further down.
Outside COD: InfoScan add-on, on request →
Current version
COD 3.8
COD 3.8 was released on 29 October 2026 and builds on 3.7. The current version is 3.8.2 of 3 November 2026.
New in 3.8.1 and 3.8.2
- Passkeepr: import. Since 3.8.1, a Bitwarden import brings along the passkeys of the logins. Since 3.8.2, the import sorts the items into several vaults by the groups in the file on request. Large imports run in blocks of 100 items.
- Passkeepr: Keepr admins. Since 3.8.1, a Keepr admin can also make other COD admins Keepr admins. Since 3.8.2, an enterprise vault has two or more admins. Two people remove an admin together: one admin asks, a second admin or the manager account confirms. The manager account can also do it alone. At least two admins remain.
- Passkeepr: invitations, notes, sign-in field. You change the access of an open invitation under “Manage vault” until it is used. Every item has a notes field. The field type “COD sign-in” tells the extension which COD sign-in tab to fill.
- Browser extension. Since COD 3.8.2, version 3.3.2 is required. It ships with COD and is installed from Passkeepr.
- Users in the Admin Area. A new user without a password receives an invitation. “Send set-password link” works for every local account, and the link is valid once. COD writes to a local account when its password or mail address changes. “Send test e-mail” in the mail settings of the location shows the mail server's answer.
- Service logs. Admin Area > Log also shows the services, such as NAC, Backup, Passkeepr and TACACS+. You choose them under “Service”.
- Names in the Passkeepr settings. Since 3.8.2, Force enterprise vaults is called Only enterprise vaults, Migration window is called Time to move personal vaults, and Copy lifetime is called Offline copy works for.
New in 3.8.0
- Passkeepr instead of Stronghold. The vault in COD and in the browser extension is now called Passkeepr. With COD 3.8, every Passkeepr database starts empty. There is no automatic transfer from Stronghold. You enter items again or read them in through the import.
- A new extension. The Passkeepr extension is a new add-on, and older builds ask you to update. Since COD 3.8.2, version 3.3.2 is required. It ships with COD and is installed from Passkeepr. It fills and saves logins and passkeys, asks about a passkey in a window of its own, and needs Chrome 137 or later or Firefox 140 or later.
- Favourites and colours in the side menu. With a right click or Shift+F10 you add a page to your favourites, give a group or page one of eight colours, or hide it. The pencil at the bottom left starts editing the menu.
- Faster lists. Long lists in GRC, Network, Asset, NAC, Backup, Monitoring, Firewall and Report load page by page and search on the server. The dashboard counts on the server instead of loading every row.
- Admin Area with a new look. Every page uses the full width, the header with Save stays in view while you scroll, and settings sit in categories with a short hint under each label.
What has been added since 3.7.10 (3.7.11 to 3.7.13)
- Vaults of the organisation. Enterprise vaults belong to your organisation and stay when people leave. Two or more Keepr admins run each one. Archiving with a reason and offline copies, which an administrator has to allow, come with them.
- Port History with NAC sessions. The port dialog shows cards and tabs, and a new Port History tab shows the history of a port including NAC sessions. Ports refresh every 30 seconds, and terminals can be undocked.
- Evidence and standards in the GRC. Attestation by third parties, the BSI IT-Grundschutz Compendium 2023 and the BSI orientation guide on attack detection systems (in COD BSI OH SzA 1.2) are available. The organisation chart is new, with versions, units and roles in teams, and the classic view is gone.
- Shell Mode for Backup and documents by key. Backup knows Shell Mode. Documents can be found by key, also through the global search.
The features your contract covers are set out solely in the service description, in the edition that applies to your contract.
What we are working on and what we plan
The columns show the rough order, not a date. None of this is a commitment.
In progress
New user interface
We are redesigning the COD user interface. The aim is to bring all modules together in one modern design.
Sign in with a passkey
We are working on passwordless sign-in to COD with a fingerprint, face recognition or a security key. It is meant to add to today's sign-in options, not replace them.
Firewall and VPN in the new interface
We are working on bringing the “Firewall and VPN” module into the new user interface. We also plan to extend the module along the way.
Next
Passkeepr: restoring earlier versions
Passkeepr keeps every earlier version of an item. A view in which you can see and restore earlier versions does not exist yet. Until now the stored versions can only be restored through the API.
Documentation and dependencies on the asset
We plan to give the asset page a “Documents” tab that shows the related documents from GRC. We want to expand the “Dependencies” tab into a place to manage dependencies, including a graph view. InfoScan is meant to place its suggested dependencies and documentation drafts right there. An approval workflow in COD is meant to ensure that an administrator reviews every suggestion before it is adopted.
More about InfoScan →Templates and checklists
We plan to let you store recurring work, such as racking a server, as a template with individual steps. Each run would become its own numbered checklist that you check off step by step.
Even finer permissions
We plan to let you tailor roles even more closely to individual tasks.
Later
Logs in one place
We plan to bring the logs of the individual modules together, step by step, in the shared log view in the Admin Area.
Several installations in one view
If you run several COD installations, we plan to let you oversee them in one place.
Reverting updates
We plan to let you revert an update cleanly if it does not go as expected.
Earlier versions
Here are the earlier versions since 3.0, newest first. Select a version to see its details.
3.7October 2026Ubuntu package, registers, forms and audit
New since 3.7.1
- Registers for processes and suppliers. Next to assets, GRC now holds processes and suppliers, each with a change history. Links show which asset groups and suppliers depend on a process, also as a graph. For each supplier, COD works out which evidence is required, such as certificates or audits, and where it stands.
- Forms with signatures. Form templates turn into documents that defined roles fill in, sign or reject. With the last signature, COD creates a final PDF with the signature log.
- One audit log for almost everything. Admin Area → Audit shows changes, module access and a report for the yearly access review. Sign-ins and exports are recorded too. The database refuses to change entries, and every night COD seals the new entries with a signature. If you wish, the log goes to your central log system via syslog over TLS.
- KPIs per period. KPIs hold a value per month, quarter or half-year and show their trend. COD computes more values itself, such as overdue activities or the finding closure rate.
- Projects and a new GRC dashboard. Projects group activities and cases with their progress and next due date. The dashboard now shows your own GRC tasks, the top risks and the state of your documents.
- ISO/IEC 27019 and a new Admin Area. For the energy sector, ISO/IEC 27019 can be switched on, and you decide which standards your GRC shows. The Admin Area has a side menu, users sit in one table, roles and permissions on one screen.
New in 3.7.1
- Find your own tasks faster. The GRC activity list can show only your own tasks or only recurring activities. Your tasks include those assigned to you through a role or a team. The upcoming deadlines tile on the GRC dashboard shows the next five open activities, including those without a due date.
- Search and sort asset groups. You can search the asset groups in GRC and sort them by name, number of assets and role. The search in the asset overview also finds assets by the name of their group.
- Help videos in GRC. On some GRC pages, an Info button opens short help videos. The videos play directly in the browser. Marking a video as watched creates an instruction record.
- Packages for Ubuntu 22.04. COD can now also be installed on servers that cannot move to a newer Ubuntu release. The installation script sets up only what each server needs.
- Several locations on one server. When a server runs Backup, Passkeepr (until 3.7 Stronghold) or Automation for several locations, an update brings every running location up to date. When you roll out one of these modules, COD picks the right service for each location.
New in 3.7.0
- KPIs in GRC. Measure information security and quality with predefined indicators, each with a target, a tolerance and a rating. COD calculates some of the values from activities and training sessions. You enter the remaining yearly figures yourself. For the management review you freeze the year and create a PDF report.
- Training sessions and emergency exercises in GRC. Define which roles, teams or people must attend, and check off who took part. An overview compares required and actual attendance.
- More meaningful activities. Activities get a due date, a protection goal (confidentiality, integrity or availability) and an effectiveness rating. Recurring activities create their next occurrence by themselves once you complete them.
- Installation as Ubuntu packages. You install and update COD like any other Ubuntu package. Packages are available for Ubuntu 24.04 and 26.04. The initial setup runs in the browser. Before changing a database, an update takes its own backup. That covers the databases of the platform, GRC and the Backup, NAC and Passkeepr modules. The exception is the switch from Stronghold to Passkeepr with COD 3.8, where the vault starts empty. This backup does not replace your regular backups. Servers without direct internet access get the packages through a proxy. A migration guide helps you switch existing installations over.
- Module rollout from the Admin Area. Set up Automation, Backup, NAC and Passkeepr (until 3.7 Stronghold) from the Admin Area.
3.6.5August 2026Updates 3.6.1 to 3.6.5
Maintenance and feature updates 3.6.1 to 3.6.5.
- One GRC for the whole organization. Choose a home location and assign the locations it covers.
- Create tickets in your Odoo helpdesk directly from COD, with prefilled fields.
- Accounts are locked instead of deleted, with a reason and a log entry. If you wish, a nightly check against Active Directory locks accounts that are no longer authorized there.
- TACACS+ shows each user's effective access as a diagram and tests whether a command would be allowed on a device you pick.
- The catalog texts of the Statement of Applicability (SoA) can be shown in German or English and exported that way as a PDF.
3.6.0July 2026Passkeepr (until 3.7 Stronghold) and TACACS+
Two new modules and more for assets.
- Passkeepr (until 3.7 Stronghold) is a vault for passwords and secrets with end-to-end encryption, including a browser extension for Chrome and Firefox.
- TACACS+ manages users, devices, rules and logs of the TACACS+ server that comes with COD in one place. A simulator checks in advance whether a command would be allowed.
- Every asset has its own page with monitoring, placement, interfaces, contacts, contracts and dependencies.
- You maintain rooms and racks by drag and drop.
3.5July 2026Topology with firewalls
The topology shows firewalls as nodes, and GRC documents embed the live topology.
Read the article →3.4June 2026GRC for several standards
GRC manages several standards on a single data set, with cases, activities and an org chart.
Read the article →3.3May 2026Monitoring with Zabbix
The Monitoring module connects to your Zabbix, with dashboard, hosts and problems right in COD.
Read the article →3.2May 2026Firewall reachability and your own colors
Firewall reachability, a collection status for every device in the inventory, and COD in your own colors.
Read the article →3.1April 2026Information security and VPN
A management system for information security and VPN management for WireGuard, OpenVPN and IPsec.
3.0February 2026New design and certificates
A new design with dark mode, global search and certificate management with your own certificate authority.
Read the article →How to read this roadmap
Released means included in a delivered version. In progress means we are developing it. Planned means we intend to do it. The columns “Next” and “Later” only show the rough order.
This roadmap shows what we have released, what we are working on and what we plan to do. Anything in progress or planned is not a commitment. Content, order and timing may change. An item may also be dropped entirely. The service you are entitled to is defined solely by the service description in the edition that applies to your contract. You receive it with your contract. Please base purchasing and project decisions on that alone.
As of November 2026
Frequently asked questions
See the current version of COD live
In a personal walkthrough we show you what COD can do today.
Would you like to offer COD as a partner? Write to sales@extocode.com.