Every feature on this roadmap started with feedback from investigators, analysts, and teams using Maltego in the field.
Below is a preview of what we’ve shipped, what we’re improving, and what’s ahead.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
COLLECT HISTORICAL DATA
When you add a new search in Monitor today, results only appear from that moment onward, making it impossible to investigate recent past events or get the full context right away.
This update would let you instantly pull up to two weeks of past data for new searches, giving you immediate context, richer insights, and the ability to investigate what happened before you hit “search.”
INTEGRATE INSTAGRAM THREADS
Currently, investigators cannot access content from Instagram Threads, which limits visibility into discussions, public posts, and user interactions on this emerging platform. As Threads adoption grows, it is becoming increasingly relevant for monitoring conversations tied to persons or events of interest.
Adding Threads as a supported data source would extend crawling workflows across the Meta ecosystem, improving coverage and expanding investigative reach into conversational formats. This ensures no relevant digital trail is missed.
STORE GRAPHS AND CASES LOCALLY
Protecting investigation data is critical to Maltego users. For some teams, storing data on Maltego-hosted servers may not be an option, even with end-to-end encryption.
Investigators will be able to choose a folder on a local hard drive and store case and graph information there only. Local storage will be supported in Chromium-based browsers due to technical browser limitations.
LOG IN WITH YOUR ENTERPRISE SSO
Many enterprise customers have asked for single sign-on (SSO) support using their existing authentication provider.
This would let your organization log in to Maltego with the same corporate identity provider and credentials you already use, reducing the number of passwords to manage, meeting your internal security requirements, and making it easier for admins to manage user access.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
CUSTOMIZE DATA EXTRACTORS
Gain more control over the data you extract from captured pages. With a customizable data extractor set, you’ll be able to detect only the data relevant to your investigations, such as email addresses, IPs, tracking IDs, or platform-specific artifacts.
Instead of relying on a fixed list, you’ll enable or disable extractors through a simple dropdown or toggle. This reduces noise, keeps your focus on relevant data, and streamlines workflows – whether you’re investigating social media activity or mapping infrastructure.
ADD FORMATTABLE NOTES
During an investigation, notes can capture background information, potential next steps, or even draft text for a final report.
A generic markdown editor in every case will make it possible to create notes that are easier to read, structure, and revisit, helping you and your team better understand the results on your graph, whether reviewing someone else’s work or returning to your own months later.
GROUP ENTITIES IN A GRAPH
As an investigation grows, you may discover that certain parts of a graph belong together, for example, multiple identifiers tied to the same person, or a range of Entities linked to the same group of actors.
Entity Groups will let you create custom groups to show these relationships without changing the underlying graph structure. The graph layout will account for groups, positioning grouped Entities closer together for easier analysis.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
TRACK QUOTA USAGE BY CASE
Right now, there’s no easy way to see how much quota each case consumes in Monitor, leaving teams unaware of which investigations are draining resources.
Soon, you’ll have clear visibility into quota consumption per investigation. This will help prioritize resources, prevent overages, and plan more effectively, especially when running multiple investigations in parallel.
CREATE ISOLATED WORKSPACES
Right now, Monitor doesn’t support isolated workspaces. Users see the same environment, and Admins can’t control who has access to what. This may create risk and confusion for large teams working on sensitive investigations.
Introducing workspaces with user-level access control would let Admins create separate environments for different teams, cases, or clients. This ensures cleaner collaboration, stronger security, and less accidental overlap.
CAPTURE SNAPCHAT CONTENT
Snapchat has become a go-to platform for younger audiences, but visibility into public Stories from accounts of interest remains limited for investigators.
With this integration, you’ll be able to monitor Stories from specified Snapchat accounts, supporting media-heavy investigations and reducing the risk of missing critical posts that disappear within 24 hours.
EXPORT PROFILE PICTURES IN BULK OR SINGLE MODE
Profile pictures can help confirm identities and their connections. Soon, you will be able to include them in both bulk and single export workflows as key media assets.
Bulk exports will automatically include profile pictures alongside other project media, while single exports will allow direct download from the Profile View. Profile pictures will retain their original resolution and format, ensuring high-quality results.
This update improves consistency across exports, preserves evidentiary quality, and makes it easier to use images in case files, reports, and downstream analysis.
CONFIGURE ACCESS TO DATA SOURCES
As an organization admin, you will be able to control which data sources your team can use in Maltego. This includes turning specific providers on or off for all users, or limiting them to defined user groups.
This functionality can help you comply with legal or regulatory requirements and ensure only the right people have access to certain data sources.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
VIEW TRANSFORM HISTORY
It can be difficult to understand what Transforms were used to build a graph, especially when you’re reviewing work created by a colleague or returning to an investigation after some time.
The history of Transforms will be visible to any investigator who opens a graph. You’ll be able to see which Entities were generated by each Transform run, and, if they haven’t been deleted, highlight them directly in the graph.
INVESTIGATE WITH AI ASSISTANT
AI Assistant uses Large Language Models (LLMs) to support OSINT investigations by summarizing complex findings, suggesting possible next steps, and enabling creative approaches to specific investigative questions.
You remain in full control. The assistant may suggest changes, such as decluttering a graph or adding bookmarks, but it can only make changes if you confirm them. It has no access to investigation data by default. If graph access is needed to respond to a prompt, you decide whether to grant it.
AI Assistant runs on Maltego-hosted infrastructure on Microsoft Azure, with servers located in the EU or US, depending on your preference.
DISTINGUISH REGIONS AND EXACT LOCATIONS
Not all locations in an investigation are the same. Some are exact addresses, while others only refer to a municipality, city, state, or country.
This update will add region polygons to Entities that reference broader areas, making them visually distinct from exact addresses. Exact locations will be shown with a pin marking the position of the Entity, while regional Entities will not.
ADD LABELS TO BOOKMARKS
Bookmarks can be used in many ways during an investigation. For example, to flag false positives, mark Entities to investigate further, or group findings.
When an investigation is shared or revisited weeks later, it’s not always clear what a bookmark means. Does a red bookmark indicate a confirmed result, something to investigate further, or a false positive? Labels will let you add context to bookmarks and help to avoid misinterpretations.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
VIEW SOCIAL MEDIA PROFILES IN ONE PLACE
Persons of interest investigations often rely on social media intelligence. While it’s possible to assemble all the information about a profile on a graph, it can be difficult to digest.
A dedicated social media profile view will aggregate all information related to a single profile and present it in an easy-to-read format, making it simpler to understand a profile at a glance.
TRACK CHANGES WITH AUDIT LOGGING
Right now, there’s no clear way to trace who changed what in Monitor, whether it’s edits to a workflow, a deleted case, or a new search being run.
With audit logging, you’ll be able to track all key actions across building blocks, searches, and cases, showing who did it, when, and what changed. It’s your single source of truth when accountability and transparency matter.
GET STARTED WITH EVIDENCE FASTER
Setting up Maltego Evidence requires a license file so it can run in on-premise or air-gapped environments. The process requires organization admins and users to work together, which can slow things down if it’s not clear what steps to take.
This update will guide investigators and administrators through setup immediately after signing in, helping teams start using Evidence faster.
EXPORT DATA TO GRAPH (DESKTOP)
A new export option will let you transfer data from Maltego Evidence into Maltego Graph (Desktop). You’ll be able to export selected target profiles as an .mtgx graph, including all direct connections and postings, for a structured and complete export.
This enhancement makes it easy to continue investigations in Graph with advanced analysis tools and external data sources, bridging the gap between Maltego tools to improve workflow flexibility and investigative depth.
AUDIT CREDIT USAGE
Today, organization admins can see overall consumption of Maltego Credits, but they lack transparency into exactly how they are used. This makes it harder to understand usage patterns and ensure Credits are being spent effectively.
This update will give admins detailed auditing capabilities, showing exactly where Credits are being used across Maltego products. They’ll be able to view Transform runs and activity in Maltego Search, including the Entity input types used, providing clearer oversight, greater transparency, and insights to optimize investigations.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
FORMAT REPORTS WITH MARKDOWN
A new Report Builder is coming with full Markdown support and flexible export options. Structure reports with familiar syntax – headings, lists, links, and more – with a live preview to see your formatting in real time. Export your reports as .md, .docx, or .pdf for easy use across tools like Obsidian, Word, or print-ready layouts.
Report structure, case data, and embedded images will remain consistent across formats, streamlining your workflow and aligning with modern documentation standards.
VIEW MORE INFORMATION ON ENTITIES
Some Entities contain more than just basic properties. For example, Breach Entities include details about the type of data breach the record was found in.
This feature makes that extra information visible, giving you more context to work with when reviewing Entities in your graph.
CONFIGURE COLLECTION NODES
In some cases, it’s useful to see a cleaned-up representation of a graph, while in others, it’s better to view every single Entity, for example, if an investigation contains many Entities with images.
This feature lets you control whether collection nodes are formed and set the threshold for how many Entities are needed before they are grouped. This gives you more flexibility to choose the view that best fits your investigation.
SELECT ENTITIES BY TYPE
Being able to interact with a graph in flexible ways is key to effective investigations. This new feature lets you select all Entities of a specific type, making it easy to isolate identifiers for further investigation.
For example, you can quickly copy all selected Entities to a new graph by right-clicking and choosing “Copy to new graph.”
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
FILTER RESULTS
When reviewing results, narrowing them down based on specific criteria can speed up analysis and make it easier to spot patterns.
Filters let you define almost any filtering logic, from checking if certain text values are present, to matching properties in a time range, to using regular expressions for advanced searches.
You can toggle filters on or off at any time, making it easy to see how different combinations affect the results you’re viewing.
VIEW RESULTS IN TABLE FORMAT
Maltego Search aggregates information in an easy-to-digest way, but when there are many results, such as numerous breach records for an identifier, valuable details can remain hidden in the record properties and won’t be visible right away.
The table view lets you see the property values of many results at a glance and spot patterns more easily. You can also choose which properties to display, so the table shows exactly the information you need for your investigation.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
USE CREDENTIALS TO ACCESS TIKTOK DATA
You can now add TikTok crawling profiles to Evidence using a username and password. This update provides a faster and more flexible setup compared to QR-code scanning. QR-code login remains available as a fallback for added reliability.
The new login flow is more stable and makes managing multiple profiles easier. It reduces friction, improves efficiency, and gives you greater control when working with Evidence.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Get regular product newsletters
delivered straight to you inbox.
