Every feature on this roadmap started with feedback from investigators, analysts, and teams using Maltego in the field.
Below is a preview of what we’ve shipped, what we’re improving, and what’s ahead.
TAG INVESTIGATORS AND RECEIVE NOTIFICATIONS
Collaboration within the Maltego platform can be hindered by the lack of a simple way to notify colleagues about important notes or updates. Investigators may miss critical information if they are not directly alerted.
By allowing users to tag other investigators within notes, this feature will send system or email notifications to tagged colleagues. This ensures timely communication and helps teams stay aligned during investigations.
VIEW VERSION HISTORY
Have you ever deleted Entities and had to rerun a Transform to get them back? Or made a change that disrupted your graph?
With version history in graphs stored in Maltego Cases, you will be able to view and restore previous versions, so accidental changes never mean starting your investigation from scratch.
Versions will be saved automatically and cleaned up daily. To keep a specific version, simply give it a name.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
COMPANY SEARCH
When an investigation target is affiliated with a company, it can be difficult to quickly gather information about related persons, the organization’s online footprint, and other relevant data.
Company Search will provide a fast overview of directly or indirectly related persons, documents, and other interesting data on the target, such as leaked emails. This helps investigators build a comprehensive picture of the organization and its connections.
COLLECT HISTORICAL DATA
When you add a new search in Monitor today, results only appear from that moment onward, making it impossible to investigate recent past events or get the full context right away.
This update would let you instantly pull up to two weeks of past data for new searches, giving you immediate context, richer insights, and the ability to investigate what happened before you hit “search."
TRACK CHANGES WITH AUDIT LOGGING
Right now, there’s no clear way to trace who changed what in Monitor, whether it’s edits to a workflow, a deleted case, or a new search being run.
With audit logging, you’ll be able to track all key actions across building blocks, searches, and cases, showing who did it, when, and what changed. It’s your single source of truth when accountability and transparency matter.
INTEGRATE INSTAGRAM THREADS
Currently, investigators cannot access content from Instagram Threads, which limits visibility into discussions, public posts, and user interactions on this emerging platform. As Threads adoption grows, it is becoming increasingly relevant for monitoring conversations tied to persons or events of interest.
Adding Threads as a supported data source would extend crawling workflows across the Meta ecosystem, improving coverage and expanding investigative reach into conversational formats. This ensures no relevant digital trail is missed.
INSIGHTS TAB FOR CRAWLED DATA
While dashboards exist for individual target profiles, there is currently no centralized view to analyze broader patterns across crawled datasets. Investigators need a way to step back and examine connections, themes, or anomalies at a higher level—not just per profile.
The Insights Tab will provide an overview of the entire project, highlighting trends such as dominant topics, recurring hashtags, frequently mentioned accounts, posting spikes, and cross-platform activity. This helps users understand the full context of a dataset before narrowing in on individual targets.
HASHTAG-BASED SEARCH ACROSS SUPPORTED PLATFORMS
Investigators currently lack the ability to search for content using hashtags across social networks. This restricts access to relevant public content organized around specific topics, events, or movements—especially on platforms where hashtags drive visibility.
Adding hashtag-based search will help users surface thematically related posts more efficiently, uncover trends, and identify connections or behaviors tied to persons of interest. This improves both the speed and depth of digital investigations.
CUSTOMIZABLE REPORT TEMPLATES
Investigators often spend significant time manually formatting and compiling reports after completing an investigation. Without reusable templates, reporting is repetitive, inconsistent, and prone to human error.
Customizable report templates will allow users to create and reuse quick-report templates directly within the tool, predefining structure, sections, and formatting (such as executive summary, key findings, and supporting evidence). This will enable faster report generation and better standardization across teams or agencies.
STORE GRAPHS AND CASES LOCALLY
Protecting investigation data is critical to Maltego users. For some teams, storing data on Maltego-hosted servers may not be an option, even with end-to-end encryption.
Investigators will be able to choose a folder on a local hard drive and store case and graph information there only. Local storage will be supported in Chromium-based browsers due to technical browser limitations.
LOG IN WITH YOUR ENTERPRISE SSO
Many enterprise customers have asked for single sign-on (SSO) support using their existing authentication provider.
This would let your organization log in to Maltego with the same corporate identity provider and credentials you already use, reducing the number of passwords to manage, meeting your internal security requirements, and making it easier for admins to manage user access.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
CUSTOMIZE DATA EXTRACTORS
Gain more control over the data you extract from captured pages. With a customizable data extractor set, you’ll be able to detect only the data relevant to your investigations, such as email addresses, IPs, tracking IDs, or platform-specific artifacts.
Instead of relying on a fixed list, you’ll enable or disable extractors through a simple dropdown or toggle. This reduces noise, keeps your focus on relevant data, and streamlines workflows – whether you’re investigating social media activity or mapping infrastructure.
ADD FORMATTABLE NOTES
During an investigation, notes can capture background information, potential next steps, or even draft text for a final report.
A generic markdown editor in every case will make it possible to create notes that are easier to read, structure, and revisit, helping you and your team better understand the results on your graph, whether reviewing someone else’s work or returning to your own months later.
GROUP ENTITIES IN A GRAPH
As an investigation grows, you may discover that certain parts of a graph belong together, for example, multiple identifiers tied to the same person, or a range of Entities linked to the same group of actors.
Entity Groups will let you create custom groups to show these relationships without changing the underlying graph structure. The graph layout will account for groups, positioning grouped Entities closer together for easier analysis.
SEARCH TRANSFORMS IN THE RUN VIEW
Users who run Transforms through the run view in Maltego Graph (Desktop) currently have limited ways to find specific Transforms, which can slow down workflows and make it harder to manage large investigations.
This feature will enable users to search for Transforms directly within the run view, streamlining the process and making it easier to locate and execute the right Transforms for their needs.
RESIZE & MAXIMIZE WINDOWS IN MULTI-SCREEN ENVIRONMENTS
Working with Maltego Graph (Desktop) in multi-screen setups can be restrictive, as resizing and maximizing the application window is not fully supported.
This limits flexibility for users who prefer a full-screen experience on secondary monitors.
The new feature will enable resizing and maximization of Maltego Graph (Desktop) across multiple screens, allowing users to take full advantage of their workspace and improve productivity.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
CONFIGURE ACCESS TO DATA SOURCES
As an organization admin, you will be able to control which data sources your team can use in Maltego. This includes turning specific providers on or off for all users, or limiting them to defined user groups.
This functionality can help you comply with legal or regulatory requirements and ensure only the right people have access to certain data sources.
MANAGE USER ACCESS IN ONE PLACE
Maltego Admin is going to become the single place where you manage all your Maltego products. This will give you centralized control over who can access each product and what they can do with it.
You can already do this for Maltego Graph and Maltego Search. Soon, as the admin of your organization, you will also be able to manage Maltego Monitor and assign roles to your organization’s users.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
USE DARK MODE
Dark Mode will make long investigations easier on your eyes. In low-light environments or late at night, you’ll be able to switch to a darker theme that reduces glare and helps you stay focused.
All dashboard components, from case summaries to notes and data tabs, will be styled for optimal readability, with preferences saved across sessions and accessibility standards met for contrast and clarity.
VIEW TRANSFORM HISTORY
It can be difficult to understand what Transforms were used to build a graph, especially when you’re reviewing work created by a colleague or returning to an investigation after some time.
The history of Transforms will be visible to any investigator who opens a graph. You’ll be able to see which Entities were generated by each Transform run, and, if they haven’t been deleted, highlight them directly in the graph.
DISTINGUISH REGIONS AND EXACT LOCATIONS
Not all locations in an investigation are the same. Some are exact addresses, while others only refer to a municipality, city, state, or country.
This update will add region polygons to Entities that reference broader areas, making them visually distinct from exact addresses. Exact locations will be shown with a pin marking the position of the Entity, while regional Entities will not.
SAVE GRAPHS LOCALLY
Today, graphs must be stored within Maltego Cases, our secure cloud-based environment. While Maltego Cases provides encrypted, cross-device access and collaboration, some customers require the ability to store investigation data exclusively on their local machines.
This update will let investigators save graphs directly to their local devices instead of storing them in Maltego Cases. By supporting local graph files, teams with sensitive data workflows gain greater control over where their information resides, helping meet internal security or regulatory requirements while keeping access to their investigative work straightforward.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
VIEW SOCIAL MEDIA PROFILES IN ONE PLACE
Persons of interest investigations often rely on social media intelligence. While it’s possible to assemble all the information about a profile on a graph, it can be difficult to digest.
A dedicated social media profile view will aggregate all information related to a single profile and present it in an easy-to-read format, making it simpler to understand a profile at a glance.
Profile views are released for Instagram. More social networks are in progress and will follow soon.
SAVE SEARCHES USING MALTEGO CASES
Searches are currently stored only within the user’s local browser environment, making them unshareable and vulnerable to loss. If a browser cache is cleared, a device is replaced, or an investigator switches machines, all historic searches disappear. This limits collaboration and prevents consistent investigative continuity across teams.
With this update, searches can be saved in Maltego Cases, with optional end‑to‑end encryption. This ensures that historic searches are preserved, accessible across machines, and shareable with colleagues. By centralizing stored searches in Cases, investigators benefit from a more reliable, collaborative, and secure workflow.
TRACK QUOTA USAGE BY CASE
Right now, there’s no easy way to see how much quota each case consumes in Monitor, leaving teams unaware of which investigations are draining resources.
Soon, you’ll have clear visibility into quota consumption per investigation. This will help prioritize resources, prevent overages, and plan more effectively, especially when running multiple investigations in parallel.
CREATE ISOLATED WORKSPACES
Right now, Monitor doesn’t support isolated workspaces. Users see the same environment, and Admins can’t control who has access to what. This may create risk and confusion for large teams working on sensitive investigations.
Introducing workspaces with user-level access control would let Admins create separate environments for different teams, cases, or clients. This ensures cleaner collaboration, stronger security, and less accidental overlap.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
MANAGE ACCESS TO MALTEGO CASES
Maltego Cases is becoming a fully manageable product within Maltego Admin, making it easier for organizations to govern how investigations are created, accessed, and shared across teams.
As a standalone product, Cases can be assigned or restricted at the organization level, giving admins fine-grained control over who can work with cloud-based, end-to-end encrypted investigations.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
FORMAT REPORTS WITH MARKDOWN
A new Report Builder is coming with full Markdown support and flexible export options. Structure reports with familiar syntax – headings, lists, links, and more – with a live preview to see your formatting in real time. Export your reports as .md, .docx, or .pdf for easy use across tools like Obsidian, Word, or print-ready layouts.
Report structure, case data, and embedded images will remain consistent across formats, streamlining your workflow and aligning with modern documentation standards.
IMPROVE RICH SOCIAL MEDIA CAPTURING
Capturing dynamic, scroll-heavy web pages for investigations is challenging, especially on platforms like Facebook and Instagram. Existing methods often fail to preserve the full structure and fidelity of the content.
This feature introduces a new capture method makes it easier to enrich social media content for deeper investigations.
VIEW MORE INFORMATION ON ENTITIES
Some Entities contain more than just basic properties. For example, Breach Entities include details about the type of data breach the record was found in.
This feature makes that extra information visible, giving you more context to work with when reviewing Entities in your graph.
CONFIGURE COLLECTION NODES
In some cases, it’s useful to see a cleaned-up representation of a graph, while in others, it’s better to view every single Entity, for example, if an investigation contains many Entities with images.
This feature lets you control whether collection nodes are formed and set the threshold for how many Entities are needed before they are grouped. This gives you more flexibility to choose the view that best fits your investigation.
SELECT ENTITIES BY TYPE
Being able to interact with a graph in flexible ways is key to effective investigations. This new feature lets you select all Entities of a specific type, making it easy to isolate identifiers for further investigation.
For example, you can quickly copy all selected Entities to a new graph by right-clicking and choosing “Copy to new graph.”
INVESTIGATE WITH AI ASSISTANT
AI Assistant uses Large Language Models (LLMs) to support OSINT investigations by summarizing complex findings, suggesting possible next steps, and enabling creative approaches to specific investigative questions.
You remain in full control. The assistant may suggest changes, such as decluttering a graph or adding bookmarks, but it can only make changes if you confirm them. It has no access to investigation data by default. If graph access is needed to respond to a prompt, you decide whether to grant it.
AI Assistant runs on Maltego-hosted infrastructure on Microsoft Azure, with servers located in the EU or US, depending on your preference.
ADD LABELS TO BOOKMARKS
Bookmarks can be used in many ways during an investigation. For example, to flag false positives, mark Entities to investigate further, or group findings.
When an investigation is shared or revisited weeks later, it’s not always clear what a bookmark means. Does a red bookmark indicate a confirmed result, something to investigate further, or a false positive? Labels will let you add context to bookmarks and help to avoid misinterpretations.
ACCESS THE LARGEST TELEGRAM DATABASE
We are integrating TelegramDB, the largest database of Telegram profiles. It will allow investigators to look up profiles by username, even if the account has been deleted, find profiles using a Telegram ID, and see which groups a user was active in.
This integration gives investigators access to more complete and historical data, unlocking insights not available through the regular Telegram API.
FILTER RESULTS
When reviewing results, narrowing them down based on specific criteria can speed up analysis and make it easier to spot patterns.
Filters let you define almost any filtering logic, from checking if certain text values are present, to matching properties in a time range, to using regular expressions for advanced searches.
You can toggle filters on or off at any time, making it easy to see how different combinations affect the results you’re viewing.
VIEW RESULTS IN TABLE FORMAT
Maltego Search aggregates information in an easy-to-digest way, but when there are many results, such as numerous breach records for an identifier, valuable details can remain hidden in the record properties and won’t be visible right away.
The table view lets you see the property values of many results at a glance and spot patterns more easily. You can also choose which properties to display, so the table shows exactly the information you need for your investigation.
WORK WITH SPLIT VIEW
Toggle table, map, and graph views on or off to see different visualizations of the same investigation data side by side.
Selecting an Entity in the table view automatically highlights it in the graph view, making it easy to see its relationships with other Entities in your results.
CAPTURE SNAPCHAT CONTENT
Snapchat has become a go-to platform for younger audiences, but visibility into public Stories from accounts of interest remains limited for investigators.
With this integration, you’ll be able to monitor Stories from specified Snapchat accounts, supporting media-heavy investigations and reducing the risk of missing critical posts that disappear within 24 hours.
MONITOR REDDIT AND THREADS
Reddit and Threads are two of the most active public spaces online. With this integration, you are now able to monitor public Reddit posts and comments, as well as public Threads posts, giving you clearer visibility into emerging narratives, community sentiment, and fast-moving discussions that often surface on these platforms before they hit mainstream channels.
USE CREDENTIALS TO ACCESS TIKTOK DATA
You can now add TikTok crawling profiles to Evidence using a username and password. This update provides a faster and more flexible setup compared to QR-code scanning. QR-code login remains available as a fallback for added reliability.
The new login flow is more stable and makes managing multiple profiles easier. It reduces friction, improves efficiency, and gives you greater control when working with Evidence.
GET STARTED WITH EVIDENCE FASTER
Setting up Maltego Evidence requires a license file so it can run in on-premise or air-gapped environments. The process requires organization admins and users to work together, which can slow things down if it’s not clear what steps to take.
This update will guide investigators and administrators through setup immediately after signing in, helping teams start using Evidence faster.
EXPORT DATA TO GRAPH (DESKTOP)
A new export option will let you transfer data from Maltego Evidence into Maltego Graph (Desktop). You’ll be able to export selected target profiles as an .mtgx graph, including all direct connections and postings, for a structured and complete export.
This enhancement makes it easy to continue investigations in Graph with advanced analysis tools and external data sources, bridging the gap between Maltego tools to improve workflow flexibility and investigative depth.
EXPORT PROFILE PICTURES IN A SINGLE MODE
Profile pictures can help confirm identities and their connections. You can now include them in single export workflows as key media assets.
Single exports allow direct download from the Profile View. Profile pictures retain their original resolution and format, ensuring high-quality results.
This update improves consistency across exports, preserves evidentiary quality, and makes it easier to use images in case files, reports, and downstream analysis.
AUDIT CREDIT USAGE
Today, organization admins can see overall consumption of Maltego Credits, but they lack transparency into exactly how they are used. This makes it harder to understand usage patterns and ensure Credits are being spent effectively.
This update will give admins detailed auditing capabilities, showing exactly where Credits are being used across Maltego products. They’ll be able to view Transform runs and activity in Maltego Search, including the Entity input types used, providing clearer oversight, greater transparency, and insights to optimize investigations.
GENERATE LICENSES FOR HUNCHLY
Admins can now generate Maltego Hunchly license files directly in Maltego Admin through a faster, self-service process.
All you need is the Hardware UUID displayed in the Maltego Hunchly app. Enter it in Maltego Admin to generate a license file that can be used in the app.
GENERATE LICENSES FOR EVIDENCE (DESKTOP FULL) AND USB DONGLE
Maltego Admin now supports generating license files for the Maltego Evidence (Desktop Full) and for USB dongles.
Use the hardware ID shown in Maltego Evidence (for your system or USB dongle) and enter it in the license generation UI in Maltego Admin to generate the license file.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Nothing here just yet. Check other parts of the roadmap to discover features we are working on.
Get regular product newsletters
delivered straight to you inbox.
