Landing Soon.Shipped. tells you what already landed. This is the companion: what's actually in progress right now, honestly staged — verified and nearly there, mid-build, or still in design. No rounding up to “coming soon.” If a date on this page slips, the next issue says so.
Edge defense, region by region
Rolling outVolumetric attacks aimed at your origin get intercepted and scrubbed at Threatmatic's own network edge — before they ever reach your bandwidth. We're standing up dedicated edge capacity across three US regions now, each with built-in redundancy, so the nearest gateway to your traffic is doing the scrubbing, not one far-away choke point.
Rate-limiting, at the endpoint and at the source
Verified · rollout pendingTwo protections working together: one blocks a connection flood aimed at a device in under 200ms, no analyst required; the other caps how much any single app on a device can send before it ever reaches a firewall. Both are built and already verified against real attack and load traffic — what's left is the last-mile wiring that pushes a rate-limit change to your whole fleet the moment you set it, the same way policy changes work today.
Nearest-region routing
In designRight now, a zone's traffic and inspected connections route through one fixed entry point, wherever that happens to be. We're designing the next step: published services and inspected traffic finding the nearest healthy regional entry point automatically — the same idea already live for gateway selection, extended to cover remote-access zones and inspection together, with true redundancy on the roadmap after that.
TrustZero: Learn, Then Enforce
In developmentThe third TrustZero posture. Point it at your fleet, let it quietly build your app catalog for a window — no manual entry — then it switches itself to enforcing only what it actually saw. The bridge between "we don't know our own app footprint yet" and "deny everything not explicitly allowed."
Smarter defense at the edge
In designEdgeGuard already stops volumetric attacks before they reach your bandwidth — pure traffic-level defense. We're designing the next layer on top: recognizing suspicious connections by what's talking, not just how much, catching automated or malicious clients before they ever reach your infrastructure. Anything you publish through Threatmatic's edge gets the deeper version of this — full inspection down to the request itself.
We could describe all of this as "coming soon" and leave it there — most vendors do. We'd rather you know which of these is tested and waiting on plumbing, which is still being built, and which is still a design on a whiteboard. That distinction is the whole point of this issue existing.— the Threatmatic team