Umami
Umami spent late 2025 patching Next.js CVEs, then shipped Boards and Session Replay in v3.1.0.
A side-by-side editorial comparison of Whatagraph and ManageEngine M365 Security Plus — release velocity, themes, recent moves, and the top alternatives to consider.
| Feature | Whatagraph | ManageEngine M365 Security Plus |
|---|---|---|
| Sector | Analytics | Analytics |
| Velocity score | 5.0 | 5.0 |
| Sparks · 30d | 0 | 0 |
| Top themes | marketing-reporting, agencies, integrations, data-storage | microsoft-365, security-auditing, on-premises, dependency-upgrades |
| Last editorial update | 2h ago | 2h ago |
| Website | — | Visit → |
Marketing reporting quietly rebuilding itself around stored data instead of live API calls.
Whatagraph builds client reports for marketing agencies by pulling from dozens of ad, analytics, and call-tracking sources. The recent releases split into two groups. One keeps widening the source catalog — Snowflake as a warehouse source, WhatConverts lead data, and Ahrefs Rank Tracker as a keyword-level integration separate from the existing domain-level Ahrefs. The other attacks reliability: a Data Storage destination that pre-syncs data so widgets stop waiting on live APIs, the Basis integration rebuilt on that model, and automatic failover when the team member whose account owns a source loses access.
An on-prem M365 auditing tool whose releases are mostly dependency hygiene.
M365 Security Plus is an on-premises Java application for auditing and alerting on Microsoft 365 activity, shipped as numbered builds a few times a year. The last two builds are typical of the pattern: 4821 upgrades the bundled JRE from Java 8 to 11 and refreshes 7-Zip and Jackson libraries, while 4820 carries the only real functional work in the window — mailbox backups to local, shared, or NAS repositories, PST splitting for large exports, bulk mailbox selection from CSV, and audit logs that show object names instead of GUIDs. Security fixes appear in nearly every build.
Whatagraph builds client reports for marketing agencies by pulling from dozens of ad, analytics, and call-tracking sources. The recent releases split into two groups. One keeps widening the source catalog — Snowflake as a warehouse source, WhatConverts lead data, and Ahrefs Rank Tracker as a keyword-level integration separate from the existing domain-level Ahrefs. The other attacks reliability: a Data Storage destination that pre-syncs data so widgets stop waiting on live APIs, the Basis integration rebuilt on that model, and automatic failover when the team member whose account owns a source loses access.
The reporting layer is being made boring in the good sense. Live-API reports break in ways an agency cannot explain to a client — a token expires, someone leaves, a widget goes blank mid-presentation — and the last few months answer each of those failure modes directly: store the data, align spend figures with the vendor's own billing totals, and silently switch to a colleague's credentials when one account stops working. The presentation work is following the same instinct, replacing per-metric threshold rules with automatic shading and consolidating scattered style settings into themes. Less configuration to maintain, fewer ways for a report to be wrong in front of a client.
Credential failover currently rescues a source when someone else on the team happens to have access; the gap it exposes is agency-owned connections that do not depend on an individual at all, which is where this thread points next.
M365 Security Plus is an on-premises Java application for auditing and alerting on Microsoft 365 activity, shipped as numbered builds a few times a year. The last two builds are typical of the pattern: 4821 upgrades the bundled JRE from Java 8 to 11 and refreshes 7-Zip and Jackson libraries, while 4820 carries the only real functional work in the window — mailbox backups to local, shared, or NAS repositories, PST splitting for large exports, bulk mailbox selection from CSV, and audit logs that show object names instead of GUIDs. Security fixes appear in nearly every build.
Two forces set the release agenda, and neither is a roadmap. The first is Microsoft: deprecated cmdlets forced an audit rewrite onto Get-MessageTraceV2, and a tenant configuration change broke onboarding until build 4817 patched around it. The second is the supply chain — Log4j, Tomcat, Bouncy Castle, Zulu JRE, and now the Java 8 to 11 jump, all tracked build by build because on-premises customers inherit whatever the vendor bundles. The product work that does land clusters around the Backup module, which is the one area growing rather than being maintained.
With the JRE finally past Java 8, Tomcat 9 is the next end-of-life dependency in the bundle, and the Backup module's steady additions suggest export and retention options continue there.
Other Analytics products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Whatagraph or ManageEngine M365 Security Plus.
Umami spent late 2025 patching Next.js CVEs, then shipped Boards and Session Replay in v3.1.0.
ADManager Plus opened to third-party identity apps in January, then shipped six months of fixes.
Five of six VictoriaMetrics entries are scraped GitHub page furniture; one is a real LTS patch.
Sigma is moving data modeling out of its own UI and into the terminal.
Steady administrative depth for M365, punctuated by a run of serious security fixes.
DuckDB in the cloud is turning into an agent's workspace, not just a query engine.
See all Whatagraph alternatives → · See all ManageEngine M365 Security Plus alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Whatagraph and ManageEngine M365 Security Plus are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Whatagraph and ManageEngine M365 Security Plus are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Analytics products to evaluate alongside.
Top Whatagraph alternatives in Analytics are ranked by recent ship velocity. Browse the "Whatagraph alternatives" section above for the current picks, or visit /alternatives/whatagraph for the full list with editorial commentary on each.
Top ManageEngine M365 Security Plus alternatives in Analytics are ranked by recent ship velocity. Browse the "ManageEngine M365 Security Plus alternatives" section above for the current picks, or visit /alternatives/manageengine-m365-security-plus for the full list with editorial commentary on each.