We've just released the initial report, so far the Future work section contains two items:
- Open call to get more data from organizations and practitioners
- Development of Damn Vulnerable Serverless Application (DVSA)
Both of those could be defined more precisely, split into more fine-grained work items and milestones.