How our security tooling atlas caught an archived project before its own GitHub page said so

The Cybersecurity Landscape Atlas — a curated comparison of security tooling across 72 areas — is not a one-time content project. It is refreshed every two weeks, and the refresh's job is to find the things a vendor's own marketing page will not tell you: a rename, an acquisition, a discontinued open-source project, a broken product URL, a claim that stopped being true.

The most recent pass found that ethyca/fides, an open-source privacy-management tool listed in the atlas, had been archived on GitHub. Nobody announced this on the project's own open-source page, which still promoted it as actively maintained. It surfaced because the refresh checks the GitHub API directly ("archived": true, last push 2026-08-06) rather than trusting the page a vendor controls. This is the second archived open-source project the atlas has caught this way in two passes — the same method, not a one-off.

The entry was not deleted. It stays listed as an open-source option, because the code still exists and still works; the note now says plainly that an archived repository takes no further security patches, which is a different, more specific risk than the "steers you toward the paid tier" caveat that used to occupy that slot.

The bigger change was structural, not cosmetic

A few weeks earlier, the atlas grew from 52 areas to 72 — the governance, risk and compliance side of the map had exactly three areas before that pass, against dozens for network and endpoint security. Fourteen new GRC areas were added: policy management, risk quantification, continuous control monitoring, exception/POA&M management, board and executive reporting, and more, along with six more areas placed in the domain they actually belong to (access certification reviews under identity, business continuity under resilience, AI governance under emerging tech).

That pass also put CMDash itself in the map — in 21 of the 72 areas, the ones it actually covers — with a disclosure mechanism rather than a footnote. VendorCore.self (see packages/shared/src/landscape/types.ts) marks the entry that is our own product; it is purely presentational and carries no weight in the scoring code, so a CMDash entry is scored by exactly the same rubric as every competitor's. The atlas renders a "this product" badge on that row and a disclosure banner in the drawer before anything else, and it says where CMDash is genuinely weak — no FedRAMP or DoD authorization of its own, no auditor network, no external security-ratings integration — in the same specific terms as the corrections above.

The full history of what changed and when, area by area, is in docs/landscape-changelog.md.