Landscape Atlas Changelog

What this is

The Cybersecurity Landscape Atlas (rendered at /landscape) is a curated comparison of 77 security tooling areas across 15 domains. It was authored in a single commit (ab9542d) (2026-06-28), and is kept current by periodic refreshes, each recorded below (most recent first).

Per issue #383, refreshes ran every 2 weeks from 2026-08-13; per issue #464, they now run weekly — checking the dataset for vendor renames/acquisitions, discontinued or archived open-source projects, broken product URLs, and materially wrong claims — and each pass also does a content-expansion sweep, adding genuine new vendor/tool options and re-examining "no open-source option" areas for new entrants. A cloud routine now runs this automatically every Monday at 09:13 UTC (see "How to run the next refresh" at the bottom); this file is still the human-reviewable record of what it — or a manual pass — found each time. Every public atlas surface (the atlas itself, /landscape, and each /landscape/<area> page) now also shows the last-refresh date, the next-refresh date, and a link back to this changelog, computed from the "Refresh history" line below — never hand-typed.

Refresh history: 2026-09-28 (weekly sweep, below — one renamed OSS repo (Snipe-IT) corrected, one undisclosed ownership change (Securiti/Veeam) corrected, 4 new entries across DSPM and MDR) · 2026-09-23 (R16 follow-up: CMDash's own security-ratings-outside-in row updated for R12's live composite score, Recorded Future's Mastercard ownership sourced in threat-intelligence-tip, "BitSight" → "Bitsight" casing fixed in the TPRM area) · 2026-09-23 (new domain: Reputation & External Risk, issue #717, 4 new areas, 29 new entries) · 2026-09-21 (new area: AI Agent & MCP Security, issue #702, 6 new entries) · 2026-09-21 (weekly sweep, below — one broken URL fixed, one undisclosed ownership change corrected, 2 new entries across Human Risk Management and Cloud Security) · 2026-09-14 (a quiet sweep: no archival/URL/M&A findings, 2 new entries across cyber insurance and AI governance) · 2026-09-09 (salvage of the superseded #405 draft: Ethyca Fides archived, one NAC entry added) · 2026-09-08 (immutable-backup expansion: 11 new entries in one area, MinIO reclassified) · 2026-09-02 (GRC expansion: 20 new areas, 135 new entries, CMDash added with disclosure) · 2026-08-28 (83 vendors added, 52/52 areas expanded) · 2026-08-13 (first refresh, further down this file — 20 entries corrected, no additions)

Refresh — 2026-09-28 (window: 2026-09-23 → 2026-09-28)

A five-day window. The refresh sweep found one genuine, previously-missed finding — an OSS repo rename that GitHub's own auto-redirect had been quietly masking from every prior pass's URL-liveness check — plus one undisclosed ownership change surfaced while sourcing this pass's expansion picks. No broken URLs and no in-window M&A affecting the dataset. The expansion sweep covered two areas in domains untouched by any dedicated expansion since 2026-09-02 (Data Security & Privacy, Security Operations), adding two vendors to each.

Summary counts

Job 1 — Refresh sweep

Open-source archival/rename check. All 46 unique OSS entries with a resolvable github.com URL were checked. This session's environment is more restricted than every prior pass: direct access to github.com — both the REST API (api.github.com) and the plain web UI — is blocked entirely (any curl/WebFetch request returns a 400/403/404 regardless of path), where prior passes could at least reach the rendered web UI when the API was scoped away. WebSearch was used instead for every repo, which is a weaker signal (indexed snippets, not a direct read of the archived-banner or org header) — flagging this for whoever runs the next pass, same as the api.github.com restriction was flagged in the 2026-09-14 and 2026-09-21 entries: prefer direct API/web access back if a future session has it, it's strictly more reliable than search-index corroboration.

Within that constraint: 40 of 46 repos returned no evidence of archival, rename, or deprecation. The three already-known archived projects (APIClarity, Ethyca Fides, Rebuff) and the two already-known org moves (Presidio → data-privacy-stack/presidio, NeMo Guardrails → NVIDIA-NeMo/Guardrails) were reconfirmed still correctly reflected, no edit needed. Two more were checked against a specific concern and found to already be correctly reflected: tfsec's existing con already states "being merged into Trivy — standalone tfsec is in maintenance/ transition" (confirmed still accurate — Aqua Security's own repo description now reads "Tfsec is now part of Trivy"), and Caldera's apache/caldera URL was independently re-verified (direct WebSearch for "apache/caldera" github MITRE Caldera resolves cleanly to the live Apache Incubator repo and caldera.apache.org) after a research pass raised a false alarm that the org had reverted to mitre/caldera — it has not; apache/caldera is correct and unchanged.

One genuine finding: Snipe-IT's repo moved. snipe/snipe-it was transferred to grokability/snipe-it in April 2025 (Grokability is the company behind Snipe-IT), confirmed via the company's own announcement (grokstar.dev, "We're moving from snipe/snipe-it to grokability/snipe-it"). GitHub's own permanent redirect from the old path is exactly why this was missed by five prior refresh passes' curl-based URL-liveness checks (a redirect resolves, so it never registered as broken) — only an explicit org/repo-name check catches a rename hiding behind a working redirect. The dataset's url is repointed to https://github.com/grokability/snipe-it; licensing and functionality are unaffected, so no other field changed.

URL liveness. All 486 unique non-github.com vendor URLs were curl-checked with a browser user-agent, following redirects. 430 returned a clean 200. The remaining 56 split into the same long-documented bot-mitigation bucket as every prior pass (Cisco, Akamai, Sophos, Entrust, Rubrik, Armis, Kroll, Forescout, Aruba, AttackIQ, Wallarm, Drata, Moodle, SafeBase, Sprinto, Wolters Kluwer, docs.ansible.com, servicenow.com, suricata.io, oneidentity.com, sublime.security, axonius.com, versa-networks.com, arista.com) plus a handful of genuinely new-signal codes (503, 000, 403) on URLs not in that established bucket: boringssl.googlesource.com (503 — Gerrit/googlesource rate-limiting), ordr.net/platform (000 on curl, but WebFetch succeeded fully), trellix.com/products/intrusion-prevention-system/ (000), abuseipdb.com, powerdmarc.com, bolster.ai, backblaze.com/cloud-storage, stonefly.com/backup/dr365-for-veeam/, and cisa.gov/…/cisa-tabletop-exercise-packages (all 403). Every one of these nine was individually re-checked via WebFetch and/or WebSearch and confirmed genuinely live at its current URL — none dead, none moved. No URL was broken this pass.

M&A / rename sweep. 13 targeted WebSearch queries (general roundup queries, SecurityWeek/ Infosecurity Magazine roundup checks, explicit per-day date queries across the window, and category-specific searches for SIEM/EDR/identity/GRC/MDR/backup/DSPM/reputation-tooling deals) found no deal, rename, or EOL announcement dated 2026-09-23 through 2026-09-28 involving any of the dataset's 616 (pre-this-pass) vendor names as acquirer or target. SecurityWeek's monthly M&A roundup for September 2026 has not yet been published (it runs in arrears; August's — 33 deals — is the latest available), so this window may be under-covered until that roundup lands; worth a follow-up check next pass. Several near-window deals were checked and ruled out explicitly on date: Accenture/Dragos+runZero+NetRise closed Sept 16-17 (before the window); CBTS/Recovery Point Systems (Sept 10, neither name in the dataset); eSentire/an unnamed stealth AI-security startup (Sept 15, target not a listed vendor); Cyera/Oasis Security (announced July 28, closed Sept 3 — both outside the window).

A genuine finding, not from the M&A sweep but surfaced while sourcing this pass's DSPM expansion picks: Securiti was acquired by Veeam, closed 2025-12-11 (~$1.725B, confirmed via Veeam's own press release) — nine months before this pass, meaning the existing privacy-management entry (added before the acquisition) had gone undisclosed for that long. Renamed to "Securiti (Veeam)" in both its existing privacy-management row and the new DSPM row below (same vkey: "Securiti", matching the shared-vkey convention already used for Recorded Future/Mastercard across two areas), and the privacy-management row's cons gained a line stating the acquisition and that brand/roadmap/ support are still integrating post-close.

Job 2 — Expansion: two areas, two vendors each

Per "rotate through domains, don't dump everything into one pass" — Reputation & External Risk, Emerging/Frontier (AI), Human Risk Management, Cloud Security, and GRC were all touched in the last four passes (2026-09-08 through 2026-09-23) — this pass picked the two thinnest none-verdict areas in domains untouched by any dedicated expansion since the 2026-09-02 GRC build-out:

• Data Security Posture Mgmt (DSPM) (Data Security & Privacy, 6 → 8 entries) gained Concentric AI and Securiti (Veeam). Concentric AI's semantic-AI classification needs no manual rules/regex and genuinely scans on-prem alongside cloud — a real gap next to the area's cloud-first incumbents (Wiz, Sentra, Cyera); it's a 2026 Gartner Peer Insights Customers' Choice for DSPM (315+ reviews, 4.8/5). Securiti's "Data Command Center" bundles DSPM with data-access governance, AI/LLM security and compliance automation in one platform, a materially broader scope than the point-DSPM tools already listed, and carries Gartner/GigaOm/Forrester/IDC recognition. Both product pages (concentric.ai/use-cases/data-security-posture-management/, securiti.ai/dspm/) verified 200 and read directly. Three other candidates were checked and ruled out as no longer independent: Normalyze (folded into Proofpoint DSPM), Dig Security (folded into Palo Alto Prisma Cloud, closed Dec 2023), and Polar Security (folded into IBM Guardium — not Wiz, as sometimes assumed); Symmetry Systems was skipped as mid-acquisition (Zscaler deal announced 2026-05-21, not yet closed) — too transitional to add cleanly.
• Managed Detection & Response (MDR) (Security Operations, 7 → 9 entries) gained Deepwatch and Blackpoint Cyber. Deepwatch is SIEM-agnostic (layers onto Splunk/Sentinel/Google SecOps/Securonix rather than requiring a specific EDR) with a distinct "Security Index" continuous-risk-scoring product, and is named in Gartner's 2025 MDR Market Guide. Blackpoint Cyber is the other major MSP/SMB-tier MDR player alongside the area's existing Huntress entry, but with a materially different technical approach (patented network/traffic mapping vs. Huntress's endpoint-first model) and transparent per-seat list pricing, a real axis of differentiation the area's other custom-quote-only vendors don't offer — the overlap with Huntress is stated plainly in its cons rather than hidden. Both product pages (deepwatch.com/managed-detection-response/, blackpointcyber.com/platform/managed-detection- and-response/) verified 200 and read directly. Secureworks was checked and ruled out as a duplicate — its brand has been fully absorbed into Sophos MDR/XDR post-acquisition (closed Feb 2025), which is already this area's existing "Sophos MDR" entry.

Both ossVerdicts were re-examined against current reality rather than assumed unchanged. MDR's none verdict stands as written — still fundamentally a staffed human service; Wazuh/ Velociraptor/Security Onion still only supply telemetry, not analysts. DSPM's none verdict also stands, but its note was tightened for precision: OSS building blocks exist for pieces of the pipeline (Microsoft Presidio for PII detection, OpenMetadata/DataHub for cataloging) but none combine discovery + classification + access/risk graphing + remediation the way commercial DSPM does — no genuine self-hostable DSPM entrant was found.

Flagged but not changed

• Varonis's self-hosted/on-prem support end-of-life. Surfaced as a bonus finding while researching DSPM candidates: Varonis is reported to be ending support for self-hosted/on-prem deployments 2026-12-31. This was not independently re-verified against Varonis's own communications this pass (the DSPM area's Varonis entry was out of this pass's two-area expansion scope) — flagging for a future pass to confirm at source and, if confirmed, update the existing "on-prem components" con in DSPM's Varonis row.
• September 2026 M&A roundup coverage gap. SecurityWeek's monthly roundup for September 2026 had not yet published at the time of this sweep (it runs in arrears). Worth re-running the M&A sweep once it lands, in case anything from this exact window (2026-09-23 → 2026-09-28) surfaces with a reporting lag.
• docs.ansible.com/ansible/latest/ — not re-individually-checked this pass (part of the established bot-mitigation bucket); still unresolved from four prior passes, still not repointed on search-index evidence alone.

Verification method

• Open-source archival/rename: WebSearch per repo (github.com direct access, both API and web UI, fully blocked in this session — see Job 1 for detail); the one confirmed finding (Snipe-IT) was corroborated against the vendor's own announcement post, not accepted from a single indexed snippet.
• URL liveness: curl -sL -o /dev/null -w "%{http_code}" with a browser user-agent against all 486 unique non-github.com vendor URLs, run concurrently across 8 parallel batches. Every non-200 outside the established bot-mitigation bucket was re-checked with WebFetch and/or WebSearch before being classified as live — never accepted on a bare non-200 curl response alone.
• M&A/rename sweep: 13 targeted WebSearch queries (general roundups, publisher-specific roundup checks, per-day date queries across the window, and 8 category-specific searches), cross-checked against all 616 (pre-this-pass) vendor name/vkey values.
• New-vendor grounding: Concentric AI's, Securiti's, Deepwatch's, and Blackpoint Cyber's pros/cons/ratings are drawn from their own product pages, read directly via WebFetch (all four returned 200), not from third-party blurbs; every superlative claim (Gartner Peer Insights Customers' Choice, GigaOm Leader, customer counts, pricing model) is attributed to the page it came from, and vendor-reported metrics without third-party audit are disclosed as such in the cons. All four vkeys were checked against the full 616-entry live dataset for collisions before adding (Securiti already existed under privacy-management, so its DSPM row deliberately reuses the same vkey rather than colliding under a new one, matching the Recorded Future/Mastercard precedent).
• Structural validation: node scripts/validate-landscape.mjs passes (77 areas, 620 vendor entries, 100% pros/cons, 100% ratings, 10/10 no-OSS areas carry a verdict); node scripts/build-landscape.mjs regenerated landscape.html; the landscape vitest suite (76 tests) passes unchanged — none of the four new vendors became a new area-best score (DSPM's Wiz and MDR's CrowdStrike Falcon Complete both remain each area's top vendorOptionScore), so landscape-score.golden.json needed no regeneration.

Self-assessment correction — 2026-09-23: R16 follow-up (#716, #717, ROADMAP-V120 R16)

The Expansion entry directly below flagged its own gap: R12 (the composite CMDash-own reputation score) and R13 (the /exposure overview UI) were "not live in this worktree's checkout" when the four Reputation & External Risk areas were written, so security-ratings- outside-in's CMDash self: true row described only R10's pass-through viewer. Both have since landed (the composite score and the /exposure page). This pass makes the promised follow-up.

• security-ratings-outside-in — CMDash's self row note/pros/cons rewritten: it now computes its own explainable composite score (0–100, A–F) from DNS/TLS/IP/exposure findings, with every lost point attributed to a named finding and the same evidence always reproducing the same score, and still shows the tenant's own SecurityScorecard/Bitsight rating beside it (never blended — the score's definition states external ratings are "NOT AN INPUT"). Kept honest: the con that still holds is that it rates only the tenant's own organization, not third parties — that is still TPRM's job. capability moved 2 → 3 to match dns-email-auth-posture and digital-risk-brand-protection's self rows; no other rating changed.
• digital-risk-brand-protection — re-checked against R11's live collectors and triage UI; the existing self row (from the same-day adversarial review below) was already accurate and needed no change.
• threat-intelligence-tip (existing area, untouched since 2026-06-28) — the Recorded Future row's name and note did not disclose that Mastercard has owned it since the acquisition closed in December 2024. Renamed to "Recorded Future (Mastercard)" and the note now states the ownership, matching the disclosure style already used for RiskRecon (Mastercard) in security-ratings-outside-in and for Recorded Future's own Digital Risk Protection row in digital-risk-brand-protection.
• third-party-vendor-risk-tprm (existing area) — the vendor's own casing is "Bitsight" (one word, lowercase "s"), already used correctly in the new security-ratings-outside-in area but still "BitSight" in this older area's vendor row (name, vkey) and in three other areas' prose mentioning it in passing. All five occurrences corrected; vkey unified to "Bitsight" across both areas so build-landscape.mjs's per-vendor cross-area count treats it as one vendor instead of two.

No area gained or lost a vendor entry; the summary counts (77 areas, 616 vendor entries) are unchanged. The DNS check count was also corrected in the same commit: the checks are 21 mail + 5 zone + 1 takeover = 27, not 26 (it already said 27 elsewhere, e.g. dns-email-auth-posture's CMDash row since the R14 review below — this was the one place still saying 26).

Proof: node scripts/build-landscape.mjs run twice, zero diff on both generated landscape.html copies; node scripts/validate-landscape.mjs --strict clean (77 areas, 616 vendor entries, all five completion invariants met); npm run landscape:score (check-scoring.mjs) unchanged (85 B, Reputation & External Risk); the shared refresh spec (12/12) and the portal's landscape-refresh-footer-drift, landscape-self-claims-drift, and landscape-pages-drift specs (172/172) all pass.

Expansion — 2026-09-23: Reputation & External Risk (#717, ROADMAP-V120 R14)

A new domain, Reputation & External Risk, holding four areas that answer #717's "landscape should have section for reputation sources for: businesses, IP, dns, etc.": outside-in security ratings, IP/domain reputation feeds, DNS & e-mail authentication posture, and digital-risk/brand protection. The candidate vendor list in the roadmap's plan was explicitly non-authoritative ("candidate starting list, not a finding") — every vendor kept below was re-sourced this session from its own product page or, for the open-source entries, its GitHub repository and API, never copied from the plan text.

Summary counts

The four new areas

• security-ratings-outside-in ("Security Ratings / Outside-In Risk Scoring", Reputation & External Risk) — SecurityScorecard, Bitsight, UpGuard, RiskRecon (Mastercard) and Black Kite, re-sourced from each vendor's own ratings/platform page. No open-source equivalent exists (ossVerdict: none) — internet-scale continuous scanning and a maintained scoring model aren't self-hostable. CMDash appears with self: true, honestly scoped: R10 (#716) runs the tenant's own already-configured SecurityScorecard/BitSight credential against its own verified domain — a pass-through viewer, not an independent first-party rating. R12 (the composite CMDash-own reputation score) and R13 (the /exposure reputation overview UI) are not live in this worktree's checkout (no composite score, no /exposure landing page) — the plan text for this item assumed both would land before R14 ("only after R5/R11/R12 are live"). This entry describes only what R10 actually ships today; if R12 lands later, this self row's note and cons need a follow-up pass, not a rewrite of the surrounding area.
• ip-reputation-threat-feeds ("IP & Domain Reputation Sources", Reputation & External Risk) — Spamhaus (DQS/"Blocklists via DNS Query"), AbuseIPDB, GreyNoise (Community), Cisco Talos Intelligence, VirusTotal (Google), plus open-source blocklist.de and FireHOL's blocklist-ipsets (confirmed non-archived, pushed within the last day via GitHub API). No CMDash self row — R7/R8 (#715) consume several of these exact sources (several free DNSBLs including blocklist.de, AbuseIPDB, GreyNoise Community, Shodan InternetDB) to track the tenant's own declared/derived IPs, but CMDash operates no reputation feed of its own; adding a self row here would have implied it competes with the vendors it actually resells/consumes. The relationship is explained in the area's long text instead.
• dns-email-auth-posture ("DNS & E-mail Authentication Posture", Reputation & External Risk) — Valimail, dmarcian, Red Sift OnDMARC, EasyDMARC, PowerDMARC, plus open-source checkdmarc and parsedmarc (both Apache-2.0, both confirmed actively maintained, commits within days via GitHub API; ossVerdict: has). CMDash appears with self: true — R4/R5's 27-check DNS posture engine (SPF/DKIM/DMARC/MTA-STS/TLS-RPT/BIMI/DNSSEC/CAA/takeover) is live and genuinely comprehensive, honestly scoped against what it does NOT do: no DMARC aggregate/forensic report ingestion (checkdmarc's gap too — parsedmarc's job), no staged p=reject rollout workflow, no BIMI VMC issuance.
• digital-risk-brand-protection ("Digital Risk Protection / Brand & Lookalike Monitoring", Reputation & External Risk) — ZeroFox, Recorded Future (Mastercard; its dedicated Digital Risk Protection module — same vendor already listed in threat-intelligence-tip for its broader TI platform), Netcraft, Bolster, BrandShield, plus open-source dnstwist (Apache-2.0) and Certstream (CaliDog's MIT-licensed certstream-server, with the independent certstream-server-rust reimplementation noted in its row; ossVerdict: partial — detection tooling is free, takedown/enforcement is not). CMDash appears with self: true — R11's (#716) lookalike-permutation and certificate-transparency collectors are live and now wired into R4's takeover check (wave-7 fix, 35ef12d0), honestly scoped: detection only, no takedown service, no social/dark-web/marketplace monitoring.

Cross-references added to avoid confusion with existing areas

Per the plan's instruction, none of the three existing related areas were changed (secure-web-gateway-dns-security, threat-intelligence-tip, attack-surface-management-asm); instead each new area's long text explicitly distinguishes itself from the one(s) a reader might otherwise confuse it with (e.g. dns-email-auth-posture — domain-posture grading — vs. secure-web-gateway-dns-security — protective DNS for a user's outbound traffic).

Adversarial review (same day, before merge)

An independent re-sourcing pass corrected, against each vendor's own pages: Bitsight's name, source count (100+, not 120+) and its free rating snapshot (the row had said no self-serve option); RiskRecon's monitored-company count (19M+); Spamhaus's ZEN composition (adds CSS) and removal process (XBL/CSS/PBL are self-service); AbuseIPDB's cheapest paid plan ($25/mo, not $5); VirusTotal's Google ownership and public-API limits; FireHOL's licence (none) and README wording; dmarcian, EasyDMARC ($35.99/mo annual, not ~$7) and PowerDMARC pricing; a false Red Sift con (Express has published pricing); checkdmarc and dnstwist licences (Apache-2.0, not MIT); parsedmarc's output list; Recorded Future's Mastercard ownership; Netcraft/Bolster cons the vendors' own pages contradict (both list dark-web monitoring); BrandShield's AI channel claim; and Certstream, which the first pass had described as a Rust "successor" — it is an independent reimplementation. Unsourced superlatives and comparative cons were removed. CMDash self rows: 26 → 27 DNS checks (21 mail + 5 zone + 1 takeover, counted from ALL_CHECKS), maturity 3 → 2 and ease 5 → 4 to match every existing self row, and UI-implying wording removed from the R10/R11 rows (no web UI ships for either at this commit).

Source note

All 29 vendor/tool citations (product pages, GitHub repos, and for two open-source repos a GitHub API check of pushed_at/archived) were fetched or queried this session; none reused description text from the roadmap plan's candidate list.

Expansion — 2026-09-21: AI Agent & MCP Security (#702, ROADMAP-V110 C8)

A third-party report on AI-agent security vendors (the Latio "2026 AI Security Market Report", attached to #702 and marked All Rights Reserved) named 14 vendors absent from the atlas and identified a real gap the atlas's two existing AI areas don't cover: AI Agent & MCP Security — governing and protecting the AI agents, copilots and MCP tool integrations a workforce and its developers actually run, as distinct from ai-ml-security-ai-spm (models/pipelines) and ai-governance-management (inventory/compliance). Per the roadmap's explicit instruction, this pass does not reuse any of the report's own vendor descriptions — every fact below was re-sourced directly from the vendor's own public product page, fetched this session.

Summary counts

The new area

ai-agent-endpoint-security ("AI Agent & MCP Security", Emerging / Frontier). Its long description states the boundary explicitly so a reader doesn't buy the same control three times: AI-SPM secures models/datasets/pipelines; AI governance inventories and certifies AI systems for compliance; this area protects the agents, copilots and MCP tool calls actually running on workforce and developer endpoints — discovery of sanctioned and shadow agents/MCP servers, permission/blast-radius mapping, runtime intent detection (prompt injection, tool poisoning, tool drift), and graduated enforcement (block/mask/steer/human-in-the-loop) rather than a binary allow/deny.

Five vendors from the report's absent list, plus one open-source scanner found independently

The report named AIR, Backslash, Bold Security, Datadog (AI Guard), Harmonic, Lasso, Lava, Onyx, Pluto, Zenity, Koi Security, Aikido, Pillar and Sweet as absent from the atlas. Of the roadmap's preferred five (AIR, Zenity, Pluto, Onyx, Lasso), all five had a citable, live, own-vendor product page this pass — no substitution was needed:

• Zenity — zenity.io/platform/mcp-security (200, fetched). The page describes MCP server/tool discovery, tool-level allow/block policy enforcement, and six named attack patterns (tool poisoning, tool drift/rug-pull, shadow servers, over-scoped servers, credential sprawl, data exfiltration) via an inline gateway that requires "register one gateway URL" with agents unchanged.
• Lasso Security — lasso.security/platform/ai-security (200, fetched). Describes build-time AI-BOM/posture management plus runtime proxy/gateway enforcement, a stated 3,000+ attack red-teaming library mapped to the OWASP Top 10, and self-published detection numbers (98.6% accuracy, sub-50ms classification) — disclosed in the atlas entry as vendor-published, not independently verified.
• Pluto Security — pluto.security (200, fetched). Describes an agentless workspace-security platform covering no-code AI builders (Lovable, Retool, n8n), coding agents (Cursor, GitHub Copilot) and MCP servers, with a dedicated MCP Inspector.
• Onyx Security — onyx.security/platform/ai-security (200, fetched). Describes discovery across browser AI, coding assistants, desktop agents, cloud workloads and MCP servers; five enforcement actions (alert/block/mask/steer/human-in-the-loop); and SOC 2 Type II / ISO 27001 certification with NIST AI RMF / EU AI Act mappings.
• AIR Security — air.security (200, fetched). Describes a four-layer platform (Filter/Defend/Control/Marketplace) that vets agent skills, plugins, MCP servers and sub-agents before install, after updates, and at runtime — a narrower supply-chain focus than the other four.

A sixth entry, found independently rather than assigned: researching the area's ossVerdict (every no-OSS area needs one, per the validation guard) turned up github.com/snyk/agent-scan — a real, actively maintained (pushed_at within this session), Apache-2.0, 3,000+-star open-source CLI from an established vendor (Snyk) that scans local agent/MCP/skill configurations for 14 risk categories. Confirmed via the GitHub REST API (archived: false) before adding, not assumed from the README alone. Rather than write an ossVerdict around a tool that isn't listed, it was added as the area's sixth vendor (kind: "o") — consistent with how every other Emerging/Frontier area with a genuine open-source option lists it rather than only noting it exists. Its con is stated plainly from what the README itself says: it requires a Snyk API token to run and does not accept external contributions, so it is free but not fully vendor-independent.

Datadog (AI Guard), also on the report's absent list, was deliberately not added here. Datadog's AI Guard is a runtime prompt-injection/PII-detection add-on to Datadog's broader LLM observability product, not a fleet-wide agent/MCP discovery-and-governance platform — it doesn't fit this area cleanly, and Datadog's total absence from the atlas (581 pre-existing vendor entries, zero named Datadog) is a separate, wider gap than one area can close. Flagging for a future pass rather than force-fitting it here.

CMDash is not in this area. CMDash is not an AI-agent endpoint product; no self entry was added.

Scoring-weight reasoning (Opus review)

ai-ml-security-ai-spm is P4 (PRIORITY_WEIGHT.P4 = 1, "Situational" — relevant only if you build/deploy AI models). ai-governance-management is P3 (weight = 2, "Advanced" — now time-bound under the EU AI Act for anyone placing AI systems on the EU market). This new area is set to P3 / "Advanced" (weight = 2) — the same tier as AI governance, one tier above AI-SPM — because its relevance condition is broader than AI-SPM's: AI-SPM matters only to orgs that build or deploy their own models, while AI Agent & MCP Security matters to any org whose workforce uses AI copilots, coding agents or MCP-connected tools, which is now close to universal rather than niche. It is not set to P1/P2: three vendors here (Pluto, Onyx, AIR) are pre-2026 or 2026-launch companies with no long-term track record, and the category itself is explicitly flagged in dis as having heavy overlap with the other two AI areas — a weight matching AI governance's, not exceeding it, avoids letting a single "we have AI agents" fact double-pay across two P1/P2-weighted areas when the org may reasonably start with just one of the three. Because PRIORITY_WEIGHT weights by area, not by vendor, and no vendor or vkey is shared between this area and ai-ml-security-ai-spm or ai-governance-management, an org selecting a tool in all three areas is scored on three genuinely different capabilities, not the same evidence counted three times — the double-counting risk was in the weight choice (over-crediting the same underlying "we have AI" fact), not in vendor overlap, and picking P3 rather than P1/P2 is how this pass avoided it.

Fixtures and guards updated in the same change

• node scripts/validate-landscape.mjs: structural checks pass — 73 areas, 587 vendor entries, 100% pros/cons, 100% ratings, 9/9 no-OSS areas carry a verdict.
• node scripts/build-landscape.mjs: regenerated both generated landscape.html copies (73 areas, 436 vendors, 14 domains); refresh footer unchanged at last 2026-09-21 / next 2026-09-28 (same day's refresh history entry).
• scripts/check-scoring.mjs: pinned area count 72 → 73.
• The scoring golden fixture: regenerated. Overall potential/ actual is unchanged at 80 (B) — the new area's best option (Lasso Security, vendorOptionScore 74) sits close to the Emerging/Frontier domain average. The domain's weighted score moves 71 → 72 (grade stays C) and its weight moves 4 → 6, since ai-agent-endpoint-security adds a P3 area (weight 2) to a domain that previously summed two P4s and one P3 (1+1+2=4).
• The landscape pages drift test: its pinned area-id count (toBe(72)) updated to 73 — an existing guard in the same family, not itself part of this item's owned files, but left broken by the dataset change and fixed alongside it.
• The shared landscape suite and the portal refresh-footer drift test: both pass.

Verification method

All five commercial vendor URLs and the one open-source repo URL were curl-checked (200, with a browser user-agent) and then read directly via WebFetch before any pros/cons/rating text was written — no fact in this section comes from the Latio report, from a press release, or from memory. The GitHub REST API was queried directly for snyk/agent-scan's archived status and star count rather than trusting the README's own framing.

Refresh — 2026-09-21 (window: 2026-09-14 → 2026-09-21)

A one-week window that found one genuine break and one genuinely new ownership fact, plus two sourced expansion entries. All 40 unique OSS github.com entries were re-checked directly against the live repo page — none newly archived or renamed. All 500 unique vendor URLs were curl-checked; 499 resolved to their intended page (200, or a documented bot-mitigation 403/429/000 spot-checked live via WebFetch/WebSearch), and one — 42Crunch's API Security Platform page — was a genuine 404.

Summary counts

Job 1 — Refresh sweep

Open-source archival check. All 40 unique OSS entries with a resolvable github.com URL were checked via WebFetch against the live repo page (this session's egress, like the 2026-09-14 pass before it, scopes api.github.com and direct github.com access to bgovanlu/cmdash itself, so the rendered web page was read directly rather than the REST API — see "Verification method" below). None were archived and none had been renamed/moved. The three already-known archived projects — Ethyca Fides, APIClarity, and Rebuff — remain archived and correctly reflected; no further edit needed. Presidio's "moved to a new home" banner (data-privacy-stack/presidio) is unchanged from the 2026-09-14 confirmation.

URL liveness. All 500 unique vendor URLs were curl-checked with a browser user-agent, following redirects. 410 returned a clean 200 on the first pass; the remainder split into the same two buckets as every prior refresh:

• A stable bot-mitigation bucket (Cisco, Akamai, Sophos, Entrust, Rubrik, Armis, Kroll, Forescout, Aruba, AttackIQ, Wallarm, Drata, Moodle, SafeBase, Sprinto, Wolters Kluwer, plus the ~40 github.com OSS pages) — not individually re-verified this pass beyond the spot-checks below, consistent with every prior refresh's treatment of this category.

• New-signal non-200s, each followed up individually: 10×000, 3×429, 2×202, 1×406, 1×404, 1×307. WebFetch/WebSearch confirmed every one except 42Crunch live and correctly scoped: owasp.org/www-project-amass/, three servicenow.com pages, zitadel.com/docs, suricata.io/features/, oneidentity.com/privileged-access-management/, versa-networks.com/products/unified-sase/, arista.com/…/network-detection-and-response, and axonius.com/platform were all confirmed live either by direct fetch or by independent page content matching the product named in the atlas. docs.ansible.com/ansible/latest/ is still Cloudflare rate-limiting this session's IP (429 on both the current URL and the previously-flagged /projects/ansible/latest/ candidate) — unresolved for a third pass running; still flagged, still not repointed on search-index evidence alone.

  42Crunch's /api-security-platform/ page is a genuine 404 — confirmed via curl and WebFetch alike, not a bot-mitigation false positive. The vendor's homepage (42crunch.com/) is live and shows a 2026 site reorganization around an "AI Security Platform for MCP (v2 preview)" pitch; its old API-security content has moved to 42crunch.com/api-security-testing.html, read directly and confirmed to cover the same OpenAPI-contract-audit and conformance-testing capability the atlas entry describes (200, confirmed via WebFetch). URL repointed; the entry also gained a con noting the company's new AI/MCP-centric positioning, since a buyer evaluating it purely for API security should know the vendor's public narrative has shifted.

M&A / rename sweep. WebSearch queries against "cybersecurity M&A September 2026", identity/GRC/AI-security-specific follow-ups, and a direct SecurityWeek roundup check turned up real September 2026 activity, cross-checked programmatically against all 581 vendor name/vkey fields — not by memory. Two early hits (a Check Point/Lakera "September 16" result and an F5/CalypsoAI "September 11" result) looked like fresh in-window events but, on opening the actual source articles, dated to September 2025, not 2026 — a search-ranking trap worth flagging for whoever runs the next pass; both were already correctly reflected from prior refreshes and needed no further edit. Named deals this pass actually found (Brinqa/PlexTrac, 1Password/Apono, Snowflake/Natoma, Cisco/Astrix, SailPoint/Entro, CrowdStrike/SGNL, Check Point/Cyata·Cyclops·Rotate) were checked against the full vendor list — none of the acquirers or targets is a dataset vendor. Veza's already-recorded ServiceNow acquisition and Mandiant's already-recorded Google ownership needed no update. Dragos/Accenture — re-checked directly against Dragos's own blog post — is still pending regulatory close; left as written for the fourth pass running.

A genuine finding, not from the M&A sweep but from re-reading Promptfoo's own repo page: Promptfoo was acquired by OpenAI, announced 2026-03-09 (OpenAI's own announcement, SecurityWeek, and Promptfoo's own blog post all confirm it) — five months before the 2026-08-28 refresh added Promptfoo to the atlas, meaning the addition missed a fact that was already public at the time. github.com/promptfoo/promptfoo itself now carries a banner: "Promptfoo is now part of OpenAI. Promptfoo remains open source and MIT licensed" — confirmed directly, not assumed from the press. kind stays "o" (correctly — the license didn't change), but the entry gained a con: a red-teaming/eval tool used to judge competing LLM providers being owned by one of them is a fact a multi-vendor evaluation should weigh, even though the tooling itself is unaffected.

Job 2 — Expansion: two areas, one vendor each

Per "rotate through domains" — Network Security (NAC), Incident Response (backup targets), and Governance/Emerging (cyber insurance, AI governance) were the last three passes' domains — this pass picked two thin areas in domains not touched recently:

• Training, Competence & Attestation Records (Human Risk Management, 5 → 6 entries) gained MetaCompliance, which bundles awareness training, phishing simulation, and policy/privacy (GDPR/CCPA) compliance management with logged acknowledgements into one audit trail — a real gap next to KnowBe4/Hoxhunt (training-only) and ISMS.online (records-only, no delivery). Its con is stated plainly from what its own page does not claim: no explicit mapping from a policy or training module to a specific framework clause the way ISMS.online demonstrates for ISO 27001 clause 7.2. Solutions page (metacompliance.com/solutions/compliance-management) verified 200 and read directly.
• CASB (Cloud Security, 6 → 7 entries) gained iboss CASB, a signatureless shadow-IT/shadow-AI CASB bundled into iboss's Zero Trust SASE platform — notable for explicit GenAI/shadow-AI discovery and prompt/upload DLP, which none of the area's existing six entries call out directly. Con stated from what the page itself doesn't offer: no API-based/at-rest scanning mode, unlike Skyhigh's and Forcepoint's multimode approach. Product page (iboss.com/casb) verified 200 and read directly; a marketing-campaign URL (www2-a89asdfddd.iboss.com/casb) surfaced in search results and was deliberately not used as the canonical link.

Both ossVerdicts were re-examined against current reality rather than assumed unchanged: no credible self-hostable CASB project was found (the area's none verdict stands — CASB's dependency on a global proxy fabric and vendor SaaS API integrations remains a structural barrier to a genuine OSS equivalent), and no new "record layer" OSS tool that maps training to a framework control surfaced beyond Moodle, so Training/Competence's has verdict (via Moodle) stands as written too.

Flagged but not changed

• docs.ansible.com/ansible/latest/ — still Cloudflare rate-limiting this session's IP (429), on both the current URL and the previously-flagged /projects/ansible/latest/ candidate. Three passes running without independent confirmation; still not repointed on search-index evidence alone. Worth trying from a genuinely different IP/session.
• Dragos / Accenture — the majority-stake deal is still pending regulatory close per Dragos's own blog post (no specific close date stated). Unchanged from the last three passes.

Verification method

• Open-source archival: WebFetch against each repo's github.com page for all 40 unique OSS entries with a resolvable GitHub URL — reading the archived banner, org name, and activity indicators directly off the rendered page, for the same egress-scoping reason as the 2026-09-14 pass (flagging again: prefer the GitHub REST API back if a future session has broader access — it surfaces pushed_at staleness the web UI doesn't always expose cleanly).
• URL liveness: curl -sL -o /dev/null -w "%{http_code}" with a browser user-agent against all 500 unique vendor URLs, run concurrently. Every non-200 was re-checked with WebFetch and/or WebSearch before being classified as either "confirmed live" or "genuinely broken" — never accepted on a bare non-200 curl response alone, and the one URL that was repointed (42Crunch) was only committed after its replacement independently returned 200 and its content was read and matched against the entry's own description.
• M&A/rename sweep: WebSearch for "cybersecurity M&A September 2026" and targeted identity/GRC/AI-security follow-ups, cross-checked programmatically against all 581 vendor name/vkey values in the live dataset — including verifying the actual publication date of two results that initially looked in-window but turned out to be dated a year earlier.
• New-vendor grounding: MetaCompliance's and iboss's pros/cons/ratings are drawn from their own product pages, read directly via WebFetch, not from third-party blurbs or search snippets; where a page didn't state something (iboss's pricing and at-rest scanning mode, MetaCompliance's framework-mapping depth and leaver/contractor handling), that gap is disclosed as a con rather than filled in from an unverified secondary source.
• Structural validation: node scripts/validate-landscape.mjs passes; node scripts/build-landscape.mjs regenerated landscape.html; the landscape vitest suite passes.

Refresh — 2026-09-14 (window: 2026-09-09 → 2026-09-14)

A quiet five-day window: the refresh sweep found nothing to correct — no newly archived open-source projects, no dead vendor URLs, and no in-window M&A affecting a dataset vendor. The expansion sweep this pass covered two GRC/Emerging-Frontier areas that were still thin after the 2026-09-02 GRC build-out, adding one sourced vendor to each.

Summary counts

Job 1 — Refresh sweep: nothing broken, nothing new

Open-source archival check. All 40 unique OSS entries with a resolvable github.com URL were checked via WebFetch against the live GitHub page (api.github.com is not reachable from this session for repos outside bgovanlu/cmdash — see "Verification method" below for why this pass used the web UI instead of the REST API). None were archived and none had moved to a new org/repo name. The two open-source projects already known to be archived from prior passes — Ethyca Fides (privacy-management) and APIClarity / Rebuff (from the 2026-08-13 refresh) — remain archived, correctly reflected in the dataset already, and needed no further edit. One repo relocation surfaced but required no change: Presidio now lives at github.com/data-privacy-stack/presidio (moved from microsoft/presidio, per the repo's own "Presidio is moving to a new home" banner) — the dataset's url already points at the new data-privacy-stack org, so this is confirmation, not a correction.

URL liveness. All 498 unique vendor URLs in the dataset were curl-checked with a browser user-agent, following redirects. 411 returned a clean 200. The remainder split into two buckets, both resolved without an edit:

• 73×403 and 1×406 — the same long-standing bot-mitigation pattern documented in every prior refresh (Cisco, Akamai, Sophos, Entrust, Rubrik, Armis, Kroll, Forescout, Aruba, AttackIQ, Wallarm, and the ~40 github.com OSS pages among others) plus five vendor domains first flagged 2026-09-08 (Drata, Moodle, SafeBase, Sprinto, Wolters Kluwer). None were individually re-verified beyond the spot-checks below; this is a stable, previously-documented category, not a new finding.
• 8×000 (connection failure), 3×429 (rate-limited), 2×202, 1×406 — genuinely new signals this pass, so each was followed up with WebFetch and/or WebSearch rather than accepted at face value. Every one resolved to a live, correctly-scoped page: frenos.io/platform, three servicenow.com pages, and sophos.com/products/managed-detection-and-response all confirmed live via WebFetch (the curl failures were transient or bot-mitigation, not real); jfrog.com/xray/ and oneidentity.com/privileged-access-management/ returned empty/challenge responses to both curl and WebFetch but are confirmed live and correctly indexed via WebSearch corroboration; docs.ansible.com/ansible/latest/ is a Cloudflare rate-limit challenge (confirmed via response headers: cf-mitigated: challenge), not a dead page — search indexing confirms Ansible's docs have since been restructured under /projects/ansible/latest/, but per the "an unverified-but-plausible edit is worse than a stale entry" rule the URL was not repointed on search-index evidence alone; and sublime.security/product/defend/ and axonius.com/platform both confirmed live on retry. No URL was changed this pass.

M&A / rename sweep. WebSearch queries against "cybersecurity M&A September 2026", SecurityWeek's monthly roundup, and targeted GRC/AI-security/identity queries turned up real September 2026 activity (Permira/BioCatch, Absolute Security/Syxsense, Kiteworks/123FormBuilder) but none of the acquirers, targets, or renamed vendors matched a name in the dataset — checked programmatically against all 579 vendor name/vkey fields, not by memory.

Job 2 — Expansion: two areas, one vendor each

Per the "rotate through domains, don't dump everything into one pass" guidance — Network Security (NAC) and Incident Response (backup targets) were expanded in the two prior passes — this pass picked two still-thin Governance/Emerging areas left over from the 2026-09-02 GRC build-out:

• Cyber Insurance & Risk Transfer (5 → 6 entries) gained Cowbell, an SMB/middle-market cyber insurer built around continuous underwriting (Cowbell Factors — 1,000+ signals across eight risk dimensions, repricing through the policy term rather than only at renewal). It fills a real gap: the four existing insurer/MGA entries (Coalition, At-Bay, Resilience, Corvus) all skew toward larger accounts. Rated below Coalition/At-Bay on capability (3 vs. 4-5) to reflect the narrower SMB/middle-market scope, but ease: 5 for the sub-5-minute API-driven quoting. Product page (cowbell.insure/cowbell-factors/) verified 200 and read directly; no claim taken from a third party.
• AI Governance & Management Systems (6 → 7 entries) gained ModelOp, an AI system-of-record / governance-orchestration platform (unified ML/GenAI/agentic/vendor-AI inventory, policy enforcement at delivery time, evidence pre-mapped to SR 11-7/EU AI Act/NIST AI RMF/ISO 42001). Its con is stated plainly from what the product page itself scopes it as: an orchestration and evidence layer that reports on metrics from an existing MLOps/LLMOps toolchain rather than a standalone bias-testing engine. Product page (modelop.com/ai-governance) verified 200.

Both ossVerdicts were re-examined against current reality rather than assumed unchanged — neither new vendor is open source, and no new genuine OSS entrant was found in either area, so both verdicts (none for cyber insurance, partial for AI governance) stand as written.

Flagged but not changed

• Dragos / Accenture. The majority-stake deal (announced 2026-06-18, ~$4.175B combined with runZero/NetRise) was targeted to close "August or September 2026." A search result headline claimed the deal had "closed," but the linked article and Accenture's own newsroom page both still carry only the original June pending-close language with no confirmed closing date — per the "don't repoint/re-rate on an unverified claim" rule, the entry's existing "deal not yet closed" con was left as written rather than updated on a headline that didn't survive a direct read of its own source.
• docs.ansible.com/ansible/latest/ — Cloudflare-challenged to automated clients; search indexing suggests the canonical doc path has moved to /projects/ansible/latest/, but this wasn't independently confirmed by opening the page, so the URL is unchanged. Worth a follow-up with a fresh IP/session.

Verification method

• Open-source archival: WebFetch against each repo's github.com page (not the REST API) for all 40 unique OSS entries with a resolvable GitHub URL — reading the archived banner, org name, and activity indicators directly off the rendered page. This session's egress policy scopes api.github.com access to the bgovanlu/cmdash repository itself, so the REST-API method used by every prior refresh (GET /repos/{owner}/{repo} for archived/pushed_at) is not reachable here for external repos; the GitHub web UI carries the same archived-banner signal and was used instead. Flagging this for whoever runs the next pass: if a future session does have broader GitHub API access, prefer it back — it also surfaces pushed_at staleness that the web UI's rendered content doesn't always expose cleanly.
• URL liveness: curl -sL -o /dev/null -w "%{http_code}" with a browser user-agent against all 498 unique vendor URLs, run concurrently. Anything other than a clean 200 was re-checked with WebFetch and, where still ambiguous, WebSearch corroboration — never accepted on a bare non-200 curl response alone, and never repointed without opening the replacement URL.
• M&A/rename sweep: WebSearch for "cybersecurity M&A September 2026" and SecurityWeek's roundup cadence, cross-checked programmatically against all 579 vendor name/vkey values in the live dataset.
• New-vendor grounding: Cowbell's and ModelOp's pros/cons/ratings are drawn from their own product pages, read directly via WebFetch, not from third-party blurbs or search snippets; where a page didn't state something (e.g., Cowbell's reinsurance backing, ModelOp's pricing), that gap is disclosed as a con rather than filled in from an unverified secondary source.
• Structural validation: node scripts/validate-landscape.mjs passes (72 areas, 579 vendor entries, 100% pros/cons, 100% ratings, 9/9 no-OSS areas carry a verdict); node scripts/build-landscape.mjs regenerated landscape.html; the landscape vitest suite (76 tests) passes unchanged — neither new vendor became a new area-best score, so landscape-score.golden.json needed no regeneration.

Salvage — 2026-09-09: closing the stale #405 draft

The biweekly automation opened PR #405 as a draft on 2026-09-01 and it sat there while three later landscape commits landed. By the time it was reviewed it was 243 commits behind main and carried 52 areas against main's 72 — areas.json is rewritten wholesale by each pass, so merging that branch would have silently deleted the entire 2026-09-02 GRC expansion. It was closed rather than merged, and the two findings that were still true were re-verified and applied directly to current main instead.

Ethyca Fides is archived. github.com/ethyca/fides returns "archived": true from the GitHub API (checked 2026-09-09; last push 2026-08-06). The entry is kind: "o" and stays that way — unlike MinIO last pass, Ethyca has not relicensed or withdrawn the code — but an archived repository takes no further security patches, which is a different risk from the "steers you toward the paid tier" con that occupied that slot. The note and that con now say so. This is the second archived open-source project the atlas has caught in two passes; both were found by asking the GitHub API rather than by reading the vendor's own open-source page, which in both cases still promoted the project.

ThreatLocker Network Control added to Network Access Control (NAC) (6 → 7 entries), the one genuinely new option in the draft. Agent-based ZTNA rather than switch-fabric NAC, which is what its cons lead with — it does not do the agentless IoT/OT profiling Cisco ISE, ClearPass and Forescout are bought for, so it is an alternative to them only for part of the area. Product URL HTTP-checked 200 before commit, per the rule from the 2026-09-02 pass.

Two of the draft's changes were rejected. Its AuditBoard addition to GRC Platform is stale: a later refresh had already renamed that vendor to "Optro (formerly AuditBoard)" across all three areas it appears in, so taking the draft's version would have reverted a correction. And the draft's ThreatLocker pros cited a PeerSpot satisfaction score of 9.4 — a point-in-time third-party number that cannot be re-checked from the vendor page the entry links to, so it was dropped and the two verifiable pros kept.

Scores. No existing rating moved. The new NAC entry rates capability: 3 against Cisco ISE and Forescout at the top of that area, so areaBestScore — a max — is unchanged and the golden fixture needed no regeneration; the shared scoring suite passes 551/551 unchanged.

Expansion — 2026-09-08: immutable backup targets (#446)

Backup & Ransomware Recovery carried ten entries and every one of them was backup software. The area's whole subject — immutability — lives in the storage layer that software writes to, and the atlas had no storage targets in it at all. Eleven entries added (565 → 576), the area's long rewritten around the software/target split and the governance-vs-compliance retention modes, and an ossVerdict added.

Storage targets, all new: MinIO, Object First Ootbi, ExaGrid, StoneFly DR365, Scality ARTESCA, Wasabi, Backblaze B2, AWS S3 Object Lock, Azure Immutable Blob Storage. Backup software, new: Bareos (inserted next to Bacula, which it forks) and Amanda Community. Every new entry's note opens by saying which of the two it is, because a datasheet rarely does.

⚠ MinIO is no longer open source, and the correction matters more than the addition. The research note this pass worked from lists MinIO as "the most popular open-source option for building an immutable storage target… licensed under AGPL". That is now wrong at source: the minio/minio repository is archived (GitHub API: "archived": true, last push 2026-04-24), its README opens with "THIS REPOSITORY IS NO LONGER MAINTAINED", the community edition had already gone source-only with the embedded console deprecated, and min.io today does not contain the strings "open source", "AGPL" or "community" anywhere on its homepage — it sells the commercial AIStor line. MinIO is therefore filed as kind: "c", not "o", with the archival stated in its cons. The ossVerdict records the consequence for the area: open source still covers the backup-software half (Bacula, Bareos, Restic, Borg) and no longer covers the immutable-target half.

Two other claims from the same note did not survive contact with the vendors' own pages:

• ExaGrid's Retention Time-Lock is not S3 Object Lock and not WORM. It is a delayed delete — configurable 0-30 days, 10 by default — over a non-network-facing repository tier, and ExaGrid says plainly it chose not to make retention permanent because the storage cost would be unmanageable. Listing it beside Object Lock products without that distinction would have implied a guarantee it does not make, so the con says so and the area's dis warns that "immutable" in a datasheet may mean a 30-day delayed delete.
• StoneFly's DR365 line is Veeam-first, not Veeam-only (DR365H targets HYCU, DR365R Rubrik, DR365U is universal), and the DR365V is sold as a "data centre in a box" that can host the Veeam server itself rather than being a pure target. Its page asserts "S3 object lockdown" without ever naming a retention mode, which is recorded as a con.

Zmanda Pro was deliberately NOT added. It is a real product and it belongs in this area, but zmanda.com returns HTTP 403 to every automated client — curl with a browser user agent, a fetch tool, and a text-extraction proxy alike — on /, /immutable-backup-solutions/, /air-gap-backup-solution/ and every other path tried, so a status code proves nothing about which paths exist and no claim on the site could be read at source. The atlas's rule since the 2026-09-02 pass is that every URL is HTTP-checked before commit (five were wrong that pass); inventing a deep link from a search-engine snippet would break it. wiki.zmanda.com does serve (200) and is the Amanda community wiki — it is what confirmed Amanda's last community release, 3.5.4, August 2023, roughly three years of silence, which is why Amanda Community is rated maturity: 2 and its cons lead with stagnation. Add Zmanda Pro when someone can open the page in a browser and cite it.

Scores. No existing entry's rating moved and the golden fixture needed no regeneration: Veeam's 91 was and remains the area's best option, and areaBestScore is a max, so eleven additions below it change nothing downstream. The new ratings sit deliberately under the platforms — a storage target covers part of an area, not all of it, so capability is 2 for the pure cloud buckets and 3 for the appliances and MinIO, against 4-5 for Veeam, Rubrik, Commvault and Druva. ease is high for the clouds (5) and Ootbi (5, its whole pitch is that no Linux expertise is needed) and low for the self-managed open-source stack (2). maturity is 5 only for AWS and Azure. Amanda Community lands lowest in the area at 2/2/4/2, which is the honest reading of a project with no immutability story and no release since 2023.

Self-assessment corrections — 2026-09-03

Three cons CMDash had published about itself were checked against the v5.9.0 tree while planning ROADMAP-COMPETITIVE.md and did not survive. A self-assessment that understates the product is as wrong as one that flatters it — it sends the roadmap after work already done — so they are corrected here rather than left standing.

No rating moved. Each con was replaced by the real remaining limitation, keeping the con count at five per area, so vendorOptionScore is unchanged and the golden fixture needed no regeneration.

Security Program Management & Maturity — the con claimed "no C2M2, and no arbitrary custom maturity model". Both ship: a shipped content pack carries DOE C2M2 v2.1 (10 domains, MIL0–MIL3) and the maturity builder is a full custom-model builder — validate, create, replace, export as a content pack, crosswalk suggestions. Replaced with the limitation that actually holds: a custom model must be authored as a structured content pack, so adopting an unshipped published model is data entry rather than an import. A second con was re-pointed at the honest caveat the C2M2 pack itself documents — where a publisher issues no official crosswalk, the mapping is authored by domain proximity.

Third-Party / Vendor Risk (TPRM) — the con claimed "no external security ratings or continuous outside-in monitoring — nothing equivalent to SecurityScorecard, BitSight or UpGuard's scanning". The SecurityScorecard and BitSight adapters in the vendor-monitoring providers are real and wired: SSRF-safe fetch, bounded retry, typed errors, driven by a daily cron.

⚠ The reason that con read as true is worth recording. Both adapters gated on platform-level SECURITYSCORECARD_API_KEY / BITSIGHT_API_KEY, and neither variable appeared in deploy/compose/docker-compose.yml's environment: allowlist, in deploy/onprem/preflight.sh, or in scripts/ops/stage-host-config.sh. The capability could not run in production on any deployment. This correction was deliberately held until the code landed (roadmap item 3.5: the env vars are now forwarded, and a tenant can store its own encrypted key, which takes precedence). Correcting the prose first would have been exactly the drift the self disclosure flag exists to prevent. The con now states the limitation that remains: ratings are a pass-through against your own subscription, with no first-party scanning.

Expansion — 2026-09-02: the governance, risk and compliance half of the map

The atlas was built by a security-engineering eye and it showed: 52 areas, of which exactly three covered governance, risk and compliance. A reader could compare nine next-gen firewalls and had nowhere to look for policy management, cyber risk quantification, internal audit, continuous control monitoring, access certification, AI governance or CMMC tooling. This pass closes that gap, and — with an explicit disclosure mechanism — places CMDash itself in the areas it actually covers.

Summary counts

The 20 new areas

Governance, Risk & Compliance (3 → 17). Ordered by build priority, not alphabetically: it-asset-software-inventory (the domain's only P1 — CIS Controls 1 and 2, and the area every other area in the map silently assumed existed), security-program-maturity, policy-management, risk-quantification-crq, control-framework-mapping, continuous-control-monitoring, exception-poam-management, customer-assurance-trust-center, board-executive-reporting (all P2), then internal-audit-management, regulatory-change-management, defense-federal-compliance, vciso-msp-grc-delivery, cyber-insurance-risk-transfer (P3).

Elsewhere, six areas were placed in the domain they genuinely belong to rather than swept into GRC: access-certification-reviews (Identity & Access — distinct from IGA, and the control most often failed on evidence rather than intent), data-governance-records-retention (Data Security & Privacy), business-continuity-dr-management and crisis-simulation-tabletop (Incident Response & Resilience), compliance-training-records (Human Risk Management — the competence/records layer, deliberately separate from phishing simulation), and ai-governance-management (Emerging / Frontier — governance, not AI-SPM, which already exists as ai-ml-security-ai-spm).

CMDash is in the map, and says so

CMDash appears in 21 of the 72 areas — the ones it actually covers. Because a product grading itself inside its own comparison tool is an obvious conflict of interest, this pass adds a mechanism rather than a footnote:

• VendorCore.self?: boolean marks the product this application is. It is purely presentational and carries no weight in scoring.ts — a CMDash entry is scored by the same vendorOptionScore rubric as everything else.
• The atlas renders a THIS PRODUCT badge on the vendor row and a Disclosure banner at the top of the vendor drawer, before the note and before the strengths.
• /readiness, where a user picks the tool they use per area and the choice feeds their own score, appends — this product to the option label.

The watch-outs are written to be usable, not defensive. Where CMDash is genuinely weak the entry says so in specifics: ~48 first-party integrations against Vanta's and Drata's several hundred; no auditor network; no agent or scanner of its own; no external security ratings in TPRM (nothing equivalent to SecurityScorecard or BitSight); no BIA or dependency mapping in BCM; no scenario library for tabletops; no LMS; no automated AI-system discovery; no FedRAMP or DoD provisional authorization of its own, so CUI-handling deployments must self-host. Four areas — internal-audit-management, business-continuity-dr-management, crisis-simulation-tabletop and it-asset-software-inventory — carry a capability: 2 rating and an explicit "this is the evidence layer, not the platform" line, because that is the truth.

Sourced corrections to existing entries

• AuditBoard → Optro (formerly AuditBoard) across every area it appears in, url repointed to optro.ai, with a watch-out noting the March 2026 rebrand is still settling. (Second rebrand for this vendor: SOXHUB → AuditBoard in 2017 → Optro in 2026.)
• Veza is noted as now part of ServiceNow; Cyberbit as having acquired RangeForce (Sept 2025); Riskonnect as having absorbed Castellan; Corvus as a Travelers company; SafeBase as the Drata trust layer; Safe Security as having absorbed RiskLens; FairNow acquired by Optro.

URL verification

All 98 URLs introduced or changed by this pass were HTTP-checked with a browser user-agent. Five were wrong and were corrected before commit rather than shipped: vz-risk/pyfair → theonaunheim/pyfair; diligent.com/solutions/board-management → …/board-management-software; workiva.com/solutions/internal-audit → …/internal-audit-management; the NAVEX policy page, which lives under /platform/, not /products/navex-one/; and runZero's product page, which is /platform/, not /product/. A further 21 bare homepages were upgraded to verified product pages, lifting the W2 deep-link metric from 86% to 90% (510/565). The remaining 403s (Drata, Moodle, SafeBase, Sprinto, Wolters Kluwer) are bot-blocks on pages confirmed to exist.

Counts are now derived, not typed

The atlas header and footer used to hard-code "52 control areas across 14 domains" and "52 AREAS · 14 DOMAINS" in the HTML. Both had to be edited by hand on every expansion, and scripts/build-landscape.mjs never touched them — a silent drift waiting to happen. They are now computed from DATA at render time (#subcount, #brandline), so they cannot disagree with the dataset again.

Fixtures and guards updated in the same change

• scripts/check-scoring.mjs: pinned area count 52 → 72.
• The scoring golden fixture: regenerated. The intrinsic ceiling moves 81 (B) → 80 (B), and Identity & Access moves 80 (B) → 79 (C) — both are real consequences of adding areas whose best available option scores below the previous domain average, not a regression.
• The shared landscape suite: 76/76 pass.

Refresh — 2026-08-28 (window: 2026-08-13 → 2026-08-28)

This is the first refresh run under the issue #383 biweekly cadence, and the first to combine the routine correctness sweep with a genuine content-expansion pass. Net result: 83 new vendor/tool entries added across all 52 areas (347 → 430 total entries), 15 ossVerdict updates (8 of them a status change, not just a note refresh), and 13 sourced corrections to existing entries (3 acquisition-driven renames, 8 ownership/licensing pros-cons additions — one of which, CyberArk Conjur, also got its url repointed, and one, HashiCorp Vault, was also reclassified kind: "o" → "c" — and 1 maintenance note on tfsec). No area was left untouched, and no vendor or area was removed.

The work was done by six research passes running in parallel, one per domain group, each doing both jobs below for its slice; a seventh pass (this one) merged, cross-checked, and validated all of it against the live dataset before anything was written.

Summary counts

Job 1 — Refresh sweep: a quiet two weeks, as expected

All 347 pre-existing vendor URLs and all pre-existing open-source repos across the six slices were re-checked. Nothing was broken or archived inside the 2026-08-13 → 2026-08-28 window — short refresh windows are expected to be quiet, and this one was. What the sweep did surface, consistent with how the first refresh treated Caldera/Omnissa, is a set of pre-existing acquisition facts (mostly from Q1–Q2 2026, one from 2025) that the original 2026-06-28 curation and the 2026-08-13 refresh both missed, because they predate even that first refresh's own 6.5-week window:

All six were sourced, cross-referenced against the live product page (confirming the acquiring company's branding now appears), and corrected below rather than left as another silent gap — the same judgment call the first refresh made for MITRE Caldera and VMware Workspace ONE.

One acquisition landed inside the window itself: Okta closed its ~$200M acquisition of Permiso Security on 2026-08-26, adding identity threat detection & response (ITDR) across human, non-human, and agentic identities. Unlike the others, this is Okta as acquirer, not target, and is a capability expansion rather than a correction — added as a new pro on the existing IAM/SSO/MFA entry. TechCrunch

URL liveness and OSS-archival methodology were unchanged from the first refresh (see "Verification method" below); the ~30 vendor domains that 403/406/000 to non-browser clients (Cisco, Akamai, Sophos, Entrust, Rubrik, Armis, Kroll, and others) were spot-checked via WebFetch and/or search-index content match, and none were found actually broken.

Job 2 — Expansion: 83 new vendors across all 52 areas

Every area gained at least one new, currently-active, sourced vendor/tool option — the first time since the original curation that the atlas's vendor count has grown. Areas that were thinnest (5–6 entries) or carried a partial/none ossVerdict got the most attention, per issue #383's "flesh out more details in every area" ask.

By domain:

Full per-vendor pros/cons/ratings are in areas.json; every entry's URL was curl-verified to a clean 200 before inclusion (79 of 83 directly; 2 more — Sophos Firewall, Arista NDR — confirmed live via WebFetch after a sandbox-specific curl failure; 1 — Sublime Security — accepted on independent corroboration via G2/Gartner/AWS Marketplace listings after a persistent 429 from this session's IP, flagged for a merge-time re-check with a fresh IP).

ossVerdict status changes (8 areas moved from none/unset to partial/has):

Seven more areas (SASE/SSE, Mobile/UEM, API Security, CNAPP, UEBA, Compliance Automation, OT/ICS Security) had their ossVerdict note refreshed to point at an actually-listed vendor instead of a prose example, or to reflect a hard re-check against current reality — status unchanged in all seven. Two areas' none verdicts were re-confirmed, not assumed: CASB (no self-hostable inline/API broker exists) and DSPM (no credible OSS cloud-data-discovery project found despite a hard search).

Existing-entry corrections applied

Following the acquisition findings in Job 1, and the TheHive/kind-reclassification precedent from the first refresh:

• Lakera → "Check Point (Lakera)" and Prompt Security → "SentinelOne (Prompt Security)" (both in AI/ML Security) — renamed to match the "Palo Alto (Protect AI)" / "Cisco (Robust Intelligence)" convention already used elsewhere in this exact area for prior AI-security acquisitions, with a cons line noting the new parent.
• Red Canary → "Red Canary (Zscaler)" (MDR) — same treatment.
• CyberArk (PAM) and CyberArk (Venafi) (PKI) — added a cons line noting the Palo Alto Networks acquisition and the resulting portfolio concentration (Palo Alto now owns both CyberArk and Prisma Cloud, the latter listed separately in 4 Cloud Security areas).
• CyberArk Conjur (Secrets Mgmt) — url repointed from conjur.org/get-started/ (now 301-redirects to a fully de-branded Palo Alto "Idira Secrets Manager" page with no CyberArk/Conjur mention) to conjur.org (still live, 200, still CyberArk-branded), plus the same ownership cons line.
• Wiz (CSPM, CWPP, CNAPP, Container & Kubernetes Security — 4 areas) — added a cons line noting it is now a Google Cloud subsidiary, relevant to multi-cloud-neutrality-conscious buyers.
• Okta (IAM/SSO/MFA) — added a pro noting the Permiso Security acquisition (ITDR expansion) — the one in-window M&A event this pass found.
• HashiCorp Vault (Encryption & Key Mgmt) — reclassified kind: "o" → "c". Vault has shipped under a non-OSI Business Source License since August 2023; listing it as open source was the same category of error the first refresh corrected for TheHive. Now that OpenBao (the genuine MPL-2.0 fork) is listed in the same area as the OSS option, keeping Vault as "o" would have been actively misleading. A cons line was added citing the license and pointing at OpenBao.
• tfsec (DevSecOps & Secrets Mgmt) — added a cons line noting the maintainer (Aqua) has redirected engineering effort to Trivy, already listed in the same area.

Flagged but not changed

• devsecops-secrets-management's duplicate Vault entries. This area lists both "HashiCorp Vault" and "Vault OSS" as separate kind: "o" entries — a latent issue the original improvement plan already flagged ("likely intended as commercial entry... left as-is"). Given the BUSL finding above, at least one of these two entries is now definitely mislabeled, but resolving which one, and whether to merge or remove an entry, needs product/reviewer judgment beyond a routine refresh's scope — left for a dedicated pass.
• OpenDLP and MyDLP (DLP) — both have had zero commits since 2014 and can't be recommended as production tools, but neither is formally GitHub-archived. Same treatment as Gophish in the first refresh: no formal EOL announcement to cite, so left as-is rather than reclassified on inference.
• Gurucul (UEBA) — the entire gurucul.com domain 403s to both curl and WebFetch, so the current URL's liveness could not be independently confirmed either way. Search indexing suggests the canonical path has moved to /products/user-and-entity-behavior-analytics-ueba/, but per the "an unverified-but-plausible edit is worse than a stale entry" rule, the URL was not changed on search-index evidence alone.
• OWASP Dependency-Check (SCA) — its underlying GitHub repo moved orgs (archived jeremylong/DependencyCheck → active dependency-check/DependencyCheck), but the dataset's url already points at the OWASP project page, which links to the correct new repo. No change needed.
• Traceable (API Security) — merged into Harness (2025-03-04), predates even the original curation baseline. Site still operates as "Traceable"; nothing in the entry is factually contradicted. Informational only, not edited.
• grc-platform's Eramba/GRC-stack duplicate — the area lists "Eramba (community)" and "GRC stack" as separate vendor entries pointing at the same eramba.org URL under different vkeys. Pre-existing, not a this-window finding; flagged for whoever next touches this area.
• Dragos / Accenture — the majority-stake deal (announced 2026-06-18, ~$4.175B combined with runZero/NetRise) is still pending as of 2026-08-28, expected to close "August or September 2026." No status change from the first refresh.
• eramba/community (GRC Platform) and Gophish (Security Awareness) — both still show the same slow-fade signals the first refresh already flagged (no resolvable OSS repo / last commit 2024-09-23 respectively). Unchanged.
• Third-Party / Vendor Risk's ossVerdict: partial — searched hard for a genuine OSS TPRM option; the only candidate found (LT-VRM, 2 GitHub stars, 1 fork, single maintainer) is a toy project by this pass's own bar. Verdict re-confirmed, not upgraded.

Verification method

Same two-phase method as the first refresh, run per-domain-slice by six parallel research passes and then re-verified centrally before merging:

• Open-source archival/rename: GET https://api.github.com/repos/{owner}/{repo} for every resolvable OSS entry (existing and newly proposed), checking archived and pushed_at. Unauthenticated rate limits (60/hr) were hit repeatedly with six passes running concurrently on shared egress — batched around and, where necessary, cross-checked via the repo's web page or gh api instead.
• URL liveness: curl -sL -o /dev/null -w "%{http_code}" with a browser User-Agent, following redirects, against all 347 pre-existing URLs and all 83 proposed new URLs. Anything other than a clean 200 was re-checked with WebFetch and, where still ambiguous, a search-index check — never accepted on a bare non-200 curl response alone.
• M&A/rename sweep: targeted WebSearch queries against every vendor name in the dataset, plus general "cybersecurity M&A roundup August 2026" queries, cross-checked against acquisition/closing dates to separate in-window events (Okta/Permiso) from pre-existing gaps (CyberArk, Wiz, Lakera, Prompt Security, Red Canary).
• New-vendor grounding: every proposed pros/cons claim and 1–5 rating is sourced from product docs, pricing pages, G2/Gartner Peer Insights/PeerSpot review data, GitHub activity (for OSS), or funding/press coverage — never invented. Where a rating component couldn't be grounded in a located number (one case, 42Crunch), that's disclosed in the entry's own cons rather than presented as a verified figure.
• Central merge review (this pass, after the six research passes returned): every proposed vkey cross-checked against the full live dataset for collisions (0 found); all 83 new URLs re-curl'd independently of the research passes' own checks (79 clean 200s, 2 confirmed live via WebFetch after a curl failure, 1 accepted on independent corroboration with a caveat — see Job 2); node scripts/validate-landscape.mjs structural checks pass (52 areas, 430 vendor entries, 100% pros/cons, 100% ratings, all 4 remaining no-OSS areas carry an explicit verdict); node scripts/build-landscape.mjs regenerated landscape.html; npx tsc --build packages/shared typechecks clean; the landscape vitest suite (76 tests) passes, including a regenerated landscape-score.golden.json fixture — adding higher-rated options to two Emerging/Frontier areas legitimately moved that domain's best-in- area score from 73 to 75, which is the fixture doing its job (catching a real dataset-driven score change, not a bug).

Refresh — 2026-08-13 (window: 2026-06-28 → 2026-08-13)

This was the first monthly content refresh, run before issue #383 set the biweekly cadence. It covers the window 2026-06-28 → 2026-08-13 (~6.5 weeks) and checks the dataset for vendor renames/acquisitions, discontinued or archived open-source projects, broken product URLs, materially wrong claims, and significant new entrants.

Net result: 20 of 347 vendor entries changed, across 17 of 52 areas. No areas or vendors were added or removed, and no vkey was changed. This was a quiet six weeks for the atlas's content — most of what moved was URL rot and two open-source projects going archived, plus one notable governance change (MITRE Caldera → Apache) and two M&A stories (Cyera/Oasis, a still-pending Accenture/Dragos deal).

Summary counts

(Some vendor entries appear in more than one category above, e.g. TheHive is both an EOL/discontinued change and a rating change — the 20-entry total below is deduplicated by area+vkey.)

Changes, grouped by type

1. Vendor renamed / rebranded

vkey was left unchanged for all three (Caldera, Caldera, VMware Workspace ONE) per the grouping rule — only name/note/url/pros/cons moved. Flagging prominently per the rules: the VMware Workspace ONE vkey now reads oddly against the new Omnissa Workspace ONE display name; I judged changing the vkey wasn't warranted (no re-grouping benefit, and it risks silently breaking the "also appears in" cross-links) but a reviewer may disagree.

Note on timing: MITRE's Apache contribution was announced 2026-05-20 and the Omnissa spin-off closed 2024-02-26 — both predate the 2026-06-28 baseline. They were missed by the original curation, not new events in this window; I fixed them anyway since the entries were actively wrong.

2. Acquisitions / M&A (event-backed, no vibes-based re-scoring)

Dragos's rating was not changed — the Accenture deal (announced 2026-06-18, ~$4.175B combined with runZero/NetRise, Dragos valued at $3.25B) was still pending regulatory close as of 2026-08-13, expected Q3 2026, and Dragos's press release states it continues operating independently under its own CEO in the meantime. I only edited the prose to flag the pending deal; a rating bump should wait for close.

3. End-of-life / discontinued / archived

This is the most consequential finding of the pass: TheHive was listed as an open-source (kind: "o") option, but it no longer has any free/self-hostable download path — the OSS repo has been archived since December 2025 and StrangeBee's current site only sells commercial on-prem/SaaS/IaaS licenses. Anyone filtering the atlas for "open source only" tools would be steered toward a product they cannot actually get for free. I changed its kind from o to c, which is a small step beyond the "don't restructure" guidance for a single field, but I judged the field was simply factually wrong, not a stylistic reorganization.

All three archival dates (TheHive: 2025-12-05, APIClarity: 2026-05-29, Rebuff: 2025-05-16) predate the 2026-06-28 baseline — these were pre-existing errors in the original curation that this pass happened to catch, not new-in-window events.

4. Broken URLs fixed

All verified two ways: (a) the old URL returned HTTP 404/000 to both curl and WebFetch, and (b) the new URL returned HTTP 200 and its content (checked via WebFetch or by confirming the exact URL is indexed by search engines) matches the product named in that area.

Verified independently after the refresh ran. Every old URL in this table was re-measured with curl at review time, not taken from the refresh report. Ten were genuinely dead (404, or a connection failure). Two were not — Radware and NeMo Guardrails both redirected — and the rows below now say so. The original report classified all twelve as 404 → 200, which overstated the decay: a redirect that works is not a broken link, and a changelog that counts it as one makes the atlas look staler than it is.

Flagged but not changed

• Gophish (Security Awareness / Phishing Simulation) — the GitHub repo is not archived, but the last release is v0.12.1 (2022-09-14), the last commit was 2024-09-23 (predates the baseline), and there are 752 open issues. This smells like a slow-fading project, but there is no formal EOL/archival announcement to cite, so the existing rating (capability 2, maturity 3) was left as-is. Worth a closer look next pass if there's still no activity.
• Eramba (GRC Platform) — I could not find a working GitHub repo for the "community" edition (github.com/eramba/community 404s) to independently confirm the open-source edition is still maintained/downloadable. The current url (eramba.org) itself resolves fine and wasn't touched, but I couldn't verify the community edition's status beyond the marketing homepage, so no rating or note change was made.
• ~19 of the ~24 vendor URLs that returned HTTP 403 to both curl and WebFetch (Cisco, Akamai, Entrust, Aruba Networks, BeyondTrust, Wallarm, AttackIQ, Kroll, Rubrik, Armis, Drata product pages) were not individually re-verified beyond pattern-matching. I spot-checked 5 of them (Sophos ×2, BeyondTrust, Entrust PQC, Armis OT/IoT, Rubrik homepage) via search-engine indexing and all 5 were confirmed live and correctly scoped — strongly suggesting the 403s are bot-mitigation (Akamai/Cloudflare blocking non-browser clients) rather than real breakage, but I did not fetch actual content for the remaining ~19 and am reporting them as unverified rather than silently assuming they're fine.
• HashiCorp Vault / Vault OSS ownership — IBM completed its $6.4B acquisition of HashiCorp on 2025-02-27. Neither entry's note/pros/cons claims HashiCorp is independent, so nothing in the current text is factually wrong, and I made no edit. Flagging only for awareness since it's a fact a reader might expect the atlas to carry.

Verification method

• Structural/archival checks (open source): for the ~75 open-source entries with a resolvable GitHub repo, I queried the GitHub REST API (/repos/{owner}/{repo}) directly for archived status, pushed_at (last commit), and redirect targets (renamed repos surface a Moved Permanently + new canonical full_name). This is the most reliable signal available — it's the platform's own metadata, not a scraped claim — and it's how APIClarity, Rebuff, TheHive's predecessor repo, and the Caldera/NeMo-Guardrails org moves were all caught.
• URL liveness: all 347 vendor url values were checked with curl (HTTP status code, following redirects, browser-like User-Agent). Anything other than a clean 200 (25× 403, 11× 404, 5× connection failure, plus a couple of cross-domain 301/302s) was re-checked with WebFetch and, where still ambiguous or clearly broken, with a WebSearch for the correct current product-page URL. A replacement URL was only committed to the dataset once it independently returned 200 and its fetched/indexed content matched the product for that specific area.
• M&A / rename events: found via targeted WebSearch queries (SecurityWeek and Infosecurity Magazine's monthly cybersecurity M&A roundups for June and July 2026, plus vendor-specific searches) and cross-checked against the 290 unique vendor names in the dataset. Every M&A-driven edit above cites the announcement it's based on.
• What was not done: I did not attempt to verify every cost/price figure against current vendor pricing — that would require sales-quote-level research per vendor and was out of scope for this pass; no pricing edits were made, and none are claimed to have been checked. I did not re-derive every pros/cons/adv/dis claim from scratch; I only corrected claims that surfaced as wrong in the course of the above (archival status, ownership, broken links). This was a refresh pass, not a full re-audit of the original curation's editorial judgments.

Independent review of this refresh

The refresh was drafted by one pass and re-verified by a second before it was committed, because a changelog is exactly the kind of document that gets trusted without being checked. What the review changed:

• Every archival claim was re-confirmed against the GitHub REST API's own archived flag: TheHive (TheHive-Project/TheHive), APIClarity (openclarity/apiclarity) and Rebuff (protectai/rebuff) all return archived: true. The two org moves were confirmed the same way — mitre/caldera and NVIDIA/NeMo-Guardrails both resolve, via GitHub's own permanent redirect, to apache/caldera and NVIDIA-NeMo/Guardrails.
• All 14 replacement URLs were re-measured and every one returns 200.
• Two "broken link" claims did not survive. Radware's and NeMo Guardrails' old URLs redirect rather than 404. The counts and the table were corrected; see the note above the URL table.
• The Caldera entries were repointed again, from the Apache project homepage to github.com/apache/caldera. The homepage is a valid link, but it cost the two entries their "deep link" status and dropped the atlas's W2 metric from 322/347 to 320/347 — a real regression against the original curation, introduced by a change that looked purely like an improvement. The successor repository is both a deep link and consistent with how every other open-source entry in the atlas is linked. W2 is back to 322/347.

Post-review state: validate-landscape.mjs structural checks pass, 52 areas / 347 vendors / 14 domains unchanged, landscape.html regenerated and in sync, and the shared package's 76 landscape tests pass.

How to run the next refresh

Runs weekly per issue #464 — superseding the every-2-weeks cadence issue #383 set on 2026-08-13 — via an automated cloud routine (Landscape Atlas weekly refresh, cron 13 9 * * 1 UTC — every Monday at 09:13 UTC) that opens a PR rather than pushing directly to main. This section is what that routine follows, and what a human runs manually to do the same pass by hand.

The cadence and the cron string are also the canonical machine-readable values in the atlas's refresh configuration — if the two ever disagree, this file is stale, not the configuration.

1. Find the last refresh: the most recent dated section above, or the commit history of the atlas dataset. Diff the dataset against that commit to confirm nothing has drifted outside this process.
2. Extract the vendor list: node -e "..." against areas.json to dump {area, name, vkey, kind, url} for all entries (see the one-liner pattern used in past passes).
3. Open-source entries: for every entry with a github.com URL (or a known repo mapping), query GET https://api.github.com/repos/{owner}/{repo} and flag any archived: true or a pushed_at more than ~12 months old. Unauthenticated GitHub API calls are rate-limited to 60/hour — batch accordingly, use a token, or gh api instead if running several research slices concurrently against the same egress IP.
4. URL liveness: curl -s -o /dev/null -w "%{http_code}" -L <url> for every vendor URL. Anything not a 200 needs a WebFetch/WebSearch follow-up before deciding it's actually broken (large vendor sites frequently return 403 to non-browser clients even when the page is fine) — never repoint a URL on a bare non-200 curl response alone.
5. M&A sweep: search "cybersecurity M&A roundup <month> <year>" for each month since the last refresh (SecurityWeek and Infosecurity Magazine both publish monthly roundups) and check the acquirer/target list against the atlas's vendor names. Separate in-window events from pre-existing gaps the sweep happens to catch — both are worth fixing, but only the former is a "new this pass" finding.
6. Expansion (per issue #383 — do this every pass, not just the first time): for areas that are thin (5–6 vendors) or whose ossVerdict is partial/none, research and add genuine, currently-active, sourced vendor/tool options with the full schema (VendorCore in types.ts: name, note, kind, vkey, a deep-linked url verified 200, 2–4 pros, 2–4 cons, and a 1–5 rating on all four axes). Re-check none/partial ossVerdicts against current reality rather than assuming the last pass's research still holds — genuinely new open-source entrants happen. On a large repo with concurrent work in flight, splitting this by domain across parallel research passes (as this pass did — six slices, one per domain group) keeps each pass's context and web-search budget from being the bottleneck; a later merge step must check every proposed vkey against the full live dataset, not just its own slice, for collisions.
7. Make only source-backed edits; record every change's source URL as you go (don't batch this at the end — you will not remember which claim came from which fetch). A quiet window with nothing to report, or an area with nothing credible to add, is a fine, expected outcome — don't force a change or an addition to have something to say.
8. Update this changelog with a new dated section at the top (below "What this is"), update the "Refresh history" line, run node scripts/validate-landscape.mjs, then node scripts/build-landscape.mjs to regenerate landscape.html, then the shared landscape test suite. If any vendor was added or a rating changed, also regenerate the scoring golden fixture — it pins scoreLandscape's output over the real dataset, so a legitimate content change (a higher-rated option becoming an area's new best score) will fail the pinned test until the fixture is regenerated; see the 2026-08-28 refresh for the one-off script used to do this via tsx. Do not commit areas.json without a regenerated landscape.html (and, when needed, golden fixture) in the same change — CI's drift guard and the pinned test will both fail.