Add Prowler and self-hosted CNAPP comparison pages

package.json

@@ -37,6 +37,7 @@
     "path-to-regexp": "6.3.0",
     "undici": "8.10.2",
     "fast-uri": "3.1.6",
+    "fflate": "0.7.5",
     "@vercel/analytics": "$@vercel/analytics",
     "@vercel/routing-utils": {
       "path-to-regexp": "6.3.0"

scripts/content-dates.mjs

@@ -19,10 +19,12 @@ const DATE_RE = /^(\d{4}-\d{2}-\d{2})/;
 
 /** @type {Record<string, string>} */
 export const STATIC_LASTMOD = {
-  '/': '2026-08-24',
+  '/': '2026-10-13',
+  '/self-hosted-cnapp/': '2026-10-13',
+  '/prowler-alternative/': '2026-10-13',
   '/contact/': '2026-08-26',
   '/docs/': '2026-09-28',
-  '/docs/getting-started/': '2026-09-28',
+  '/docs/getting-started/': '2026-10-13',
   '/docs/configuration/': '2026-09-28',
   '/docs/the-graph/': '2026-09-28',
   '/docs/schema/': '2026-09-28',
@@ -46,7 +48,7 @@ export const STATIC_LASTMOD = {
   '/docs/docker/': '2026-09-28',
   '/docs/kubernetes/': '2026-09-28',
   '/docs/security/': '2026-09-28',
-  '/docs/open-source/': '2026-09-28',
+  '/docs/open-source/': '2026-10-13',
 };
 
 /**

scripts/content-dates.test.mjs

@@ -37,7 +37,9 @@ test('indexed blogs have lastmod and /blog/ uses the newest', () => {
   const lastmodByPath = buildLastmodByPath();
   const newest = entries.reduce((acc, entry) => maxIsoDate(acc, entry.lastmod), '1970-01-01');
   assert.equal(lastmodByPath.get('/blog/'), newest);
-  assert.equal(lastmodByPath.get('/'), '2026-08-24');
+  assert.equal(lastmodByPath.get('/'), '2026-10-13');
+  assert.equal(lastmodByPath.get('/self-hosted-cnapp/'), '2026-10-13');
+  assert.equal(lastmodByPath.get('/prowler-alternative/'), '2026-10-13');
 
   const sample = entries.find((entry) => entry.slug === 'agentless-vs-agent-cloud-security');
   assert.ok(sample);

src/components/CompareSection.astro

@@ -48,6 +48,11 @@ const rows = [
         ))
       }
     </div>
+    <p class="compare-more">
+      <a href="/prowler-alternative/">Prowler vs OpenSourceOM</a> is the Prowler alternative
+      comparison. <a href="/self-hosted-cnapp/">Cartography and BloodHound</a> are compared as a
+      self-hosted CNAPP.
+    </p>
   </div>
 </section>
 
@@ -102,6 +107,11 @@ const rows = [
     background: var(--gradient);
   }
 
+  .compare-more {
+    margin: 1.5rem 0 0;
+    color: var(--text-muted);
+  }
+
   @media (min-width: 768px) {
     .compare-header {
       display: grid;

src/components/Footer.astro

@@ -21,6 +21,8 @@ const licenseUrl = 'https://github.com/OpenSourceOM/website/blob/main/LICENSE';
         <li><a href="/docs/the-graph/">Security graph</a></li>
         <li><a href="/docs/architecture/">Architecture</a></li>
         <li><a href="/docs/open-source/">Open source scope</a></li>
+        <li><a href="/prowler-alternative/">Prowler alternative</a></li>
+        <li><a href="/self-hosted-cnapp/">Self-hosted CNAPP</a></li>
         <li><a href="/contact/">Contact</a></li>
         <li><a href="https://github.com/OpenSourceOM/core" target="_blank" rel="noopener noreferrer">Core repo</a></li>
         <li><a href={licenseUrl} target="_blank" rel="noopener noreferrer">License</a></li>

src/content/blog/open-source-cspm-cnapp-tools-2026.md

@@ -2,7 +2,7 @@
 title: "Open Source CSPM and CNAPP Tools in 2026: What Exists Today"
 description: "Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team."
 pubDate: 2026-08-24
-updatedDate: 2026-08-24
+updatedDate: 2026-10-13
 author: OpenSourceOM Team
 tags:
   - open source CSPM
@@ -43,7 +43,7 @@ No single mature OSS project clones every proprietary CNAPP feature yet. Instead
 | Project / category | Strength | Gap vs. CNAPP |
 |--------------------|----------|----------------|
 | Policy engines (OPA, Cloud Custodian) | Flexible policy-as-code | No unified graph or path analysis |
-| Multi-cloud scanners (Prowler, ScoutSuite) | Broad AWS/Azure/GCP checks | Flat findings lists |
+| Multi-cloud scanners (Prowler, ScoutSuite) | Broad AWS/Azure/GCP checks | Findings lists. Prowler App can add an AWS attack-path graph via Cartography |
 | IaC scanners (Checkov, tfsec) | Shift-left | Pre-deploy only |
 
 These are excellent for **misconfiguration detection** — the CSPM layer — but they rarely answer *"Which of these 500 findings sits on a path to prod data?"*
@@ -69,7 +69,7 @@ The differentiator for **self-hosted CNAPP**-like experiences is the **security
 | Finding enrichment | CVEs and misconfigs on graph nodes |
 | Path queries | Prioritize by attack path, not severity |
 
-**[OpenSourceOM](https://opensourceom.org)** is building this layer openly: collectors, graph engine, CSPM rules with path context, Apache-2.0 licensed, self-hosted. Status: early development — see [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md).
+**[OpenSourceOM](/prowler-alternative/)** is that layer, self-hosted and Apache-2.0: collectors, a Postgres graph, and CSPM rules scored by path. [Prowler vs OpenSourceOM](/prowler-alternative/) is the Prowler alternative comparison. Cartography and BloodHound are on [self-hosted CNAPP](/self-hosted-cnapp/). Phase 3 has shipped — see the [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md).
 
 ## Proprietary CNAPP vs. open source stack
 
@@ -112,19 +112,17 @@ Promises vs. shipped features — especially for attack path and UI.
 
 ## Reference architecture: composable OSS cloud security
 
+Prowler and OpenSourceOM stay separate tools. OpenSourceOM does not ingest a Prowler report.
+
 ```
-┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
-│ CSPM scanner    │────▶│ Graph / normalizer│────▶│ Path queries +  │
-│ (Prowler, etc.) │     │ (OpenSourceOM)   │     │ prioritization  │
-└─────────────────┘     └──────────────────┘     └─────────────────┘
-         │                        ▲
-         │               ┌────────┴────────┐
-         │               │ IAM + inventory │
-         └───────────────│ collectors      │
-                         └─────────────────┘
+┌─────────────────┐     ┌──────────────────┐
+│ CSPM scanner    │     │ Security graph   │
+│ (Prowler)       │     │ (OpenSourceOM)   │
+└─────────────────┘     └──────────────────┘
+ compliance workbook     ranked attack paths
 ```
 
-Start with one CSPM scanner + graph platform; add CIEM and CWPP feeds over time.
+Run Prowler for the framework mapping and OpenSourceOM for the queue. Add CIEM and CWPP feeds over time.
 
 ## When open source is the wrong fit
 
@@ -150,4 +148,4 @@ Even then, **open source CSPM** scanners can supplement vendor tools for second
 
 ---
 
-**Related:** [CSPM vs CNAPP](/blog/cspm-vs-cnapp-whats-the-difference/) · [Attack path analysis](/blog/attack-path-analysis-cloud-security/)
+**Related:** [Prowler vs OpenSourceOM](/prowler-alternative/) · [Self-hosted CNAPP, Cartography, and BloodHound](/self-hosted-cnapp/) · [CSPM vs CNAPP](/blog/cspm-vs-cnapp-whats-the-difference/) · [Attack path analysis](/blog/attack-path-analysis-cloud-security/)

src/pages/docs/getting-started.astro

@@ -20,6 +20,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     },
   ]}
   related={[
+    { href: '/prowler-alternative/', label: 'Prowler vs OpenSourceOM' },
+    { href: '/self-hosted-cnapp/', label: 'Self-hosted CNAPP, Cartography, BloodHound' },
     { href: '/blog/open-source-cspm-cnapp-tools-2026/', label: 'Open-source CSPM and CNAPP tools' },
     { href: '/blog/self-hosted-cspm-architecture/', label: 'Self-hosted CSPM architecture' },
     { href: '/docs/the-graph/', label: 'How the security graph works' },

src/pages/docs/open-source.astro

@@ -20,6 +20,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     },
   ]}
   related={[
+    { href: '/prowler-alternative/', label: 'Prowler vs OpenSourceOM' },
+    { href: '/self-hosted-cnapp/', label: 'Self-hosted CNAPP, Cartography, BloodHound' },
     { href: '/blog/open-source-cspm-cnapp-tools-2026/', label: 'Open-source CSPM and CNAPP tools' },
     { href: '/blog/cspm-vs-cnapp-whats-the-difference/', label: 'CSPM vs CNAPP' },
   ]}