Document Phase 4 and Phase 5 next to the shipped collectors

src/content/blog/open-source-cspm-cnapp-tools-2026.md

@@ -2,7 +2,7 @@
 title: "Open Source CSPM and CNAPP Tools in 2026: What Exists Today"
 description: "Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team."
 pubDate: 2026-08-24
-updatedDate: 2026-10-13
+updatedDate: 2026-10-14
 author: OpenSourceOM Team
 tags:
   - open source CSPM
@@ -69,7 +69,7 @@ The differentiator for **self-hosted CNAPP**-like experiences is the **security
 | Finding enrichment | CVEs and misconfigs on graph nodes |
 | Path queries | Prioritize by attack path, not severity |
 
-**[OpenSourceOM](/prowler-alternative/)** is that layer, self-hosted and Apache-2.0: collectors, a Postgres graph, and CSPM rules scored by path. [Prowler vs OpenSourceOM](/prowler-alternative/) is the Prowler alternative comparison. Cartography and BloodHound are on [self-hosted CNAPP](/self-hosted-cnapp/). Phase 3 has shipped — see the [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md).
+**[OpenSourceOM](/prowler-alternative/)** is that layer, self-hosted and Apache-2.0: collectors, a Postgres graph, and CSPM rules scored by path. [Prowler vs OpenSourceOM](/prowler-alternative/) is the Prowler alternative comparison. Cartography and BloodHound are on [self-hosted CNAPP](/self-hosted-cnapp/). Phase 3 has shipped. Phase 4 (package inventory from persistent workload storage) and Phase 5 (secret and malware findings on that storage) are next — see the [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md).
 
 ## Proprietary CNAPP vs. open source stack
 

src/pages/docs/architecture.astro

@@ -36,6 +36,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     <code>internal/rules</code>, and the collectors. PostgreSQL is the graph store. Phase 3 adds
     the plugin SDK, the embedded rule pack, a Helm chart, and cloud audit context from
     CloudTrail, Activity Log, and Admin Activity logs, on top of the Phase 2 feature set.
+    Phase 4 and Phase 5 are planned: package identifiers from persistent workload storage,
+    then secret and malware findings on that same storage. They are not in this layout yet.
   </p>
   <pre><code>{`Cloud / Kubernetes APIs
         │
@@ -121,7 +123,13 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
   <h2>What this version leaves out</h2>
   <p>
     Multi-tenant RBAC, SAML, and platform audit logs of who clicked what in the console are
-    outside the open source core. See <a href="/docs/open-source/">Open source scope</a>.
+    outside the open source core, as is classification of object bodies and database rows.
+    See <a href="/docs/open-source/">Open source scope</a>.
+    Phase 4 will write <code>packages</code> from root volumes, boot images, container layers,
+    function bundles, and shared filesystems. Phase 5 will add secret and malware findings
+    on that storage, recording the kind and the path. Neither phase is implemented.
+    <code>om scan aws</code>, <code>om scan azure</code>, and <code>om scan gcp</code> stay
+    read-only API scans.
     Recursive path SQL is capped. Azure and GCP <code>REACHABLE</code> edges still ignore
     firewalls; the collector pages describe that and the IAM rules behind <code>CAN_ACCESS</code>.
     The design notes in the core repo

src/pages/docs/collectors/aws.astro

@@ -96,7 +96,10 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     API reports no further page.
   </p>
   <p>
-    The collector does not inventory Lambda, EKS, VPCs, or IAM groups. RDS and Aurora instances are
+    The collector does not inventory Lambda, EKS, VPCs, or IAM groups, and it does not snapshot
+    EBS volumes or read packages on disk. That inventory is Phase 4 on the
+    <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>, as a
+    separate opt-in scan. RDS and Aurora instances are
     datastores, and their tags supply <code>sensitivity</code> the same way a bucket tag does.
     Buckets are listed
     account-wide. EC2 and security groups are the one region in <code>AWS_REGION</code>.

src/pages/docs/collectors/azure.astro

@@ -144,6 +144,9 @@ az login
     built-in set above. A subscription Reader covers the ARM calls, including
     <code>Microsoft.Insights/eventtypes/values/read</code>. Listing containers also needs
     <code>Microsoft.Storage/storageAccounts/blobServices/containers/read</code>. The collector
-    does not call mutating APIs.
+    does not call mutating APIs, and it does not snapshot OS disks or read packages on the VM.
+    That inventory is Phase 4 on the
+    <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>, as a
+    separate opt-in scan.
   </p>
 </DocsLayout>

src/pages/docs/collectors/gcp.astro

@@ -151,7 +151,10 @@ gcloud auth application-default login
     The scan lists instances, firewalls, load-balancer pieces, buckets, bucket IAM, service
     accounts, the project IAM policy, Cloud SQL instances, and Admin Activity log entries.
     Listing those entries needs <code>logging.logEntries.list</code>. Logs Viewer
-    (<code>roles/logging.viewer</code>) includes it. The collector does not call mutating APIs
-    and does not request Data Access logs.
+    (<code>roles/logging.viewer</code>) includes it. The collector does not call mutating APIs,
+    does not request Data Access logs, and does not snapshot boot disks or read packages on the
+    instance. That inventory is Phase 4 on the
+    <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>, as a
+    separate opt-in scan.
   </p>
 </DocsLayout>

src/pages/docs/collectors/index.astro

@@ -134,4 +134,21 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     queries have a start vertex. Plugins that want internet paths must include that node
     themselves. The id constant is <code>internet:global</code> in <code>sdk/collector</code>.
   </p>
+
+  <h2>What a scan does not read</h2>
+  <p>
+    Built-in collectors call cloud APIs. They do not snapshot a root volume, pull container
+    layers, or download a function bundle. <code>om scan aws</code> stores an AMI id on
+    <code>image</code>. <code>om scan k8s</code> stores image references. Neither writes the
+    packages inside. <code>om enrich cve</code> can match a CVE only when <code>packages</code>
+    is already on the workload, which today means the demo graph or a plugin.
+  </p>
+  <p>
+    Phase 4 on the
+    <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>
+    is that inventory, from root volumes, boot images, container layers, function bundles, and
+    shared filesystems. It will be a separate opt-in scan, because a volume snapshot is a write
+    in the account. The API scans on this page stay read-only. Phase 5 then records a secret
+    or malware finding from storage that scan already opened, storing the kind and the path.
+  </p>
 </DocsLayout>

src/pages/docs/collectors/kubernetes.astro

@@ -27,7 +27,8 @@ export K8S_NAMESPACE=payments
     services, and service accounts. Deployments and ReplicaSets are not nodes. Pods are the
     workloads. Each pod stores <code>images</code>: the sorted, unique image refs from its init
     containers and app containers. Ephemeral containers are omitted. An empty image list is not
-    written.
+    written. The refs are not pulled, so packages inside the layers are absent until Phase 4
+    on the <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>.
   </p>
 
   <h2>Mapping</h2>

src/pages/docs/enrichment.astro

@@ -44,6 +44,9 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     <code>om scan aws</code> writes <code>image</code> as the AMI id when the instance has one.
     A plugin can set <code>packages</code> directly. See
     <a href="/docs/collectors/plugins/">Plugins</a>.
+    Phase 4 will fill <code>packages</code> from persistent workload storage (root volumes, boot
+    images, image layers, function bundles, and shared filesystems). Enrichment stays a matcher.
+    See the <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>.
   </p>
 
   <h2>NVD</h2>

src/pages/docs/index.astro

@@ -38,6 +38,9 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     into PostgreSQL. Named path queries, CSPM rules, and CVE enrichment rank what an outsider can
     reach. These pages describe the <code>om</code> CLI, REST API, and collectors as they ship in
     <a href="https://github.com/OpenSourceOM/core">OpenSourceOM/core</a>. Phase 3 has shipped.
+    Phase 4 and Phase 5 are open on the
+    <a href="https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md">roadmap</a>:
+    package inventory from persistent workload storage, then secret and malware findings on that storage.
   </p>
 
   <h2>Start</h2>

src/pages/docs/open-source.astro

@@ -16,7 +16,7 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     {
       question: 'What is outside the open-source core?',
       answer:
-        'Insider-threat analysis, SAML and SSO, multi-tenant RBAC, and audit logs of who used the console are planned outside the open-source core. Attack paths, CSPM, collectors, and the self-hosted API stay in core.',
+        'Insider-threat analysis, SAML and SSO, multi-tenant RBAC, audit logs of who used the console, and classification of object bodies and database rows are planned outside the open-source core. Attack paths, CSPM, collectors, workload package inventory, and the self-hosted API stay in core.',
     },
   ]}
   related={[
@@ -83,6 +83,10 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
           <td>Cloud audit ingest as graph context</td>
           <td>Immutable platform audit logs (who used OpenSourceOM)</td>
         </tr>
+        <tr>
+          <td>Workload package inventory (Phase 4) and secret or malware findings on that storage (Phase 5)</td>
+          <td>Classification of object bodies and database rows</td>
+        </tr>
       </tbody>
     </table>
   </div>
@@ -93,6 +97,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     exposed path. Path queries return those events with the path. Data Access logs are not
     collected. <strong>Platform audit logs</strong> — operator actions in the
     console/API, SSO identity, retention, and auditor export — belong in the commercial offering.
+    Phase 4 and Phase 5 stay in core: packages, secrets, and malware on storage an outsider can
+    reach. Reading object bodies and database rows to classify customer data does not.
   </p>
 
   <h2>Why this split</h2>
@@ -113,7 +119,9 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     CSPM rules, blast radius, Kubernetes ingest, exports, the collector plugin SDK,
     and the Helm chart are in the tree, along with inventory-backed CVEs, crown-jewel
     datastores, attack-path findings, and cloud audit context from CloudTrail, Activity Log,
-    and Admin Activity logs. How to run them is covered from
+    and Admin Activity logs. Phase 4 and Phase 5 are open and not in the tree yet: package
+    inventory from persistent workload storage, then secret and malware findings on that
+    storage. How to run what has shipped is covered from
     <a href="/docs/getting-started/">Getting started</a> through
     <a href="/docs/collectors/plugins/">Plugins</a>. Commercial offerings are
     <strong>not available yet</strong> — there is no pricing, sales contact, or enterprise SKU