No. The CNCF landscape describes itself as a map meant to categorize most projects and product offerings in the cloud native space. Its inclusion rules are practical, such as GitHub stars and a clear product description, and none of them describe a security review. Use it to discover tools, not to trust them.
What the landscape says it is
The repository README calls it a map that categorizes most cloud native projects and product offerings. The data files and images live in the repository, the generator lives in a separate project, and the landscape is regenerated daily so merged changes should appear within 24 hours.
How things get in
According to the README:
- Cloud native projects with at least 300 GitHub stars that clearly fit an existing category are generally included, each in one best fit category.
- A company's product generally appears in one box, its major or best known offering.
- Commercial versions of open source software are generally excluded, though all Certified Kubernetes implementations are shown.
- Closed source products must link to a clear product description, and stealth mode companies are not accepted.
- New categories are unlikely to be created.
Those are cataloging rules. Stars measure attention, a product description shows that something exists, and neither shows that the software is secure.
What the data comes from
Some of the data comes from Crunchbase and GitHub, and the README says anything sourced there has to be corrected at its source. Projects can also declare a Technical Advisory Group, such as security, otherwise a group is auto detected from a category mapping that the README says may be inaccurate. So even the tags need a second look.
How to use it well
- Find the category. If you are looking for container image scanners or policy engines, the map shows what exists.
- Note what is missing. Because commercial versions of open source are generally excluded, the picture is partial.
- Shortlist on your criteria. Then evaluate each option yourself, for example with the open source evaluation routine.
- Check maturity separately. The landscape also shows CNCF project levels, which have their own meaning, covered in what sandbox, incubating and graduated mean.
A caution on crowded categories
A map with many boxes can imply that products in one box are interchangeable. They rarely are. Two tools in the same category can differ in what they detect, where they run, and what they send off your systems. The box tells you the problem space, not the fit.
Where Safeguard fits
Safeguard offers container and dependency scanning, SBOM generation and policies and gates. A free scan is available at gold.safeguard.sh/scan for a quick look at what it reports on your code.
Quick check
What does the 300 star rule mean?
According to the README, cloud native projects with at least 300 GitHub stars that clearly fit a category are generally included. It is a cataloging threshold, not a security one.
Sources
Last reviewed: 19 October 2026.
