R3-03 · backs slide 19, 20
R3-03 Competitor matrix
Supports slides 19 and 20.
Who else is on the map, in plain English. I confirmed the cells on 17 Oct 2026 from my own knowledge of this market. The claim we make is narrow: the only crosswalk we’ve found that shows provenance per mapping and states its gaps.
| Who | What they are | What they do that we don’t | What we do that they don’t |
|---|---|---|---|
| STIGViewer / OpenControls | Free STIG viewer; paid crosswalk across DISA, NIST, SCF, CIS and CSA, with API and MCP | Provenance on every mapping. States what isn’t covered. Derived mappings labelled as ours. Free practitioner tier. Air-gapped path. | |
| UCF | Licensed common-controls framework; mappings sold by subscription | Twenty years of mapped authority documents; an enterprise sales force | A free tier; proof of absence; agent access through MCP |
| Strike Graph | GRC platform, 357 organisations | The workflow and the audit: evidence collection, assessor collaboration | The crosswalk itself, which is why ours ships inside theirs from November |
| CIS | CIS Controls and Benchmarks; mappings through its own navigator | Its own controls, widely adopted; benchmarks for hardening | A cross-publisher crosswalk with DISA and NIST in one place; MCP |
| DISA tooling (free) | The published STIGs and the official viewer | Authoritative source; free; runs air-gapped | Mappings to NIST, SCF and CIS; gaps stated; an API |
| GRC platforms | Subscription compliance suites | Breadth: policies, risk, vendors and audits in one tool | Depth on the crosswalk, with provenance. We’re their content, not their competitor. |
Disclosure: I co-founded UCF and left in 2025.
What backs our row
- Provenance and the asserted-versus-derived split: an outside system review in August said publisher weight “is never averaged with our confidence score. Two disagreeing sources get two chips, not a winner.”
- Proof of absence and MCP: verified by live query on 26 Aug 2026, the MCP server ships the uncovered residue as an output, across 11 read-only tools and 37 catalogs.
- Publishers in the graph: 706 STIG baselines, 1,534 SCF controls and 252 indexed authority documents behind the gate (25 Aug 2026).
Not yet evidenced: a public citation for each competitor cell. The cells rest on my confirmation, not on one source per claim.
Sources:
- Competitor cells: Dorian Cougias, confirmed 17 Oct 2026
- Strike Graph organisation count: R2-03 partner bench register
- Outside review: Weekly Check-In 12 Aug 2026
- MCP live query and graph counts: Weekly Check-In 26 Aug 2026