incident.io vs Prowler

Prowler ships roughly weekly and the Lighthouse AI thread runs through nearly every release. In 5.35.0 the assistant gained write actions and a side panel; 5.37.0 gave it page-aware context and the full Prowler MCP toolbox, with MCP itself adding integrations, users and roles on both Cloud and self-hosted; 5.39.0 puts a Skills menu on every individual finding. Around that, the paid tier keeps absorbing organizational complexity — Compliance Watchlist, multi-domain SAML SSO, and now Azure management-group onboarding — while 5.37.1 was a pure hardening release that cut the API image's critical CVE count from 18 to 4.

Every Lighthouse release moves one step further from answering and closer to deciding. Read-only chat became actions, actions became context-aware, and the newest release attaches named skills to a single finding — including one that judges whether the finding is real and closes it out. The commercial line is drawn consistently: detection and the scanner stay open source, while the agentic layer and multi-tenant onboarding sit behind a Cloud subscription. Every write path is bound to the asking user's RBAC rather than a service identity, which is the same answer given each time the surface widens.

With triage decisions now automatable per finding, the unresolved question these entries raise is bulk: applying a skill across a finding group rather than one at a time, which is where Finding Groups and Systemic Scope already point. Expect the Azure onboarding pattern to be repeated for the remaining providers.