Icinga: Infrastructure Monitoring Ledger 2026

Part of the Infrastructure Monitoring Ledger (edition 2026-10-04). How the scores work: methodology.

Snapshot

Tier: Challenger
Owner: Icinga GmbH within the NETWAYS group, Nuremberg; privately held, no venture capital
Licence model: GPLv2 for every component, no enterprise edition; paid support subscriptions per monitored hosts (quote, from about EUR 4,500 a year)
Products scored: Icinga 2 core 2.16, Icinga Web 2 with Icinga DB Web, Icinga DB, Icinga Director, Icinga Notifications, Business Process module
Latest release: Icinga 2.16.5, 2026-08-14
Next signal: No dated milestone; IcingaCON 2025 direction is wider MCP tooling, Redis Cluster hardening and more Proxmox, KubeVirt and AHV automation
Archetype: Pure open-source check engine
Evidence grade: B. Release dates match git tags, but several capability cells (Proxmox basket in a core patch release, native AHV/KubeVirt/OpenStack) read as overstated and are not tied to a release note.

Scorecard

Dimension	Score	Direction
Capability today	67.6 / 100	higher is better
Momentum since end of 2022	+6.2 points	higher is better
Credibility	18.5 / 25	higher is better
Commercial risk	5.0 / 25	lower is better
Technical lock-in	6.5 / 25	lower is better
Integrator fit	13.0 / 20	higher is better
AI leverage	4.5 / 20	higher is better
Ledger Index	64.2 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Server, virtualization and storage (12)	2.5	3	3	3.5
Network monitoring (12)	2.5	2.5	2.5	2.5
Application and service monitoring (10)	3	3.5	3.5	3.5
Data collection and scale (12)	3.5	4	4	4
Alerting and event management (12)	3.5	3.5	3.5	4
Visualisation and reporting (8)	2	2.5	3	3
Logs and traces (8)	1	1.5	1.5	1.5
Automation and remediation (8)	3.5	4	4	4
Security and compliance (8)	3	3.5	3.5	4
New-platform support (VMware exit) (10)	1	1.5	2	3.5
Total / 100	52.0	59.6	61.4	67.6

Year by year: 2016: 52.0 · 2017: 52.8 · 2018: 52.8 · 2019: 59.6 · 2020: 59.6 · 2021: 59.6 · 2022: 61.4 · 2023: 62.6 · 2024: 65.8 · 2025: 65.8 · 2026: 67.6

What moved the score

Year	Domain	Change	Points	Trigger
2017	Logs and traces	1 → 1.5	+0.8	2.8: Windows Event Log check commands; logs otherwise in external Elasticsearch, Graylog or Loki via links
2019	Application and service monitoring	3 → 3.5	+1.0	Business Process module models business services with AND/OR/MIN logic; x509 certificate monitoring
2019	Automation and remediation	3.5 → 4	+0.8	Director GA: imports from CMDB, vCenter, AD and cloud; official Ansible collection
2019	Data collection and scale	3.5 → 4	+1.2	2.11: network stack rewritten on Boost.Asio; 50+ satellites per cluster; about 100k checks per cluster
2019	New-platform support (VMware exit)	1 → 1.5	+1.0	Kubernetes and Nutanix AHV only through community plugins
2019	Security and compliance	3 → 3.5	+0.8	2.11 era: CA proxy across DMZs, older TLS removed; OIDC and SAML modules; audit logging
2019	Server, virtualization and storage	2.5 → 3	+1.2	Icinga Module for vSphere: official vCenter discovery of hosts, datastores and VMs; PowerShell checks on Windows
2019	Visualisation and reporting	2 → 2.5	+0.8	Grafana module embeds external Grafana panels; PDF export; Business Process tree views
2022	New-platform support (VMware exit)	1.5 → 2	+1.0	Community Proxmox VE plugins; Kubernetes via Prometheus exporter checks
2022	Visualisation and reporting	2.5 → 3	+0.8	Icinga DB Web GA, 2022-06: fast filtering and bulk actions; scheduled SLA reports; graphs still in Grafana
2023	Alerting and event management	3.5 → 4	+1.2	Icinga Notifications GA, 2023-11: on-call rosters, escalation, alert grouping and multi-channel routing
2024	New-platform support (VMware exit)	2 → 3	+2.0	2.14.2 era: official Director basket for Proxmox VE imports nodes and VMs with templates
2024	Server, virtualization and storage	3 → 3.5	+1.2	2.14.2 era: Director automation basket imports Proxmox VE nodes and guests; Redfish hardware checks via plugin
2026	New-platform support (VMware exit)	3 → 3.5	+1.0	Director baskets for Nutanix Prism and KubeVirt per current docs; no dated release named
2026	Security and compliance	3.5 → 4	+0.8	2.16: scoped API tokens; restriction-filter tenancy; FIPS-capable OpenSSL on RHEL 9; air-gapped; no KEV entry (the security record)

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-07	2.14.0: C++17 core; OpenTelemetry metrics export GA	D4 Collection and scale	U
2023-11	Icinga Notifications GA with on-call rosters and routing	D5 Alerting and events	C
2024-01	2.14.2: Director automation basket for Proxmox VE	D1 Server and virtualization	M
2024-03	Icinga Web 2.12.1: fix for CVE-2024-28186	D9 Security	C
2025-06	2.15.0: Grafana embedding module with authenticated proxy	D6 Visualisation and reporting	C
2025-06	2.15.0: automated agent certificate rotation via REST API	D9 Security	C
2026-04	2.16.0: MCP server preview	D7 AI-assisted operations	M
2026-04	2.16.0: Redis Cluster support in Icinga DB	D4 Collection and scale	C
2026-04	2.16.0: fine-grained API token scoping	D9 Security	C

Centre of gravity: Security (3), Collection and scale (2), Alerting and events (1)
Driver mix: Vision 0%, Customer need 67%, Market window 22%, Upstream 11%, Portfolio 0%

Credibility: 18.5 / 25

Criterion	Score	Basis
Cadence	3.5	Majors 2.14 (2023-07), 2.15 (2025-06), 2.16 (2026-04) plus patches; a 23-month gap before 2.14
Roadmap transparency	4	Public GitHub repos and milestones; direction stated at yearly IcingaCON keynotes
Say-do	4.5	7 of 7 items since 2023 shipped on stated timing; sample comes from conference promises
Velocity	3	One or two substantive changes per major release
Lifecycle stability	3.5	In-place upgrades; IDO backend superseded by Icinga DB, a migration users must plan

Say-do record, 2023 to 2026: 7 items 2023-2026, all shipped with no lag: Notifications, C++17, Proxmox basket, certificate rotation, C++20/OpenSSL 3.3, MCP preview, Redis Cluster.

Commercial risk: 5.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	0.5	GPLv2 throughout; no licence or pricing change recorded since 2023
Purchase constraints	1	Everything free; optional support per host count, quote based
Channel and access	1.5	Open downloads and docs; official package repositories bundled with paid support
Owner stability	1	Privately held by NETWAYS group since 2009; no outside investors
Cost of staying supported	1	Free updates; support is optional and does not unlock features

Security record of the product itself: None found in the KEV catalogue (the security record). Recent CVEs: CVE-2022-24716 Icinga Web 2 file read, fixed 2022-03-08; CVE-2024-28186 XSS, fixed 2024-03-12.

Technical lock-in: 6.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Plain-text Icinga DSL unique to Icinga; state in PostgreSQL or MySQL; standard plugin format
Export path	1.5	Config is text files and Director JSON baskets; metrics already in InfluxDB or Graphite
Stack coupling	1	Choice of MySQL or PostgreSQL; Nagios-compatible plugins reusable in other tools
Hardware / cloud coupling	0	Any hardware, fully offline
Skills and tooling coupling	2	DSL and Director skills are Icinga-specific; plugin skills are common

Integrator fit: 13.0 / 20

Criterion	Score	Basis
Partner programme openness	3.5	Certified partner network in DACH, France, UK and North America
Multi-tenancy and self-service	2.5	Restriction filters by host group or variable; dedicated satellites; no MSP portal or billing
API and infrastructure-as-code	4	REST API; official Ansible collection; Puppet module with 15M downloads; Director CLI
Skills and certification	3	NETWAYS training and integrator certification; no public exam detail

AI leverage: 4.5 / 20

Strand	Today	Latest step
AIOps on monitoring data	0.5	2016: 2.5: GPU servers checked through the check_nvidia_smi plugin; no machine learning
AI platform stack	0	none
AI-assisted operations	1	2023: Notifications 1.0: rule-based alert grouping and quiet-period dampening
Agent openness	3	2026: 2.16.0, 2026-04: MCP server preview for state queries and downtimes

AI say-do: 2 tracked, 2 delivered GA (Icinga DB, Notifications), 0 dropped; MCP preview shipped as promised. No ML in the product; a community Ollama summarizer does not count.

Reading

Icinga is building a modular, fully GPL monitoring stack around its check engine, with Icinga DB for scale, Director for automation and a new notification service. Its record is steady and honest: small, regular releases, every 2023-2026 promise delivered, and no exploited flaws. The trade-off is that graphs, logs, flows and network configuration all live in other tools, so buyers assemble and run several products.

Open questions and evidence caveats

Proxmox basket dated to a core patch release (2.14.2) and native AHV, KubeVirt and OpenStack claims have no release note; platforms score may be high.
MCP preview in 2.16.0 is reported only in the research and AI evidence; confirm against the 2.16.0 release notes.
Network score assumes Monitoring Plugins as standard; check_nwc_health and map modules are third-party and counted half.