Prometheus: Monitoring Ledger 2026

Part of the Infrastructure Monitoring Ledger (edition 2026-10-04). How the scores work: methodology.

Snapshot

Tier: Open-source engine
Owner: Cloud Native Computing Foundation project (graduated 2018); maintainers from several companies, no owner
Licence model: Apache 2.0; no paid edition; support and managed services from third parties (Grafana Labs, Red Hat, AWS, Google, Chronosphere, PromLabs)
Products scored: Prometheus server and Alertmanager; official exporters (node, windows, snmp, blackbox) counted at half; Grafana, Thanos, Mimir and community exporters not scored
Latest release: 3.15.0, 2026-09-25
Next signal: Type and unit labels to stable, more native-histogram PromQL functions, wider Remote Write 2.0 adoption; no dates
Archetype: Cloud-native metrics engine
Evidence grade: A. Release tags, specifications and docs are primary and consistent; the one conflict is whether the MCP server is official or community.

Scope of the scores: Scores cover the Prometheus server and Alertmanager. Anything that needs an exporter (node_exporter, windows_exporter, snmp_exporter, blackbox_exporter, pve-exporter) or another project (Grafana, Thanos, Mimir, Prometheus Operator) counts half at most and is named in the basis.

Scorecard

Dimension	Score	Direction
Capability today	45.0 / 100	higher is better
Momentum since end of 2022	+1.8 points	higher is better
Credibility	21.0 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	5.0 / 25	lower is better
Integrator fit	12.5 / 20	higher is better
AI leverage	4.5 / 20	higher is better
Ledger Index	57.5 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Server, virtualization and storage (12)	1	1.5	1.5	1.5
Network monitoring (12)	1	1	1	1
Application and service monitoring (10)	2	2	2	2.5
Data collection and scale (12)	3	4	4	4
Alerting and event management (12)	3	3.5	3.5	3.5
Visualisation and reporting (8)	1.5	1.5	1.5	2
Logs and traces (8)	0	0	0.5	0.5
Automation and remediation (8)	2.5	3	3	3
Security and compliance (8)	0.5	1	2	2
New-platform support (VMware exit) (10)	1.5	1.5	2	2
Total / 100	33.4	39.8	43.2	45.0

Year by year: 2016: 33.4 · 2017: 35.8 · 2018: 35.8 · 2019: 39.8 · 2020: 39.8 · 2021: 39.8 · 2022: 43.2 · 2023: 43.2 · 2024: 45.0 · 2025: 45.0 · 2026: 45.0

What moved the score

Year	Domain	Change	Points	Trigger
2017	Data collection and scale	3 → 4	+2.4	2.0 (2017): V2 TSDB with WAL, up to 1M samples/s per node; later Remote Write and Agent mode (2.32, 2021); no native clustering
2019	Alerting and event management	3 → 3.5	+1.2	2.x/Alertmanager (2019): gossip HA clustering, label-based routing trees
2019	Automation and remediation	2.5 → 3	+0.8	2.x (2019): configuration as code; Prometheus Operator CRDs and Ansible collection at half
2019	Security and compliance	0.5 → 1	+0.8	2.x (2019): TLS and basic auth toward scrape targets only
2019	Server, virtualization and storage	1 → 1.5	+1.2	2.x (2019): node_exporter, windows_exporter and community ipmi_exporter at half; no VMware or storage in core
2022	Logs and traces	0 → 0.5	+0.8	2.x (2022): exemplars link samples to traces stored in Jaeger or Tempo
2022	New-platform support (VMware exit)	1.5 → 2	+1.0	2.40 (2022): scrapes KubeVirt and OpenShift endpoints; Proxmox and AHV only via community exporters at half
2022	Security and compliance	1 → 2	+1.6	2.x web-config (2022): native TLS, mTLS and basic auth on endpoints; no RBAC, SSO or tenancy
2024	Application and service monitoring	2 → 2.5	+1.0	2.50 (2024): OTLP metrics receiver; 3.0 native histograms for latency percentiles; no traces or synthetics in core
2024	Visualisation and reporting	1.5 → 2	+0.8	3.0 (2024): rebuilt UI with histogram heatmaps; no dashboards, maps or SLA reports

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-06	2.45: first long-term support release	D12 Packaging and licensing	C
2024-02	2.50: native OTLP metrics receiver	D4 Collection and scale	U
2024-08	2.54: second LTS line	D12 Packaging and licensing	C
2024-11	3.0: Remote Write 2.0	D4 Collection and scale	U
2024-11	3.0: UTF-8 metric and label names for OTel	D11 Ecosystem openness	U
2024-11	3.0: native histograms GA	D4 Collection and scale	V
2024-11	3.0: rebuilt web UI	D6 Visualisation and reporting	C
2025-05	prometheus-mcp server preview	D7 AI-assisted operations	M
2025-07	3.5: type and unit metadata labels	D4 Collection and scale	V
2026-02	3.10: Alertmanager notification metrics	D5 Alerting and events	C
2026-09	3.15: agent-mode WAL and native histogram compaction fixes	D4 Collection and scale	C

Centre of gravity: Collection and scale (5), Packaging and licensing (2), Ecosystem openness (1)
Driver mix: Vision 18%, Customer need 45%, Market window 9%, Upstream 27%, Portfolio 0%

Credibility: 21.0 / 25

Criterion	Score	Basis
Cadence	4.5	Regular minor releases (3.0 2024-11 to 3.15 2026-09) and LTS lines since 2.45 (2023)
Roadmap transparency	4.5	Public roadmap page, design docs, governance repository and GitHub milestones
Say-do	4.5	8 of 8 tracked items GA within 12 months 2023-2026; native histograms and Remote Write 2.0 five months late
Velocity	3.5	One or two substantive features per release; 3.0 (2024) bundled several
Lifecycle stability	4	One-year LTS since 2023; 2.x to 3.0 upgrade with limited breaking changes

Say-do record, 2023 to 2026: 8 commitments since 2023 (LTS, native histograms, OTLP receiver, Remote Write 2.0, UTF-8 names, second LTS, container limits, type and unit labels), all delivered; lags 0 to 5 months. AI evidence: 2 of 2, MCP as 0.x preview.

Commercial risk: not scored

This is an open-source engine: nobody sells it, so there are no commercial terms to score. Its project health is described below.

Security record of the product itself: None found in the KEV catalogue for Prometheus, Alertmanager or the official exporters (the security record).

Technical lock-in: 5.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	Own TSDB block format, open source and documented; YAML configuration; OpenMetrics exposition standard
Export path	1	Remote Write 1.0 and 2.0, HTTP API, snapshots and promtool dump
Stack coupling	1	Standard exporters and OTLP intake; PromQL supported by many back ends
Hardware / cloud coupling	0	Single static binary on any OS and architecture; fully offline
Skills and tooling coupling	1.5	PromQL is specialised but widespread; Prometheus Certified Associate exam

Integrator fit: 12.5 / 20

Criterion	Score	Basis
Partner programme openness	3	No programme, but competing support and managed services from Grafana, Red Hat, AWS, Google, Chronosphere, PromLabs
Multi-tenancy and self-service	0.5	No tenancy in core; needs Mimir, Thanos or a proxy
API and infrastructure-as-code	4.5	HTTP query and management APIs, Prometheus Operator CRDs, official Ansible collection, Helm charts
Skills and certification	4.5	Prometheus Certified Associate from the Linux Foundation; very large community

AI leverage: 4.5 / 20

Strand	Today	Latest step
AIOps on monitoring data	0.5	2020: 2020: GPU metrics via NVIDIA dcgm-exporter add-on; no anomaly detection in core
AI platform stack	0	none
AI-assisted operations	1	2016: 1.0 (2016): predict_linear and deriv in PromQL, rule-based only
Agent openness	3	2025: 2025: prometheus-mcp server in the project organisation, v0.9 to v0.18 (preview)

AI say-do: 2 announced, 1 GA (native histograms), 1 preview (MCP server 0.x), 0 pending, 0 dropped. Prometheus has no machine learning; it is the metrics source other AIOps tools read.

Reading

Prometheus is the metrics collection, storage and alerting engine much of the market builds on, and its 2023-2026 work (LTS lines, OTLP intake, native histograms, Remote Write 2.0) keeps it the reference format rather than turning it into a full monitoring suite. The project delivered every tracked item, most within a few months of target, with no licence change and no owner who could make one. For enterprise infrastructure it needs exporters, Grafana and a long-term store around it, so server, network, hypervisor and reporting depth come from add-ons scored at half.

Open questions and evidence caveats

Scores depend on the project boundary: Alertmanager counted in, exporters at half; a different boundary moves several domains by a point or more.
The capability text calls the MCP server community-built; the AI evidence names a repository in the Prometheus organisation at 0.x. The AI evidence was followed.
Native TLS on web endpoints is placed at the 2022 checkpoint; the research does not name the release.
Scale figures above one server describe external back ends (Mimir, VictoriaMetrics), not Prometheus alone.