Open source scope

OpenSourceOM Core is Apache-2.0 licensed and self-hosted. The free project is designed to help teams defend against external attackers — mapping exposure, attack paths, and which findings matter because an outsider could reach them.

Capabilities aimed at internal risk and enterprise deployment(SAML, multi-tenant RBAC, compliance workflows, platform audit logs) may ship as commercial offerings later. They are not part of the OSS core today.

What is in the open source core

Attack path queries — internet → workload → datastore
Graph-context CSPM rules and CVE prioritization by reachability
Identity blast radius (compromise → reachable assets)
Multi-cloud and Kubernetes inventory collectors
Self-hosted API, CLI, and web console
SIEM, Slack, and Jira export integrations
Community extensibility — collectors, rules, and graph queries in code

Open source vs. commercial (planned)

Open source (OSS)	Commercial (planned)
Attack path queries (internet → workload → datastore)	Insider / internal-threat analysis
Graph-context CSPM and CVE prioritization	Privileged access governance for operators
Multi-cloud + Kubernetes inventory	Multi-tenant RBAC, org/account scoping
Self-hosted API, CLI, and web console	SAML / SSO and enterprise identity integrations
Community collectors and rule packs	Enterprise compliance workflows
Cloud audit ingest as graph context (planned)	Immutable platform audit logs (who used OpenSourceOM)

Cloud provider audit APIs (for example CloudTrail) may later feed the OSS graph as evidence of exposure and attack paths. Platform audit logs — operator actions in the console/API, SSO identity, retention, and auditor export — belong in the commercial offering.

Why this split

External attack defense — exposure, reachability, and path-aware prioritization — is the foundation of graph-native cloud security. Keeping that in open source means any team can run a credible, auditable CNAPP-style stack in their own environment without vendor lock-in.

Internal-threat controls and enterprise identity requirements add operational complexity that many small teams do not need, but large organizations often require. A commercial tier lets us serve those needs without bloating the core repository or slowing community contributions.

Status

The core repository is in active development (Phase 2). Commercial offerings are not available yet — there is no pricing, sales contact, or enterprise SKU at this time.

For phase-level detail and upcoming work, see theroadmap on GitHub. To suggest priorities, open aGitHub Discussion with theroadmap label.

License

OpenSourceOM Core is licensed underApache-2.0. You can inspect, modify, and deploy it without a commercial agreement.