Open-source CSPM scope

OpenSourceOM Core is Apache-2.0 licensed and self-hosted. The free project is designed to help teams defend against external attackers — mapping exposure, attack paths, and which findings matter because an outsider could reach them.

Capabilities aimed at internal risk and enterprise deployment (SAML, multi-tenant RBAC, compliance workflows, platform audit logs) may ship as commercial offerings later. They are not part of the OSS core today.

What is in the open source core

Attack path queries — internet → workload → datastore
Graph-context CSPM rules and CVE prioritization by reachability
Identity blast radius (compromise → reachable assets)
Multi-cloud and Kubernetes inventory collectors
Self-hosted API, CLI, and web console
SIEM, Slack, and Jira export integrations
Community extensibility — collectors, rules, and graph queries in code

Open source vs. commercial (planned)

Open source (OSS)	Commercial (planned)
Attack path queries (internet → workload → datastore)	Insider / internal-threat analysis
Graph-context CSPM and CVE prioritization	Privileged access governance for operators
Multi-cloud + Kubernetes inventory	Multi-tenant RBAC, org/account scoping
Self-hosted API, CLI, and web console	SAML / SSO and enterprise identity integrations
Community collectors and rule packs	Enterprise compliance workflows
Cloud audit ingest as graph context	Immutable platform audit logs (who used OpenSourceOM)
Workload package inventory (Phase 4) and secret or malware findings on that storage (Phase 5)	Classification of object bodies and database rows

om scan aws stores CloudTrail management events, om scan azure stores Activity Log events, and om scan gcp stores Admin Activity audit logs, from the last 24 hours on the identity and resource they name, when that resource is on an exposed path. Path queries return those events with the path. Data Access logs are not collected. Platform audit logs — operator actions in the console/API, SSO identity, retention, and auditor export — belong in the commercial offering. Phase 4 and Phase 5 stay in core: packages, secrets, and malware on storage an outsider can reach. Reading object bodies and database rows to classify customer data does not.

Why this split

External attack defense — exposure, reachability, and path-aware prioritization — is the foundation of graph-native cloud security. Keeping that in open source means any team can run a credible, auditable CNAPP-style stack in their own environment without vendor lock-in.

Internal-threat controls and enterprise identity requirements add operational complexity that many small teams do not need, but large organizations often require. A commercial tier lets us serve those needs without bloating the core repository or slowing community contributions.

Status

The core repository has shipped Phase 3. CSPM rules, blast radius, Kubernetes ingest, exports, the collector plugin SDK, and the Helm chart are in the tree, along with inventory-backed CVEs, crown-jewel datastores, attack-path findings, and cloud audit context from CloudTrail, Activity Log, and Admin Activity logs. Phase 4 and Phase 5 are open and not in the tree yet: package inventory from persistent workload storage, then secret and malware findings on that storage. How to run what has shipped is covered from Getting started through Plugins. Commercial offerings are not available yet — there is no pricing, sales contact, or enterprise SKU at this time.

For phase-level detail and upcoming work, see the roadmap on GitHub. To suggest priorities, comment on an open issue, or open a GitHub Discussion with the roadmap label when the change is not tracked yet.

License

OpenSourceOM Core is licensed under Apache-2.0. You can inspect, modify, and deploy it without a commercial agreement.

Questions

Is OpenSourceOM free to use?

The core is Apache-2.0. You can inspect, modify, and run it without a commercial license. There is no paid SKU, pricing page, or sales contact today.

What is outside the open-source core?

Insider-threat analysis, SAML and SSO, multi-tenant RBAC, audit logs of who used the console, and classification of object bodies and database rows are planned outside the open-source core. Attack paths, CSPM, collectors, workload package inventory, and the self-hosted API stay in core.