Cloud‑Native Project Promotions & CNCF Growth

• Knative officially graduated from CNCF in Oct 2025, marking a notable maturity milestone for serverless within the cloud‑native stack. (CNCF)

• CNCF continues to host a mix of 34+ graduated and ~36 incubating projects across networking, observability, and automation categories. (CNCF)

• Compared to 2024, this reflects sustained motion at the higher end (2024 saw key graduations like Dapr and cert‑manager). (Palark)

• Mid‑year velocity reports show cloud‑native adoption (Kubernetes, OpenTelemetry, Backstage, Argo/Flux) still climbing with contributor and activity growth. (CNCF)

• Growth of CNCF Silver member companies underscores ecosystem expansion and vendor buy‑in by year‑end. (CNCF)

Governance & New Foundations

• The Linux Foundation’s 2025 annual report highlights multiple new foundation launches and governance expansions across AI, digital infrastructure, and sustainability. (Linux Foundation)

• A major late‑year launch is the Agentic AI Foundation (AAIF) under LF, co‑founded by OpenAI, Anthropic, Block, and supported by AWS, Google, Microsoft, Bloomberg, aimed at open standards for autonomous AI systems. (Techstrong.ai)

• EU‑focused NeoNephos Foundation and LF Decentralized Trust are other 2025 governance movements broadening open source infrastructure authority beyond standard Linux/FOSS stacks. (Linux Foundation, Linux Foundation)

Licensing & Relicensing Dynamics

• Major open‑source license popularity remained anchored in Apache‑2 and permissive families in 2025, based on aggregated community interest. (Open Source Initiative)

• Industry commentary highlights risks and impacts when licenses shift (e.g., relicensing controversies like Redis’s past moves), underscoring compliance volatility that can affect vendor strategy. (NSFOCUS)

• There were no widely documented giant UI libs/base image relicensing sagas at scale in public signals (e.g., React/Lodash governance changes were discussed as community model shifts rather than wholesale relicensing). (The New Stack)

2025 vs 2024 YOY Highlights

• Project promotions: 2025 continued CNCF graduations (e.g., Knative) building on 2024’s list (Dapr, cert‑manager). (CNCF)

• Governance & launches: 2025’s AAIF and other LF entities are new structural plays versus 2024’s more incremental governance evolutions, indicating a sharper strategic pivot toward AI standards and decentralized trust frameworks. (Techstrong.ai)

• Licensing shifts: 2025 saw ongoing community focus on license compliance and popularity rather than headline relicensing battles; the narrative in 2024 emphasized license trend tensions, but not major base image rewrites. (Open Source Initiative)

Founder & Investor Touchpoints

• Founders in cloud‑native should watch graduated projects like Knative as signals of enterprise adoption curves and consolidation opportunities. (CNCF)

• AI infrastructure founders should note the AAIF launch as a potential platform to co‑build open agent standards and attract cross‑platform adoption. (WIRED)

• Investors can use CNCF velocity and LF governance growth stories to benchmark maturity and risk (graduations often presage broader enterprise uptake). (CNCF)

Primary Sources to Bookmark

• CNCF project lists & announcements (Graduated/Incubating/Sandbox) via CNCF official portal. (CNCF)

• Linux Foundation Annual Report 2025 for governance/new foundation context. (Linux Foundation)

• Open Source Initiative and license trend summaries. (Slashdot News)

If you want proof that the AI hype cycle is finally hitting the “deployment” phase—where the rubber meets the road and the checkbooks come out—look no further than this week. We are moving from the “cool demo” phase to the “industrialization” phase, characterized by massive consolidation, rigorous governance, and the frantic cleaning up of cap tables.

The headline, of course, is IBM writing an $11 billion check for Confluent.¹ This isn’t just M&A; it’s a validation of the thesis that real-time data is the circulatory system of the AI economy. But beyond the mega-deal, we saw the “Services Trap” claim another victim (and a subsequent escape attempt) with Robin AI, and the formation of the Agentic AI Foundation—a classic move by incumbents to commoditize the complement.

Here is my analysis of the week’s events, looking past the press releases to see who is actually building a business.

IBM Buys Confluent: The $11 Billion “Plumbing” Play

On December 8, 2025, IBM announced a definitive agreement to acquire Confluent (NASDAQ: CFLT) for $31.00 per share in cash, valuing the enterprise at approximately $11 billion.

My Take

Let’s be clear: IBM isn’t buying a “streaming platform”; they are buying the pipes for the next decade of enterprise IT.

• The Valuation: An all-cash offer at a premium suggests IBM sees this as an existential necessity for their Watsonx strategy. They missed the cloud wars; they refuse to miss the AI data wars.

• The Strategy: This is the Red Hat Playbook part two. OpenShift gave IBM the hybrid compute layer. Confluent gives them the hybrid data layer. If you are a bank running AI agents that need to trade on real-time market ticks, you can’t have your data stuck in a Snowflake warehouse batch-processing overnight. You need “Data in Motion,” and Confluent owns that category.

• The Governance Angle: IBM CEO Arvind Krishna explicitly linked this to “agentic AI.” Agents need context. Confluent provides the context window. By wrapping Confluent in IBM’s governance blanket, they make Kafka safe for the Fortune 500, Blue-washing the open source stack for regulated industries.

Read More

• Why IBM’s acquisition of Confluent could signal an M&A gold rush

• IBM to Acquire Confluent to Create Smart Data Platform for Enterprise Generative AI

• Form DEFA14A for Confluent INC filed 12/09/2025

The Agentic AI Foundation: Commoditizing the Complement

On December 9, 2025, the Linux Foundation announced the Agentic AI Foundation (AAIF) with founding members OpenAI, Anthropic, and Block.

Why Competitors Hold Hands

It’s always suspicious when fierce competitors like OpenAI and Anthropic sit at the same table. But in this case, the strategy is transparent: Commoditize the Integration Layer.

• The Model Context Protocol (MCP): Contributed by Anthropic, this is an attempt to standardize how AI connects to data sources (Google Drive, Slack, etc.). If every model has to build its own integrations, the ecosystem fragments. By making the “socket” standard (MIT licensed), they ensure that their models can plug into any data source. It lowers the switching costs for data, which increases the value of the intelligence (which they sell).

• AGENTS.md: OpenAI’s contribution is essentially a robots.txt for the agent era. It’s a text file that tells coding agents how to behave in a repository. It’s simple, it’s dumb, and it will probably work because developers hate complex config files.

• Goose: Block contributed goose, an Apache 2.0 developer agent. This is a “Reference Implementation.” It keeps the big proprietary players honest by providing a “good enough” open source alternative, ensuring no single vendor locks down the agent runtime.

Read More

• Block, Anthropic, and OpenAI Launch the Agentic AI Foundation

• AGENTS.md

• block/goose on GitHub

Escaping the Services Trap: Robin AI

In a smaller but highly instructional move, Robin AI divested its managed services arm to Scissero on December 10, 2025. While this story is not specifically open source, there are lessons here for all startups.

A common failure mode for startups is sliding from software into services without realizing it. When your model is only mostly right, the “last mile” gets patched with people—and that quietly rewrites your business model and margins. Here’s how that trap compresses your valuation multiple, and how Robin AI engineered a clean fix.

The SaaS Metric Reality

I have written extensively about the Services Trap.

1. The Trap: You build an AI startup. The AI is 80% accurate. To keep enterprise customers happy, you hire humans to fix the other 20%. Suddenly, you aren’t a software company; you’re a tech-enabled law firm.

2. The Multiple: Software companies trade at 10x-20x revenue. Services companies trade at 1x-2x revenue.

3. The Fix: Robin AI realized that to raise their next round or prep for an exit, they had to fix their gross margins. By dumping the humans (and the low-margin revenue) to Scissero—a firm that likes services revenue—Robin AI reverts to a pure-play SaaS profile. It’s a textbook cap table cleanup.

The “Free Puppy” Problem: Apache Tika Vulnerability

The Apache Tika project disclosed a massive 10.0 CVSS vulnerability (CVE-2025-66516) this week.

The Enterprise Reality Check

Open source is free like a puppy, not free like beer. You have to feed it, walk it, and clean up after it.

• The Risk: Tika parses PDFs. Every RAG (Retrieval-Augmented Generation) pipeline in the world uses Tika to ingest corporate documents. This vulnerability allowed attackers to embed malicious code in a PDF resume or white paper and take over the ingestion server.

• The Lesson: This is why “supply chain security” is the new “endpoint protection.” The OpenSSF 2025 Annual Report, released this same week, highlights that we are finally getting serious about signing models and verifying artifacts. If you are running raw open source in production without a vulnerability management strategy, you are just waiting to be a headline.

Emerging Tech: Infrastructure for the Agent Economy

Two startups caught my eye this week because they are solving “boring” problems—which usually means they are solving real problems.

AgentField: Kubernetes for Agents?

• What it is: An Apache 2.0 “control plane” for AI agents.

• My Take: We don’t need more “Agent Frameworks” (looking at you, LangChain). We need runtimes. We need something that handles identity, permissions, and “who shut this thing off?” AgentField is positioning itself as the infrastructure layer—the “Kubernetes”—for autonomous software. If they can solve the “Shadow AI” problem for the CIO, they have a business.

Flowglad: The Billing Nightmare

• What it is: An open source (AGPLv3 core / MIT SDK) payment processor designed for usage-based billing.⁶

• My Take: AI billing is a nightmare. It’s not “per user/month” anymore; it’s “per token,” “per compute minute,” or “per successful action.” Retrofitting Stripe for this is painful. Flowglad is attacking the Net Revenue Retention (NRR) lever directly by making it easy to implement complex, consumption-based pricing models.⁸ The AGPL license is a smart poison pill to keep AWS from strip-mining it.⁹

It’s a Wrap

The week of December 8–14, 2025, wasn’t about shiny new models. It was about Architecture and Economics.

• IBM bought the pipes.

• OpenAI/Anthropic standardized the sockets.

• Robin AI fixed their margins.

The toy phase is over. If you aren’t building for governance, security, and sustainable unit economics, you are officially behind the curve.

KServe

• As of November 2025, KServe was accepted as an incubating CNCF project. (CNCF)

• KServe offers a unified platform for scalable, multi‑framework model serving (both predictive and generative AI) on Kubernetes — making it powerful enough for enterprise‑scale AI workloads. (CNCF)

• It’s already seeing real production adoption across large enterprises in sectors from cloud infrastructure to finance — meaning there’s market demand and proven use cases. (CNCF)

• Commercial angles: managed/hosted AI‑model‑serving platforms; enterprise MLOps support and consulting; inference‑gateway as a service; hybrid‑cloud or multi‑cloud hosting backed by KServe.

Lima

• In November 2025, Lima was promoted to incubating status by CNCF. (CNCF)

• Lima provides lightweight Linux VMs optimized for running containers (e.g. containerd, Docker, Podman) — originally targeted at local dev environments but extending to secure isolation for AI workloads (e.g., sandboxing coding agents). (CNCF)

• Commercial angles: secure local‑dev VM hosting; enterprise sandboxing platforms (e.g. for dev teams, AI‑agent containment, compliance); desktop‑to‑cloud developer tools; managed desktop‑to‑Kubernetes integration services.

OpenFGA

• Also accepted into CNCF incubation in November 2025. (CNCF)

• OpenFGA is an authorization engine designed to implement complex, relationship-based access control (ReBAC) at scale — helping externalize and centralize authorization logic rather than embedding in each application. (CNCF)

• Since its Sandbox adoption, it’s already deployed by hundreds of companies. (CNCF)

• Commercial angles: hosted (SaaS) authorization / identity‑access management; enterprise-grade SLAs and support; consulting or integration services for complex distributed systems; add‑on modules (monitoring, auditing, compliance).

On the macro level, global startup funding saw a dramatic pick‑up in October 2025: about $39 billion was invested globally, up from roughly $34 billion in October 2024. (LinkedIn)

But beneath that headline number lies a more dramatic story, a sector‑level breakout in defense & aerospace. According to data compiled by PitchBook (and reported by Business Insider), startups in aerospace and defense raised over $19 billion in 2025, nearly double the ~$10 billion they raised in 2024. (Business Insider)

Some individual rounds were especially large and emblematic of a structural pivot: for instance, Anduril Industries closed a $2.5 billion raise in mid‑2025. Meanwhile, Saronic Technologies — a maritime‑/autonomous‑vessels startup raised $600 million Series C earlier in the year. (Business Insider)

Why I’m sharing this:

• The jump in overall startup funding signals a resurgence of risk capital, good context if you’re watching commercial open‑source, infrastructure, or deep‑tech sectors (since capital flow tends to shape where new innovation accrues).

• The surge in defense/aerospace suggests investors increasingly view “hard tech + national security + government buy‑in” as a growth vertical, possibly meaning more interest in open‑source tooling that supports hardware, security, supply chain transparency, or “dual‑use” technologies.

• For your community-building around commercial open source startups: this could signal rising opportunity in sectors adjacent to defense or infrastructure, where open-source could play a strategic role.

Sector-Level Takeaways

• AI & AI infrastructure remain center-stage. The large rounds going into cloud-AI infrastructure, model training, data centers, and AI tooling suggest that the “plumbing layer” for next-gen software remains highly investable. (Lambda, other unnamed AI-cloud startups, broad list of $100M+ rounds) Crunchbase

• Defense / aerospace / dual-use hardware & autonomy are seeing a sharp rebound. The ~$19 B raised by aerospace & defense startups in 2025 (almost double 2024) shows renewed investor appetite for “hard tech” with potential government contracts and national-security relevance. Business Insider

• Capital concentration around large rounds, meaning fewer, but much larger, financings. That suggests venture investors are placing bigger bets on a narrower set of potentially transformative companies, which could mean higher entry barriers, but also a rising premium on leverage, uniqueness, and defensibility (e.g. open-source tooling, data infrastructure, governance, compliance, dual-use tech).

🚀 What just happened

• LangChain raised $125 million Series B at a $1.25 billion valuation — officially becoming a unicorn. The round was led by IVP with participation from CapitalG, Sapphire Ventures, and incumbents like Sequoia Capital, Benchmark, and Amplify Partners. (LangChain Blog)

• Alongside the funding, LangChain rolled out major platform updates — a full 1.0 rewrite of its core library, a freshly released orchestration engine LangGraph, and upgraded support infrastructure via LangSmith. The team says the aim is to turn prototype‑style LLM workflows into reliable, production‑ready “agents.” (LangChain Blog)

• Mem0, a startup building a memory‑layer infrastructure for AI agents, disclosed raising $24 million (Seed + Series A) from investors like Basis Set Ventures, Peak XV Ventures, Y Combinator, and others. The funding is intended to support development of persistent memory for agent workflows. (The Economic Times)

• OpenHands, which builds an “open‑source cloud coding agents” platform, raised $18.8 million in Series A led by Madrona Venture Group (with participation from other firms including Menlo Ventures). OpenHands emphasizes a model‑agnostic, enterprise‑secure stack, integrates with GitHub/GitLab/Bitbucket, Slack, and Jira, and offers sandboxed, scalable agent deployments — not just IDE‑centric tools. (Business Wire)

• Early infra‑oriented OSS also got capital: Pangolin, which only recently hit major grassroots traction (GitHub stars, community growth, adoption by individual users), announced a $4.7 million seed round on October 1, 2025. The founders framed the raise as necessary “to grow responsibly” and build sustainable funding rather than rely on donations forever. (pangolin.net)

📈 What this signals — and why it matters

• The “agent stack” is maturing fast. The LangChain round — plus its simultaneous product launch — shows investors and developers view “agents + orchestration + memory + governance” as the next repackaging of software infrastructure. This goes well beyond early‑stage chatbot experiments.

• Infrastructure & tooling — not just models — are winning bets. Mem0, OpenHands, Pangolin: these are not LLM‑model providers, but the underlying scaffolding that enables serious, reusable, scalable AI systems. That’s a major shift in where capital is flowing.

• Open source + VC capital continues to co‑exist (and even thrive). As Pangolin’s blog notes, OSS can bootstrap via community and donations but ultimately needs real runway to scale. These rounds suggest that investors are increasingly comfortable backing OSS‑first infrastructure — even when monetization is early or nascent.

• Enterprise readiness is becoming a key differentiator. OpenHands’ pitch emphasizes sandboxing, governance, cloud‑scale deployment, and model‑agnosticism — attributes appealing to regulated organizations or large engineering teams. That’s not hobby‑hacker appeal anymore.

• We may be witnessing structural long-term shifts — this isn’t just another short-term AI hype cycle. If these tools mature and become stable, they could reshape how software is built (and who builds it). For someone with your background — interested in OSS business models and building a “Maintainer Economy” — this wave could represent foundational infrastructure on which many commercial OSS startups will emerge.

🔭 What to watch next (and why you should care)

• Will these bets pay off commercially, or fizzle if model providers absorb orchestration & memory features themselves? That’s a key inflection point.

• Whether multiple “agent‑stacks” converge or fragment: will LangChain, OpenHands, Pangolin et al. end up interoperable, or competing platform‑standards?

• How open‑source-first projects handle monetization: will they turn toward enterprise SaaS, licensing, or hybrid models — and how will that interact with the ethos of open source?

• Which of these tools get adopted by large enterprises or communities that map onto your own open‑source / COSS network — possibly revealing startup & investment opportunities for your portal or syndicate

  

  .

Traditional metrics are designed to measure a known, defensible business, while open source is often about creating an indefensible asset that generates a defensible advantage elsewhere.

This forces a fundamentally better question. Instead of asking “How fast is the ARR growing?” we need to ask, “Where is the durable, defensible alpha?” In investing, “alpha” is the excess return you get from a genuine edge—an advantage in insight, access, or structure that can’t be explained by just riding a market trend. I’m talking about “alpha in the open”: a persistent, market-beating advantage hiding in plain sight, often right next to the git clone command.

Don’t get me wrong. Traditional startup metrics play a role, especially as the business matures. But that’s not where you find the edge. It’s not where you find the alpha. In open source, alpha isn’t on a financial statement. It’s encoded in the project’s governance model, the subtle power dynamics on a mailing list, or the specific wording of a license that quietly narrows who can build a commercial competitor. It’s in the way a community debates and resolves breaking changes at 2 a.m. on a Sunday. It reveals itself in which companies are quietly funding the core maintainers, where the most active contributors work, or how often the “experimental” branch gets merged into main. It is the practice of finding the moat before it’s even been dug. Finding that kind of alpha requires a different kind of diligence and a different playbook. It’s a playbook that treats repositories, roadmaps, and release notes as primary sources and weighs community health right alongside unit economics and cap tables. This essay is that playbook.

But is Open Source Even Investable?

The numbers don’t lie: The open source software ecosystem has evolved from a hobbyist community into a multi-billion dollar investment category that, when it works, systematically outperforms traditional software.

According to The State of Commercial Open Source 2025 Report, Commercial Open Source (COSS) companies consistently outperformed their peers in fundraising velocity, early-stage valuation and liquidity outcomes. For example, the report found that the median IPO valuations for COSS companies were $1.3 billion (vs. $171 million for closed-source peers), and M&A valuations were $482 million (vs. $34 million for closed-source peers). Additionally, the report shows that COSS companies achieve 91% graduation rates from Seed to Series A versus just 48% for software overall. They command 45% higher valuations and exit at a staggering 28x higher median valuation. The report demonstrates that open source is not only a viable strategy for startups and investors, it is a superior one, particularly for companies building infrastructure software.

Adoption First, Monetization Later

The magic of COSS is that the bottom-up, community-driven adoption model provides natural product-market fit validation long before monetization is even attempted. Innovation is accelerated by a global pool of talent no single company could ever hire. But this is precisely where most investors get it wrong. Success requires a sophisticated evaluation framework that looks past vanity metrics and assesses community health, technical quality, and the viability of a business model in a way traditional due diligence simply cannot.

Identifying market-beating returns in COSS requires a specialized, multi-faceted framework. The core idea is to unify three pillars of analysis: the community, the product, and the market.

Project Health & Community Vitals

A healthy community is the single most valuable asset in open source, providing a compounding advantage through inexpensive R&D, QA, documentation, and marketing. But you have to know how to measure it correctly.

Forget vanity metrics like total GitHub stars. The real signals of a thriving project are found in its rates of change. Look for consistent growth in monthly active contributors, pull request response times under 48 hours, and a predictable release cycle. These metrics prove a project has momentum and is actively maintained.

Forget vanity metrics like total GitHub stars. The real signals of a thriving project are found in its rate of change.

To properly assess an open source project, you must look beyond vanity metrics and evaluate the community’s health across three distinct pillars: its Activity, its Decentralization, and its Culture. Only then can you make a judgment about its long-term sustainability.

The Pulse: Is the Project Alive and Active?

First, measure the project’s vital signs. The key here is not a single number, but the rate of change. A healthy project shows consistent momentum, which you can quantify by tracking the growth of its monthly active contributors. This should be complemented by its pull request merge rate, where a figure above 80% signals an efficient, well-oiled machine. Finally, a time-to-first-response of under seven days for new issues indicates that maintainers are engaged and attentive.

Don’t Let a Single Bus Stop Your Investment

The Bus Factor is an informal software engineering concept. It poses the question, “How many key developers would have to be hit by a bus to cripple the project?” A low bus factor (like 1 or 2) is an existential risk. Another common heuristic is the 50% Rule: If fewer than five people are responsible for over 50% of the commits, you don’t have a community; you have a massive concentration risk.

The Vibe: Is the Community a Place People Want to Be?

Evaluating the health of a community requires going past strictly quantitative data. You must also make a qualitative assessment. This is where you must do the manual work that most investors skip. You need to get a feel for the community’s culture by reviewing the forums, Slack channels, and GitHub discussions. Look for:

• Constructive Communication: Are disagreements handled respectfully, or do discussions devolve into toxic flame wars?

• Maintainer Responsiveness: Are maintainers helpful and encouraging to new contributors, or are they dismissive and absent?

• Governance Clarity: Are there unresolved conflicts over the project’s direction or leadership?

These cultural factors are the leading indicators of future success or failure. A toxic or unresponsive community will inevitably kill enterprise adoption and repel talent.

Technical, Security and License Diligence

To separate hobby projects from enterprise-ready solutions, you must conduct deep technical diligence. If the project has an OpenSSF (Open Source Security Foundation) Scorecard, then look for it to be above 7.0. This is a strong predictor of enterprise-adoption readiness. Use automated tools like SonarQube to assess technical debt. A high debt ratio means the team is firefighting, not building features. And don’t forget the license. The wrong license is a deal-killer. “Viral” GPL licenses can poison a proprietary codebase, while changing licenses, like HashiCorp’s recent BSL shift, alienate the community. A clear, stable, enterprise-friendly license is non-negotiable.

Commercial Validation

Third, you must find commercial validation. A popular free tool is not a business. Community momentum precedes financial metrics by 12–24 months, so you need to look for the early signals. The strongest is enterprise validation. Monitor corporate engineering blogs, conference presentations, and job postings. When a Fortune 500 company adopts a project in production, monetization opportunities typically follow within 18 months.

You can estimate market demand through package manager downloads (is it growing >50% quarterly?). MongoDB had over a million monthly downloads before its Series A. You can also count the number of dependent projects and how that number is growing; the more projects that depend on your project, the more essential it is to the ecosystem.

Count the number of dependent projects and how that number is growing; the more projects that depend on your project, the more essential it is to the ecosystem.

Listen for monetization readiness signals: community requests for SSO and compliance or conference talks on “scaling challenges.” These conversations mean the iron is hot. But timing is everything. Monetize too early, and you alienate your community. Wait too long, and a well-funded competitor will eat your lunch. The optimal window is often right around 10,000 monthly active developers.

Business Models That Work (And One That Doesn’t)

The “open core” model flat-out dominates. Companies like GitLab and MongoDB generate 88% of their revenue from subscriptions, not services. The pattern is consistent and proven: provide immense value in the open source core, but reserve true enterprise features—like security, compliance, and advanced analytics—for the paid tiers.

The “open core” model flat-out dominates. Companies like GitLab and MongoDB generate 88% of their revenue from subscriptions, not services.

The highest-growth segment, however, is managed cloud services. This is the accelerator. MongoDB Atlas grew from a new product to 46% of the company’s total revenue in just five years. Confluent Cloud and HashiCorp Cloud prove the same thesis: enterprises are more than willing to pay to have someone else manage the operational complexity, even for a “free” tool. This is often paired with usage-based pricing, which shows far superior performance by aligning cost to value and reducing adoption friction compared to old-school, per-seat models.

There is also one model that consistently fails for venture-backed companies: professional services. Avoid the “services business trap.” If a project’s only monetization path is support contracts and consulting, run away. These models cannot achieve the scalability or margins that VCs require. HashiCorp generates only $5M from services versus $165M from licenses. The services-only model is a dead end for venture returns.

The open source investment landscape is no longer a niche; it’s a distinct asset class

Defensibility, Moats, and Emerging Trends

Defensibility in open source is different. Your moat isn’t code secrecy; it’s community lock-in. When a project becomes integral to a developer’s workflow, like Git or Docker, the switching costs are built on skill investment and ecosystem integration. The strongest moats come from data network effects, where the product improves with usage—think query optimization in a database or model improvements in an ML platform. The ultimate advantage is ecosystem control. When a project like Kubernetes becomes an industry standard, competitors are forced to integrate with it rather than replace it.

Know Where to Look

The next wave of opportunity will come from applying this playbook to new categories. The fastest-growing segment is AI/ML infrastructure, with 11 of the top 20 trending open source projects in 2024 being AI-focused. Cloud-native security is another-booming category, with projects like Open Policy Agent and Falco solving security challenges that traditional tools can’t handle. Finally, developer productivity tools—testing frameworks, deployment automation, and observability platforms—continue to attract massive investment as teams hunt for 10x efficiency gains.

A New Framework for a New Class

The open source investment landscape is no longer a niche; it’s a distinct asset class offering superior risk-adjusted returns through faster fundraising, higher success rates, and larger exits. But this success is only available to investors who throw out the old software metrics playbook. You must adopt a specialized framework centered on community dynamics, technical quality, and monetization readiness.

The COSS model is proven. But the next 100x return won’t come from finding the next Red Hat. It will be captured by applying a rigorous playbook to the emerging categories of AI, security, and developer productivity. The investors who can successfully separate the high-potential, enterprise-ready platforms from the popular-but-unmonetizable hobby projects in these new arenas will be the ones who capture the disproportionate returns of the next decade.

Citations

• Redpoint Ventures: “Open Source Metrics and Moats” (2024)

• a16z: “Investing in Open Source Startups” (2023–2024)

• OSS Capital: “Open Source Startup Playbook” (2024 edition)

• PitchBook: Commercial Open Source Software VC Report (2023–2024)

• Index Ventures: “Beyond ARR — Metrics for Open Source” (2023)

• Bessemer Venture Partners: “Open Source Go-To-Market Framework” (2023)

• AngelList: Open Source Startup Metrics (2024)

• Sifted: How Open Source Licensing Became the Next Software Moat (2024)

• State of Commercial Open Source 2025 Report (reference cited in question)

• Crunchbase: “COSS Exits and VC Returns” (2023–2025)

• OSS Insight: “Valuations and Exit Trends for Open Source Startups” (2024)

• Software Freedom Conservancy: “Health Indicators in FLOSS Projects” (2024)

• OpenSSF: Project Security Scorecard Adoption Trends (2024)

• GitLab 2024 Annual Report

• MongoDB 2024 Annual Report

• HashiCorp SEC filings (2023–2024)

• Confluent S-1 and 2024 Q2 Results

• Red Hat Annual Reports (2023–2024)

• The New Stack: The Licensing Wars in Open Source (2024)

• TechCrunch: “Why HashiCorp Switched Licenses” (2023)

• CNCF: “2024 Cloud Native Open Source Landscape”

• GitHub Octoverse 2024

This week I attended KubeCon + CloudNativeCon 2025. Here’s what I learned..

Community Momentum Beats Every Metric You’ve Been Taught

Let’s start with the obvious truth most investors still ignore: community momentum is the only reliable leading indicator in open source.

Revenue? A lagging metric. Customer logos? Marketing output. GitHub stars? Vanity. The real signal hides in the base of active users. Sometimes contributor velocity is a sign of community momentum—especially end-user contributions. That’s the closest thing this market has to insider information.

Take Backstage, an open source project led by Spotify. Long before “platform engineering” became a buzzword, Backstage was quietly racking up end-user commits from Fortune 500 teams. That’s not hype—that’s proof of necessity. When your customers are fixing your bugs for you, you’ve achieved gravitational pull. Same with Argo CD: contributor growth foreshadowed its near-total dominance in GitOps. The people closest to the pain built the solution, and the market followed.

The Smart Money Hides in the Weird Niches

Every tourist in cloud native wants to circle Kubernetes. It’s big, it’s shiny, and it feels safe. But the truth is, the best returns are probably no longer next to the flagship—they’re in the weird corners where incumbents don’t bother looking.

Big platforms breed competition and margin compression. Specialized niches breed moats. Look at Crossplane and Cilium: both solved painfully specific problems (multi-cloud control planes, Kubernetes networking) with deep technical leverage and zero early competition. That gave Upbound and Isovalent time to build businesses before the hyperscalers even woke up.

If it feels too niche to matter, that’s often your entry point. By the time everyone “gets it,” you’re priced out.

Mature Projects Win Through the Ecosystem Play

Once a project hits ubiquity, the tech risk disappears—but so does the easy growth. The trick then is not to out-innovate the core; it’s to monetize the surrounding chaos. That’s the ecosystem play.

Kubernetes did it first. Red Hat, Rancher, and every cloud provider turned it into gold by selling what enterprises actually buy—support, integration, security, and simplicity. Prometheus spawned Chronosphere. Argo and Flux fueled Akuity and Codefresh. The pattern repeats because it works: the open core builds trust; the ecosystem captures dollars.

For investors, this is the lowest-risk bet in the open-source stack: technology already proven, market already educated.

The only thing left to test is execution.

Suddenly, giving away your “secret sauce” wasn’t charity—it was the most efficient customer acquisition strategy in the history of enterprise software.

But let’s be clear: Commercial Open Source Software (COSS) is more than a philosophy; it is a business strategy. It is a ruthlessly effective way to reduce friction, build a user base, and monetize the enterprise’s need for reliability. Here is the Kellblog take on how Commercial Open Source works, why it wins, and how to execute it without giving away the farm.

The Core Principle: Free Bits, Paid Insurance

The fundamental confusion about COSS is the difference between the code and the product. In a commercial open source model, the code is released under an OSI-approved license like Apache or GPL. Anyone can view, modify, and redistribute it. But enterprises don’t just buy code. They buy risk mitigation.

The commercial entity wraps that raw code in a layer of value that enterprises are legally obligated or operationally desperate to pay for. This creates a “Dual-Purpose” reality. You have the Community Edition, which is for the hacker, the student, and the startup. It is DIY; if you break it, you keep the pieces. Then you have the Commercial Edition for the Global 2000. It comes with SLAs, indemnification, security patches, and someone to yell at when the database goes down at 3:00 AM on a Saturday.

The business model relies on a simple equation: you achieve ubiquity via open source, and you achieve monetization via enterprise requirements.

How to Actually Make Money

If you are giving the software away, where does the revenue come from? In my experience, successful COSS companies generally leverage one of three dominant strategies.

The first is the Support-First model, pioneered by Red Hat. The software is 100% open, and the vendor sells a subscription for enterprise-grade support. The pitch is simple: “Sure, you can run the free version of Linux. But do you want to explain to your CIO why mission-critical production servers are unpatched?”

The second, and currently most popular, is Open Core (or Feature Tiering). Here, the “core” functionality is free, but certain enterprise essentials (e.g., security features, auto-scaling, auditing, etc.) cost money. This is the model used by Elastic, Grafana, and GitLab. The database is free, but if you want LDAP integration, audit logs, and high-availability tools—features only a large company needs—you need an Enterprise License. The rule of thumb here is that functionality is free, but manageability is paid.

Finally, we have the Managed Service (SaaS) model. The software is free to download, but difficult to operate at scale. Companies like MongoDB (with Atlas) and Confluent (with Cloud) pitch the value of convenience: don’t hire five expensive DevOps engineers to manage your own clusters. Pay us a monthly fee, and we will run our software for you.

The Strategic Weapon: Licensing

Founders often treat licensing as a legal box to check. That is a mistake. Your license is your business strategy.

On one end of the spectrum, you have permissive licenses like Apache 2.0 or MIT. These are “land grab” licenses designed for maximum adoption with zero friction. You want everyone using your code, and you don’t care if Google uses it to build a competing product.

On the other end, you have “viral” or copyleft licenses like GPL. These are defensive. They ensure that if someone uses your code, they have to contribute back, keeping the ecosystem honest.

More recently, we’ve seen the rise of “Source Available” licenses like the SSPL (Server Side Public License). While purists argue these aren’t technically open source, they solve a very specific business problem: they stop AWS from taking your free code and selling it as a service without paying you a dime. You choose a permissive license to grow the funnel, and a restrictive or commercial license to protect the revenue.

Why Go This Route?

Why would a VC fund a company that gives its IP away? The answer is Frictionless Customer Acquisition.

In the traditional proprietary model, you need a sales rep to get a prospect to even look at the software. In COSS, the developer downloads it, builds a Proof of Concept, and falls in love with it before a salesperson ever makes a call. The developer becomes your internal champion.

Furthermore, you benefit from the network effect. More users mean more bugs found and more features contributed. Proprietary software rots; open source software evolves. It also acts as a massive talent magnet. Engineers want to work on cool, open projects, meaning your hiring pipeline is filled with people who are already contributing to your repo.

The Risks and the Bottom Line

I would be remiss if I didn’t mention where this goes wrong. The biggest risk is the “Amazon Problem.” If your license is too permissive, a hyperscaler can fork your code, rebrand it, and sell it as a native cloud service, effectively cutting you out of the loop.

There is also the constant tension between community and commerce. If you lock too many features behind the paywall, the community revolts and forks the project. If you give too much away, nobody buys the Enterprise edition. It is a delicate balance, and maintaining the support staff required to service a massive free user base can be incredibly expensive.

The Bottom Line

Commercial Open Source is the ultimate “have your cake and eat it too” model. It gives you the distribution power of a viral consumer app with the contract values of enterprise software. It offers customers the transparency they crave and the reliability they require.

If you can navigate the licensing minefield and balance the needs of the community against the demands of the shareholders, COSS isn’t just a way to write software—it’s the best way to build a modern software company.

We have moved well past the era where open source was just about Linux infrastructure or MySQL databases. Today, this model undergirds multi-billion dollar public companies and fuels sectors ranging from fintech to cybersecurity. What we are witnessing is a virtuous cycle where technical innovation and business innovation feed one another. The open collaboration improves the software; the commercial models (like SaaS and Open Core) turn that code into sustainable enterprises.

But building a business on free software remains one of the hardest balancing acts in tech. To get it right, you have to navigate a specific evolution of “fit,” choose the right revenue vehicle, and ignore the noise about licensing until you actually have a strategy.

The Three Hurdles: From Project to Profit

Most founders are obsessed with Product-Market Fit (PMF). In the open-source world, PMF is actually the second step, not the first, and certainly not the last.

You start with Project-Community Fit. This is the “is anyone listening?” phase. It doesn’t matter whether your code came from a PhD thesis or a corporate hackathon; if you don’t have a critical mass of contributors and adopters, you don’t have a company. You have a repository. The leading indicator here isn’t revenue; it’s GitHub stars, pull requests, and the transition of the founder from “coder” to “community leader.”

Once the community forms, you hit Product-Market Fit. This is where usage becomes the signal. Are people downloading it? Are they keeping it installed? These early adopters are effectively your marketing funnel, promoting the project long before you hire a VP of Sales.

But here is where companies die: they confuse user love with buyer value. To build a real business, you need Value-Market Fit. While PMF maps to individual developers, Value-Market Fit targets the enterprise buyer. You must answer a brutal question: If the free product satisfies the customer’s needs, why would they ever write a check?

You cannot sell the code. You must sell the operations around the code—security, compliance, scalability, and management. Technical founders must deliberately design “value boundaries” that preserve community trust while ensuring there is actually something left to sell.

Choosing Your Revenue Vehicle

Once you have the fit, you need a model. Historically, we saw the Support and Services model (think early Red Hat). You gave the software away and charged for the “throat to choke.” While it works, it is operationally intensive, low-margin, and incredibly hard to scale.

That evolved into Open Core, the standard for on-premises software. You keep the engine open, but the leather seats and GPS are proprietary. It works, but it requires rigorous discipline to avoid alienating the community by walling off the wrong features.

Today, the dominant model is Open Source as a Service. Cloud computing allowed us to monetize the outcome, not the license. Customers want the function without the headache of hosting it. While founders often lose sleep over “Cloud Capture”—the fear that AWS or Google will just host their code and put them out of business—this is largely a boogeyman.

The reality is that domain authority is the ultimate moat. Enterprise customers don’t just want hosting; they want freedom from vendor lock-in, they want access to the creators, and they want the deep expertise that only the team who wrote the code can provide. No hyperscaler can replicate the roadmap control of the original authors.

The Go-To-Market Reality

Too many early-stage companies let legal considerations drive business strategy. Let’s be clear: the license is a go-to-market enabler, not a substitute for one. Figure out your product strategy, identify your customer, and then pick the license (usually a permissive one like MIT or Apache) that greases the skids for adoption.

When you build the funnel, you are managing two synchronized roadmaps. You have an open track to drive awareness and a proprietary track to drive revenue. The best companies master a dual engagement model: a bottom-up, self-serve motion to capture developer enthusiasm, and a top-down enterprise sales motion to capture the budget.

If you focus too much on enterprise features, you kill the community. If you focus too much on the community, you starve the business.

The Road Ahead

We are entering Open Source 3.0. Proprietary companies are releasing their own projects, and AI is reshaping how code is generated. But the fundamental truth remains: the most successful companies are those that master the intersection of community volume and enterprise value. It is a difficult craft, but it is currently the most efficient mechanism we have for creating software and building enduring businesses.