Most teams say they want “AI automation.”
What they actually need is boring: custom workflows wired into messy systems.
A vendor can sell you a UI. They can’t sell you the last mile that makes it work inside your org.
Why this is happening now
GitHub crossed 180M+ developers with 36M new signups in 2025. The CNCF survey reports 89% of orgs use cloud native tech and 93% use or evaluate Kubernetes.
But governance maturity is lagging. The Linux Foundation reports only 34% of orgs have a defined open-source strategy and only 26% have an Open Source Program Office.
Most teams run OSS in production without vendor-grade controls.
AI made customization unavoidable
AI shifted value away from feature checklists and toward integration and policy.
The real work now is:
- Wiring context from your systems into the model
- Enforcing access rules, approvals, and audit trails
- Measuring quality so it doesn’t silently drift
GitHub reports 80% of new developers use Copilot within their first week. That lowers the friction to evaluate and integrate tools.
A quick rubric: SaaS vs open source vs building
Answer these four questions. If you score high on two or more, you’re usually in open-source territory.
1) Integration depth
Low integrations → SaaS. Deep internal systems → Open source.
2) Data sensitivity and audit needs
Low risk → SaaS. Regulated data, audit trails, approvals → Open source or build.
3) Change frequency
Stable workflow → SaaS. Weekly rule changes and exceptions → Open source.
4) Unit economics
Per-seat is fine → SaaS. Usage spikes and token burn matter → Open source.
Build only if you can commit to permanent ownership.
Concrete examples: where OSS keeps winning
When infrastructure becomes too important, governance beats branding.
Redis changed its license. The ecosystem forked to Valkey, backed by the Linux Foundation and major cloud providers.
Terraform changed its license. The ecosystem forked to OpenTofu, now in the CNCF Sandbox.
PostgreSQL shows the hybrid outcome: open core, managed ops when you need it.
The tradeoff: ops burden and supply chain risk
Open source trades vendor lock-in for ownership.
One estimate puts the five-year fully loaded cost of a major OSS component around $135K once you include setup, maintenance, and security work.
Security is the other tax. OpenSSF expects supply chain attacks to keep rising. Maintainers get phished. Dependencies drift.
If you go OSS, do it like you mean it. Pin versions, maintain an SBOM, monitor vulnerabilities, put it behind SSO, add tracing, and assign a named owner.
Action steps
1) List your top 5 cross-tool workflows. Circle the one with the most handoffs and clear failure cost.
2) Run a 2-week proof of concept on an OSS core. Ship one end-to-end path. Example: support triage → enrichment → draft response → human approval → logging.
3) Add guardrails on day one. Pin versions, back up state, put it behind SSO, add tracing, and assign a named owner. If you don’t want pager duty, pay for a managed offering built on the same OSS.
Sources
- https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/
- https://www.cncf.io/reports/cncf-annual-survey-2024/
- https://www.linuxfoundation.org/blog/the-state-of-open-source-software-in-2025
- https://canonical.com/blog/state-of-global-open-source-2025
- https://openssf.org/blog/2025/01/23/predictions-for-open-source-security-in-2025-ai-state-actors-and-supply-chains/
- https://words.filippo.io/compromise-survey/
- https://quandarypeak.com/2025/12/unseen-costs-and-latent-risks-of-oss/
- https://opentofu.org/
- https://www.linuxfoundation.org/blog/a-year-of-valkey
- https://survey.stackoverflow.co/2024/
I reply to all emails if you want to chat: