U.S. Open Source Services Market

The National Institute of Standards and Technology (NIST) said on 15 April 2026 that Common Vulnerabilities and Exposures (CVE) submissions rose 263% between 2020 and 2025, and that its National Vulnerability Database would now enrich first the flaws in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog and in software used by the federal government, according to the NIST announcement. American organisations running Linux, Kubernetes, PostgreSQL and Kafka can no longer wait for a free public score on every flaw; more of them are paying someone to watch their open source for them. The U.S. open source services market covers what American organisations pay for support and maintenance subscriptions, managed operation, integration and deployment, consulting, and training and certification built around open source software. Douglas Insights sizes it at USD 12.7 billion in 2025, from about 128,000 paying accounts at an average annual spend of USD 99,000, and at USD 43.6 billion in 2035, a revenue CAGR (compound annual growth rate) of 13.16%. The United States is 88.5% of the North America row of our worldwide Open Source Services Market report, the study sits in our enterprise software coverage, and every figure follows the Douglas Insights research methodology.

Which U.S. open source services line earns the most: support subscriptions, managed operation or integration?

Support and maintenance subscriptions earn the most U.S. open source services revenue, 38.0% of 2025, USD 4.82 billion, because renewals compound every year. Managed services grow fastest, 16.0% a year, from USD 3.29 billion to USD 14.5 billion by 2035.

Support subscriptions lead at USD 4.82 billion, slightly above the 37.4% share in our worldwide model, because American banks, insurers, hospitals and federal agencies standardised early on Red Hat Enterprise Linux, OpenShift and supported PostgreSQL and treat the yearly subscription as an audit requirement rather than an option. They grow 11.8% a year to USD 14.7 billion as each renewal adds cores, clusters and nodes. Managed services, USD 3.29 billion, are open source engines run for the customer, from MongoDB Atlas and Elastic Cloud to hosted Kafka and Kubernetes. They grow fastest, 16.0% a year, because an operated cluster costs less than the engineers needed to run it: MongoDB’s Atlas revenue rose 29% to USD 1.81 billion in the year to January 2026, 73% of the company’s USD 2.46 billion total, its results of 2 March 2026 show. By 2035 managed services almost match support at 33.3% of value.

Integration and deployment, USD 2.34 billion, cover the projects that put Kubernetes platforms, Terraform pipelines and data streaming into production; they grow 12.8% a year. Consulting, USD 1.52 billion, grows slowest, 10.6% a year, because American buyers now prefer fixed subscriptions to open-ended advice. Training and certification, USD 697 million, grows 12.2% as employers certify Linux, Kubernetes and Ansible skills rather than hire scarce specialists. Service-type values for 2035 sum to USD 43.4 billion, 0.51% below the headline. The databases that much of this support sits on are sized in our U.S. Relational Databases Software Market report.

Why does U.S. spend per open source account rise 4.20% a year to 2035?

U.S. spend per open source account rises 4.20% a year, from USD 99,000 in 2025 to USD 149,400 in 2035, because managed operation, AI data stacks, security assurance and hybrid automation add 5.60 points before restraints take 1.40 points.

Paying accounts grow faster than spend, 8.60% a year, from about 128,000 to 292,000, as startups and mid-sized firms buy hosted engines instead of running them. America invests heavily in the software these services keep running: private fixed investment in software reached USD 751 billion in 2025, up 9.52% from USD 686 billion in 2024, according to Bureau of Economic Analysis (BEA) data. Four drivers make up the gross spend leg.

Managed operation replacing in-house teams: 2.00 points

Managed operation adds 2.00 points. Each workload moved from a self-run cluster to Atlas, Elastic Cloud or a hosted Kafka service is billed at several times its old support fee, because the provider now carries the pager. Elastic Cloud revenue rose 22% to USD 837 million in the year to April 2026, against 17% for Elastic’s total of USD 1.74 billion, its results of 28 May 2026 show.

AI data stacks: 1.60 points

AI adds 1.60 points. Retrieval, vector search, event streaming and model serving run mostly on open source engines, and U.S. firms building them buy support and managed capacity for each new layer; IBM’s data software grew 22% and automation software 18% in the fourth quarter of 2025, its results of 28 January 2026 state.

Security assurance and provenance: 1.30 points

Security adds 1.30 points. The 263% rise in CVE submissions and NIST’s narrower enrichment leave buyers needing patched, signed and documented builds; Chainguard, which sells hardened open source images, raised USD 356 million at a USD 3.5 billion valuation on 23 April 2025 after its annual recurring revenue grew sevenfold to USD 40 million, Fortune reported.

Hybrid cloud automation: 0.70 points

Automation adds 0.70 points. Terraform, Vault and Ansible move from free tools to supported platforms as American enterprises standardise them across clouds; IBM completed its purchase of HashiCorp on 27 February 2025. The four contributions, 2.00 + 1.60 + 1.30 + 0.70, give 5.60 points.

What slows U.S. open source services: self-support, hyperscaler bundles or budget discipline?

Three restraints remove 1.40 points from U.S. spend per open source account, leaving 4.20% a year: self-support and community builds take 0.60 points, hyperscaler-bundled services 0.50 points and budget discipline 0.30 points.

Self-support is the largest brake. Open source code is free to run, so American technology companies with strong platform teams use community builds, rebuilt Linux distributions and forks rather than paid subscriptions; every engineer who can patch PostgreSQL or Kubernetes in house replaces part of a support contract. Douglas Insights removes 0.60 points. The cost of that engineer sets the trade: the Bureau of Labor Statistics (BLS) puts the median pay of U.S. software developers at USD 135,980 in May 2025, across 1,717,800 jobs, in its Occupational Outlook Handbook.

Hyperscaler bundles remove 0.50 points. Amazon Web Services, Microsoft Azure and Google Cloud run open source engines such as PostgreSQL, Redis-compatible caches, Kafka and Kubernetes as their own managed services and include support in the cloud bill, so revenue that a specialist would earn appears as cloud infrastructure instead. Budget discipline removes 0.30 points, as FinOps teams cut idle clusters and push consulting into fixed-price work; the security tools that compete for the same budget are sized in our U.S. Cloud Application Security and Vulnerability Management Market report.

Which U.S. states buy the most open source support, and why does Virginia grow fastest?

California buys the most U.S. open source services, USD 2.28 billion or 18.0% of 2025, Douglas Insights estimates. Virginia grows fastest, 14.8% a year to USD 3.02 billion by 2035, with Texas close behind at 14.6%.

California leads because Silicon Valley, Los Angeles and San Diego hold the densest cluster of software firms and AI startups, the heaviest buyers of managed MongoDB, Elastic and Kafka; it grows 13.6% a year. Virginia, USD 760 million, grows fastest because federal agencies and the contractors around Northern Virginia must document how every open source component is built and patched, and buy supported, FedRAMP-authorised distributions to do it. Texas, USD 1.14 billion, grows 14.6% as Dallas, Austin and Houston add bank, airline, energy and chip-design headquarters. New York, USD 1.27 billion, grows 12.4% on banks and insurers that already pay for Red Hat and supported databases.

Washington, USD 760 million, carries Seattle’s cloud and software firms, which often self-support and so grow at 13.4%. The rest of the South, USD 2.28 billion, includes Georgia, Florida and North Carolina banks, retailers and hospital systems; the Midwest, USD 1.77 billion, and the rest of the Northeast, USD 1.27 billion, grow 12.4% and 12.2% on manufacturers, insurers and universities modernising older Linux estates. State values for 2035 sum to USD 44.1 billion, 1.01% above the headline; in the data table the row labelled Global holds the U.S. total, USD 12.7 billion in 2025.

Who sells open source services to American organisations after IBM’s HashiCorp and Confluent deals?

IBM sells the most U.S. open source services, about 14.5% of 2025, USD 1.84 billion, through Red Hat, HashiCorp and Confluent, Douglas Insights estimates. With MongoDB and Elastic the top three hold about 26.0%; the rest is fragmented.

The shares are Douglas Insights estimates because no supplier reports U.S. open source services revenue on its own. IBM’s software revenue rose 11% to USD 30.0 billion in 2025 and Red Hat grew 10% in the fourth quarter, its January 2026 release shows; the HashiCorp purchase and the Confluent deal, which IBM completed on 17 March 2026 according to its first-quarter 2026 filing, turn it into the default vendor for supported infrastructure code in American enterprises. GitLab’s revenue rose 26% to USD 955 million in the year to January 2026, with 1,456 customers paying more than USD 100,000 a year, up 18%, its results of 3 March 2026 state.

Specialists win where one engine matters. EDB and Percona sell PostgreSQL and MySQL support to firms leaving commercial licences; Chainguard sells hardened images to engineering teams; SUSE and Canonical compete for Linux and Kubernetes subscriptions outside the Red Hat base; Accenture, Deloitte and regional integrators earn the integration and consulting lines. Scale matters most in support, where a vendor that ships patches for thousands of packages within hours can sign multi-year federal and bank contracts; it matters least in training, where the Linux Foundation’s certifications and vendor courses compete on price.

What does open source support cost a U.S. organisation, from a USD 878.90 RHEL subscription to six-figure contracts?

A U.S. organisation spent an average USD 99,000 on open source services in 2025, Douglas Insights estimates, from USD 878.90 a year for one standard RHEL virtual server subscription to multi-million-dollar managed and support contracts at the largest banks.

List prices come from Red Hat’s store; the other bands are Douglas Insights estimates from company disclosures. Premium RHEL support costs 62.6% more than Standard, the price of faster response, and that gap is the market’s logic in miniature: buyers pay for time saved when something breaks. The average account spend of USD 99,000 equals 72.8% of one median software developer’s pay, which is why mid-sized American firms buy support and managed operation rather than hire a dedicated open source engineer. Elastic counted more than 1,720 customers paying over USD 100,000 a year at April 2026, up from 1,510 a year earlier, its release shows. The price leg reaches about USD 103,200 per account in 2026.

Which U.S. rules push buyers toward paid open source support: SSDF 1.2, SBOM elements or CMMC?

Three U.S. rule sets push buyers toward paid open source support: Executive Order 14306 of 6 June 2025 and NIST’s draft SSDF 1.2, CISA’s 2025 SBOM minimum elements, and the Pentagon’s CMMC rule in force since 10 November 2025.

Executive Order 14306, signed on 6 June 2025, struck parts of the January 2025 order on software security but kept NIST’s duty to publish a preliminary update to the Secure Software Development Framework (SSDF) by 1 December 2025, the order’s text shows. NIST announced the draft SSDF version 1.2, SP 800-218 Revision 1, on 17 December 2025, with comments due by 30 January 2026, according to NIST’s Computer Security Resource Center. Software sellers to federal agencies must show how they build and patch the open source inside their products, work that supported distributions and hardened images make easier.

CISA asked for comment on its draft 2025 Minimum Elements for a Software Bill of Materials (SBOM), updating the 2021 elements, in a Federal Register notice of 22 August 2025, with comments due by 3 October 2025. Defence contractors face the Cybersecurity Maturity Model Certification (CMMC) rule, effective 10 November 2025, with phase 2 from 10 November 2026, Squire Patton Boggs explained. Each rule turns a free download into a component someone must document, which is why Virginia grows fastest.

What if AI stacks multiply paying accounts: where does U.S. open source services spending land in 2035?

The U.S. open source services market ends 2035 between USD 32.9 billion and USD 55.5 billion across our three cases, around a base of USD 43.6 billion. The pace at which new accounts start paying sets most of the spread.

In the slower case hyperscalers absorb more managed open source into their own bills, more technology firms self-support and federal SSDF and SBOM duties stay voluntary for most private buyers. In the faster case AI agents and data platforms multiply small paying accounts and CMMC phase 2 pulls thousands of defence suppliers into supported builds. One extra point of yearly account growth adds USD 4.19 billion to 2035 U.S. open source services value; one point less removes USD 3.86 billion.

Our 13.16% sits just below the 13.2% North America rate and the 14.52% worldwide rate in our global model, because the United States already pays for more of its open source than Asia Pacific, which grows 16.6% a year from a lower base.

Douglas Exclusive: the U.S. Open Source Assurance Ledger

The U.S. Open Source Assurance Ledger is a Douglas Insights estimate, not an official register, built from 9 primary documents dated February 2025 to May 2026, tracking how security duties and supplier deals move open source from free to paid.

The finding, a Douglas Insights estimate: U.S. open source services equal 1.69% of the USD 751 billion that American businesses invested in software in 2025. If software investment grows 7.0% a year to about USD 1.48 trillion in 2035, our USD 43.6 billion forecast lifts that ratio to 2.95%. In other words, Americans will not write proportionally more open source code; they will pay proportionally more to have it patched, documented and run, because the public vulnerability service is shrinking its coverage while federal rules widen the paperwork.

How does the methodology turn 128,000 paying accounts into USD 12.7 billion?

Our methodology multiplies about 128,000 U.S. organisations paying for open source services in 2025 by an average annual spend of USD 99,000 to reach USD 12.7 billion. Accounts come from firm-size bands; spend from five service types.

The model covers 9 states or regions, 5 service types, 2 deployment modes and 2 organisation sizes, and uses 92 data points, 21 sourced and 71 modelled. Arithmetic: 128,000 x USD 99,000 = USD 12,672 million; 12,672 x (1.0860 x 1.0420)^10 = USD 43,634 million, or USD 43.6 billion. Paying accounts reach about 139,000 in 2026 and 292,000 in 2035; spend per account reaches USD 103,158 in 2026.

Two cross-checks agree. First, USD 12.7 billion is 88.5% of the USD 14.3 billion North America row of our worldwide open source services model, in line with the U.S. share of North American software investment. Second, the disclosed revenue of MongoDB, Elastic and GitLab, USD 5.16 billion worldwide, is consistent with our estimated U.S. shares once Americas splits are applied. Subscription-style buying across IT is set in context in our Everything as a Service Market report. AI tools help draft the text and automated checks test the arithmetic and links; the Douglas Insights research desk chooses the sources, builds the model and approves publication, as our editorial standards explain.

Sources

1. National Institute of Standards and Technology NIST Updates NVD Operations to Address Record CVE Growth (2026)
2. NIST Computer Security Resource Center Draft SSDF version 1.2 (SP 800-218 Rev. 1) (2025)
3. U.S. Government Publishing Office Executive Order 14306 (2025)
4. CISA, Federal Register Request for comment: 2025 Minimum Elements for a Software Bill of Materials (2025)
5. U.S. Bureau of Economic Analysis via FRED Private fixed investment: Software (2026)
6. U.S. Bureau of Labor Statistics Software Developers, Occupational Outlook Handbook (2026)
7. IBM via SEC IBM fourth-quarter 2025 results (2026)
8. IBM IBM completes acquisition of HashiCorp (2025)
9. MongoDB via SEC MongoDB fourth quarter fiscal 2026 results (2026)
10. Elastic via SEC Elastic fourth quarter and fiscal 2026 results (2026)
11. GitLab via SEC GitLab fourth quarter fiscal 2026 results (2026)
12. Red Hat RHEL Server (virtual) store page (2026)

What counts in the U.S. open source services market, and what is excluded?

The U.S. open source services market counts what American organisations pay for support, managed operation, integration, consulting and training around open source software. Proprietary software licences, cloud infrastructure billed separately, unpaid community support and hardware are excluded.

The by-service split covers support and maintenance subscriptions, managed services, integration and deployment, consulting, and training and certification; the by-deployment split covers cloud and on-premises; the by-organisation split covers large enterprises and small and medium enterprises; the by-state split covers California, Texas, New York, Washington, Virginia, the rest of the West, the rest of the South, the rest of the Northeast and the Midwest. Spend is counted where the buying organisation is based, not where the supplier is.