At some point in the near future, companies without a sufficient understanding of what makes the open-source community tick are going to test the limits of mixed source, predicts Geoffrey Moore, managing director of TCG Advisors, a consultancy. "I think there is a potential for backlash from the open-source community against companies that do not play according to the aspirations or ethics of that community," says Moore.

Fallout from this kind of uprising could put a big hurt on a CIO’s infrastructure. For example, open-source projects could be left for dead by their communities, with no one left to support them. Then there’s "forking," in which the open-source code base is used to start a new project that is incompatible with the original version. Finally, there’s the doomsday scenario: malicious hacking of a formerly open-source code base.

CIOs are concerned about getting caught in the middle of this fragile relationship—especially if their software provider goes under. "If I have some proprietary software, I have to worry about disrupting my infrastructure if I need to take it out and then find a replacement for it," says Strasnick. But if the code is open, as is the case with Strasnick’s JBoss middleware system, users can take the code with them to another provider if the relationship sours.

"If JBoss decides to stop supporting my software," says Strasnick, "I will have the source code, and I can simply go find someone else to support it."

Why VCs Don’t Like What CIOs Want

CIOs prefer the open-source business model that Roesch couldn’t sell to potential investors: a services model in which the company sells support for a single, open-source code base.

"I like the services model because all my money goes into implementation and support," says Strasnick. A few well-known open-source companies, such as Red Hat (Linux), JBoss (middleware) and MySQL (database), are built around this model. But because the software code base is open to anyone, barriers to entry for competitors are low.

These companies have to be extremely lean and mean to go up against comparable proprietary software companies. "CIOs expect to pay less for open source," says Forrester’s Goulde. "It has to provide 30 to 50 percent savings." That would seem easy when the software is free, but the software usually isn’t free for the companies that support it; many must provide their own employees to lead, manage and code the open-source products. The unpaid community that appeared around Linux took many years to develop and is the exception rather than the rule. Worse, venture capitalists don’t like the services-only model because the margins on service are invariably lower than those for proprietary software. "The venture community is committed to getting a disproportionate amount of return on its capital," says Moore. "At some point, the company [they invest in] has to have sustainable competitive advantage." This helps explain why open-source companies have been slower to grow than their proprietary counterparts.