Another limiting factor is that it’s next to impossible to build a business around open source in niche markets or in vertical industries. Only a small percentage of downloaders will pay for support from vendors (for example, Snort has 100,000 regular users, but only 800 have signed up for support), and developer and user communities won’t grow unless the software is used by many, many people. So big, successful open-source products have certain things in common: They are broadly applicable across many types of companies and industries, and they tend to be in areas that companies don’t believe provide a competitive advantage (such as infrastructure) because everyone—including competitors—will have access to the software source code.

Yet even if the open-source software qualifies on all these fronts, building a business around it will still be difficult unless the software is complex and is an important part of keeping the business running. In this case, CIOs, especially those in small or midsize companies with small staffs, cannot afford to go without commercial support. Indeed, support is consistently the biggest concern of CIOs on Forrester Research’s surveys, according to Goulde. "We need a vendor to take a portion of the risk if we’re going to go with any software package," says NIH Federal Credit Union’s Drake.

And CIOs always prefer to go with a big, established vendor for support rather than a small startup. That’s why MySQL, for example, has formed partnerships with Hewlett-Packard and Dell to support its open-source database. MySQL takes a cut of the proceeds, and CIOs get the warm-and-fuzzies from knowing that a big vendor is standing behind the product, according to MySQL CEO Marten Mickos.

Yet the combination of CIOs’ nervousness about small vendors and the venture capital community’s reluctance to back open-source software means that CIOs will see more and more mixed-source sales pitches in the coming years. It pays to vet these vendors carefully (see "Your Open-Source Checklist," Page 52).

The ROI of Trust

For his part, Roesch believes that the Snort community will survive. "Check Point needed education about why it’s important to keep it open, and they get it," says Roesch. Part of that education was that the open-source development model creates relationships between project owners and users that cannot be duplicated in the proprietary world. "A lot of the guys buying Sourcefire software are people who started using Snort in college, and now they’re bringing it into their companies," he says. "It’s hard to quantify the value of being able to go into a sales meeting against big vendors like Cisco and having someone [from the prospect company] ask for your autograph."