OpenSource Risk Experts
Get a free exposure review

ABOUT

An independent open source risk advisory, built around the relicensing wave.

OpenSource Risk Experts is an independent open source risk advisory for the enterprise. We advise CISOs, general counsel, and procurement and engineering leaders on the license exposure buried in the open source they run, and we are paid only by the buyer.

BUYER SIDE

We sit on your side of the table in every negotiation and every audit. The vendor's interests are not our interests.

NO RESALE

We carry no software to push and no quota to hit. A recommendation to do nothing is one we can make freely.

CONFIDENTIAL

What we find stays between us. Engagements are confidential by default, and findings are never anonymized into someone else's sales deck.

ABOUT THE FIRM

A practice built around one risk that most firms still miss.

We were built around the relicensing wave, when projects the enterprise had treated as permanently open began moving to source available terms overnight. HashiCorp moved Terraform, Vault, and Consul to the Business Source License as of August 2023. Redis moved to the SSPL and the RSALv2 as of March 2024. Elasticsearch and Kibana moved to the SSPL as of 2021, and MongoDB did so in 2018.

We speak the difference between the Business Source License, the Server Side Public License, and the GNU AGPL plainly, and we translate it into the language of exposure, cost, and containment. We provide commercial and licensing risk advisory, not legal advice, and we point you to your own counsel for interpretation and compliance questions.

THE PEOPLE

Who runs the practice.

Both advisors bring 20 years across enterprise software and open source. Every assessment and case study on this site is authored by one of them.

Fredrik Filipsson

ADVISOR · LICENSING & NEGOTIATION

Fredrik brings 20 years across enterprise software and open source, spanning licensing, commercial negotiation, and vendor strategy. He guides buyers through relicensing events, from HashiCorp’s Business Source License move to the Redis SSPL shift, quantifying exposure and negotiating commercial terms that match real usage.

Morten Andersen

ADVISOR · GOVERNANCE & REMEDIATION

Morten brings 20 years across enterprise software and open source, with a focus on governance, SBOM, and technical remediation. He helps engineering and procurement teams map dependency exposure, build OSPO approval gates, and execute fork or migration plans that remove lock-in.

COMMON QUESTIONS

Questions buyers ask.

What does an independent open source risk advisory do?

An independent open source risk advisory maps the open source you run, quantifies the exposure created when a project changes its license, and helps you contain it. Because we take no vendor fees and resell no software, the advice reflects your risk rather than someone else's sales target.

Are you a law firm?

No. We provide commercial and licensing risk advisory, not legal advice. We map and quantify exposure from the buyer side. For interpretation of license terms and compliance questions, we recommend you engage your own counsel.

How are you paid?

We are paid only by the buyer. We do not resell licenses, take referral fees, or hold a position in any project we assess.

Who do you work with?

We work with CISOs, general counsel, procurement leaders, and engineering leaders who carry production exposure from open source that has relicensed, such as HashiCorp, Redis, and Elastic.

CONTAINMENT

Map your blast radius before it spreads.

A confidential open source license risk assessment. Independent, buyer side, paid only by you.

Not ready to talk? Read the free open source license risk guides first.

Get a free exposure review