Open source software is published with its source code under a licence that lets anyone use it, change it and pass it on. Proprietary software is owned by a vendor that keeps the code private and sells you the right to use it. The comparison of open source software vs proprietary software is usually framed as free against paid, and that framing misleads. For a business the useful questions are who fixes it when it breaks, what it costs over its whole life, how long it will be supported and how hard it would be to leave. Neither kind wins on all four, and nearly every business system contains both.
What the two terms mean
Open source has a precise meaning. The Open Source Initiative’s definition requires, among other things, that the licence allows free redistribution, makes the source code available, permits modified versions and does not restrict what the software is used for. Linux, PostgreSQL, PHP, WordPress and the community edition of MySQL are all open source. So is Microsoft’s .NET, which surprises people who think of Microsoft as the proprietary side of the argument.
Proprietary software is licensed, not given. You pay per user, per server, per processor core or by subscription, and the licence sets out what you may do. Microsoft SQL Server, Windows Server and Microsoft 365 are examples, along with most accounting and CRM packages.
Two further categories are easy to overlook.
Source-available software publishes its code but restricts how you may use it, so it is not open source in the defined sense. Licences also change. In August 2023 HashiCorp moved Terraform, a tool for setting up cloud servers, from an open source licence to its Business Source License, and a group of other companies responded by continuing the open source version under the Linux Foundation as OpenTofu. Redis, a widely used data store, was under a permissive open source licence up to version 7.2, dropped it for the versions that followed and has offered an open source licence again since version 8. A change like this applies to new versions; what was already released stays under its old terms.
Bespoke software, written for your business, is proprietary to whoever holds the copyright. That is not automatically you. Our answer on who owns the source code of bespoke software explains what to check in the contract.
What the choice means for the person paying
| Question | Open source | Proprietary |
|---|---|---|
| Licence cost | Usually none. You pay for hosting, skilled people and any support contract you choose to buy | A licence or subscription, priced per user, per core or per server |
| Who fixes a fault | The project’s maintainers, with no obligation to you. Paid support is often sold by a vendor or a specialist firm | The vendor, under its support terms, while your version is in support |
| Support dates | Published by the project and often short. Each PHP release is supported for about four years | Published by the vendor and often longer. A SQL Server version is supported for about ten years |
| Seeing and changing the code | Yes, if you have the skills or pay someone who has | No |
| Leaving | Nobody can withdraw your right to run the version you have. Lock-in comes from skills and customisation | Depends on the product’s export features and on the contract |
| Finding people | Depends on how widely the technology is used, not on its licence | The same |
Four assumptions that do not hold
Open source is free. There is no licence fee. There is still the cost of installing it, hosting it, upgrading it and employing or hiring people who know it. For a database or a web framework those costs are far larger than the licence would have been, in either camp.
One kind is more secure than the other. Open code can be inspected by anyone, which helps when people do inspect it. Proprietary code has a vendor with a security team. In practice the risk in both cases comes from running a version that no longer receives fixes, or from not applying the fixes that exist. An abandoned open source library and an out-of-support commercial database are the same problem.
Proprietary means supported for as long as you pay. Vendors end support on published dates whatever you would like. SQL Server 2016 stopped receiving free security fixes on 14 July 2026. Our end-of-support pages list the dates for the Microsoft products we see most often.
A system is one or the other. A typical application on the Microsoft stack uses .NET, which is open source, with SQL Server, which is not, and depends on dozens or hundreds of open source libraries. A typical PHP application may sit on a commercially licensed database or use paid plugins. The choice is made component by component.
Licence obligations worth checking
Open source licences come in two broad families.
Permissive licences, such as MIT, Apache 2.0 and BSD, let you use the code in commercial, closed software provided you keep the copyright notices.
Copyleft licences, such as the GPL, add a condition: if you distribute software that includes the code, you must make your own source code available on the same terms. Using such software inside your own organisation does not normally count as distributing it. The AGPL goes further and applies the condition to software that people use over a network.
This matters most if you sell or supply software to customers. MySQL is a familiar example: the community edition is under the GPL, and Oracle sells commercial licences to companies that want to ship MySQL with their own product without accepting the GPL’s terms. Our comparison of SQL Server and MySQL covers that case in more detail.
Licence terms are a legal matter. If you distribute software, ask your developers for a list of the open source components it contains and the licence of each, and take advice on anything under a copyleft licence.
How to weigh a particular choice
For a component that a business system will depend on for years, these questions matter more than the label.
- Who stands behind it? A vendor with a published support policy, a foundation, several companies, or one volunteer.
- When does support for this version end, and what does moving to the next one involve? Frequent releases mean frequent upgrades, which is work someone has to do and pay for.
- What will it cost over five years? Count licences, hosting, upgrades and the people needed to look after it.
- Can we hire for it, or buy support for it, near us?
- What is the way out? Whether the data can be exported in a usable form, and whether another supplier could take the system over.
The same reasoning applies to everyday tools such as office software, with one addition: how easily staff can use the product and exchange files with customers usually outweighs the saving on licences.
A check you can make this week
Ask whoever looks after your main system for a list of everything it depends on: the database, the framework, the operating system and the larger libraries, with the version, the licence and the end-of-support date of each. If nobody can produce that list, that is the finding. On a Windows server, our free end-of-support check script lists the Windows, SQL Server and .NET versions it finds and their dates. A code audit produces the full inventory, libraries included, as part of a written report.