Editions

Vista Platform ships as a free, open-source Core plus two paid editions. An edition is a licensing boundary that decides whether a capability exists in a build at all. It is not the same thing as a tier — tiers are commercial packaging that an operator authors, and only the MSP edition can author them.

Anything not listed on this page is Core.

Core

Free and open source. One team securing its own estate.

Everything not listed as Enterprise or MSP below. Full discovery, the complete crypto inventory and CMDB, compliance evaluation against the six free frameworks, CBOM generation and CycloneDX export, RBAC, local users and invitations, audit logging, RLS tenant isolation, the mTLS service mesh, and the sensor and agent source.

Enterprise

A company with auditors and an identity provider.

Core, plus compliance authoring, federated identity, audit-grade CBOM evidence, external system integration, and the regulated framework catalog.

MSP

Selling this as a service to others.

Enterprise, plus the multi-tenant management plane. Note that tenant isolation itself is Core — MSP sells the plane that manages tenants, not the model that isolates them.

Paid capabilities

Why each of these is paid

Enterprise: compliance authoring

Core keeps the full evaluation + materialization engine and the free frameworks; authoring your own policy and retuning shipped thresholds is the paid surface.

custom_policies · threshold_overrides

Enterprise: CBOM evidence

Core generates CBOM artifacts and exports CycloneDX. Signing, attestation layers, and drift comparison are the audit-grade surface.

cbom_signing

Enterprise: identity

Core ships local users, invitations, and RBAC. Federated identity in all three flavors (tenant OIDC/SAML, social signup, staff SSO) is paid.

sso_saml

Enterprise: monetization

The tenant-facing self-service billing surface — subscription, invoices, plan change, payment portal — is served by admin-service/ee/billingapi (/my-billing/**). Core mounts none of it, and there is nothing for it to show: a Core deployment has no subscription, no invoices and no payment provider. Tier ASSIGNMENT and usage-against-limits stay Core, so entitlements still resolve and Settings → Usage & Limits still works.

billing_portal

Enterprise: white-label

Core keeps the palette/theme selector (a single org styling itself). Replacing product marks with your own is the paid surface.

custom_branding

Enterprise: external system integration

Core keeps the entire internal CMDB (assets, crypto configurations, certificates, keys, every lens). Syncing it OUT to a foreign CMDB/ITSM — ServiceNow, Device42, SolarWinds — is the paid surface.

cmdb_sync

Enterprise + MSP: audit forwarding

Core logs every audit event and serves every audit query. Forwarding them to an external SIEM (Splunk, Datadog, Elastic, webhook) is paid. Listed as Enterprise because MSP is a superset — EditionFor returns the MINIMUM edition that may grant the item.

siem_export

Enterprise: OT/ICS

Retains the platform's existing gating: OT active probing and the OT lens have only ever shipped enabled on the paid tiers. Core keeps the full TLS/SSH/SMB discovery pipeline. Revisit if OT proves to be an adoption driver rather than a vertical upsell.

ot_active_probing · ot_primary_lens

MSP management plane

The MSP edition is carved by which services ship, not by capability flags, so these areas have no entry in the table above. Tenant isolation is Core — MSP sells the plane that manages tenants, not the model that isolates them.