Embedded Files
January 29, 2026
Historically an Open Source Program Office (OSPO) was viewed in terms of license compliance. The typical OSPO implementation was simple and contained, tied to legal risk management, and that was often only in a trailing or passive way.
In the last post, the OSPO concept was extended as a starting point for a business to formalize and coordinate actions in support of reducing business risk relative to the open source software (OSS) projects upon which the business depends.
Shifting to more active leadership via the OSPO opens additional vectors of business opportunity.
The Modern OSPO
The Modern OSPO
A modern OSPO drives value into engineering and product organizations, because open source software is the common innovation substrate. The right staff working in upstream projects make an OSPO a metaphorical ear on the rail listening for distant trends. Through hands-on activity with upstream project involvement, technology leaders gain visibility into opportunity and risk and actively lead out ahead of both.
Who “Owns” Innovation?
Who “Owns” Innovation?
Businesses often struggle with internal fighting, politics, and questions of ownership. Innovation does not wait. How then to resolve potential conflict?
Optimal ownership of the innovation mission is blurry when it comes to org-spanning quality attributes. It becomes especially blurry when the most relevant business owner may need to outsource work to others more knowledgeable in the intersection of OSS and security architecture and operations, compliance (sales, regulatory, IP), dependency selection and lifecycle management, privacy, accessibility, M&A due diligence, etc. A well run OSPO fosters alignment.
The OSPO as Bridge Builder
The OSPO as Bridge Builder
Rapid innovation in OSS combines with a practitioner set mixing specialists and specializing generalists inside an OSPO. As a result, the OSPO is exactly where your company might already have traction amongst technology leaders ahead of an emerging business interest.
Principled Advocacy
Principled Advocacy
In the abstract, an OSPO deals in fundamental attributes of quality software engineering. Concern for long-term quality is often missing in the early hype phase of technology proofs of concept and the rush to productization. The breadth of quality must though eventually be actively championed by an empowered org owner and it is often the modern OSPO leading the charge. A modest initial investment positions a business for dividends. Early OSPO presence in trend areas bridges into and accelerates product teams.
Today the state of art in AI is a fantastic example of a new addition to the list of topics on which a modern OSPO will contribute. Legal and licensing questions need answers. Quality and risk needs evaluation. Security concerns and threat models need definition. Interoperability glue code might need to be published as OSS for your products to play in the space.
An OSPO Example
An OSPO Example
For the reasons described above, the OSPO at VMware from 2016 through the 2023 acquisition by Broadcom did many types of work in addition to typical license compliance functions. The OSPO coordinated upstream community sustaining functions. It provided upstream project health/risk assessments for business units. It had engineers working speculatively in trending technology areas, eg: containers, orchestration, serverless, kernel, observability, supply chain security, service meshes, ML/AI, and others.
Scaled Investment
Scaled Investment
Often the breadth of engineering, legal, program/project management and other staffing investment in a modern OSPO is viewed as strange or stepping on the toes of other teams who wants to own the go-to-market. Especially when product teams aren’t yet doing work upstream on a topic, it takes intentional leadership to start something non-zero somewhere – somewhere like OSS. That investment is smart relative to extended value potential for the company.
Need an OSPO? Or need more out of your OSPO? Reach out to start a conversation on how a modern OSPO can accelerate value in your business.
Page updated
Report abuse