Open Source Takes on Enterprise Risk Management  ## Metadata - Author: [[Samuel Sidler]] - Full Title: Open Source Takes on Enterprise Risk Management - Category: #articles - Document Note: --- tags: - #OpenSource - #EnterpriseRisk - #WordPress Author: Samuel Sidler Source: delta.blog Reference: [Link to article](https://www.delta.blog/open-source-takes-on-enterprise-risk-management/) date created: 2024-10-07 10:00 --- # Title: Open Source Takes on Enterprise Risk Management ## Table of Contents: - [📝 Summary](#📝-summary) - [📖 Main Content](#📖-main-content) - [🗒️ Notes](#🗒️-notes) - [🗣️ Paraphrase](#🗣️-paraphrase) - [📰 Newsletter](#📰-newsletter) - [✅ Action Items](#✅-action-items) - [🧪 Hypotheses](#🧪-hypotheses) - [📊 Methodology](#📊-methodology) - [❓ Questions](#❓-questions) - [🔮 Future Research](#🔮-future-research) - [💡 Implications](#💡-implications) - [🧠 Learning Styles Assessment](#🧠-learning-styles-assessment) - [📊 Accessibility Assessment](#📊-accessibility-assessment) - [🌍 DEIB Assessment](#🌍-deib-assessment) - [✅ Logical Validity](#✅-logical-validity) - [🔍 SEO Evaluation](#🔍-seo-evaluation) - [🎯 Conclusion](#🎯-conclusion) ## 📝 Summary: The article explores the relationship between open source projects like WordPress and enterprise risk management, highlighting the challenges that enterprises face when adopting open-source technology. It delves into the complexity of managing risks related to software maintenance, licensing, and security in the open-source ecosystem. The focus is on the need for better governance and proactive risk mitigation strategies to enable enterprise-level adoption. ## 📖 Main Content: The article emphasizes how open source is no longer a niche solution but has become integral to enterprise operations. However, the decentralized nature of open-source projects, such as WordPress, introduces complexities when it comes to risk management. The author argues that enterprises need structured risk management frameworks to effectively utilize open-source software, especially given the evolving ecosystem and the potential for security vulnerabilities and licensing issues. Sidler also touches on the "messiness" of the open-source ecosystem, particularly when enterprises attempt to scale such software solutions. He discusses how this messiness presents a barrier to widespread enterprise acceptance and suggests that addressing these challenges with improved governance and clear risk assessment could make open-source tools more enterprise-friendly. ### 🗒️ Notes - **Open Source in Enterprise**: - Open source has moved beyond niche usage; it’s now foundational to enterprise IT. - The decentralization of open-source projects creates unique challenges for risk management. - **Risk Management Concerns**: - **Licensing Issues**: Enterprises need clarity around licensing to avoid legal disputes. - **Security Vulnerabilities**: Open source lacks the centralized oversight of proprietary software, increasing the need for vigilant security practices. - **Governance and Mitigation**: - Improved governance frameworks could help enterprises effectively mitigate risks. - Proactive strategies for managing open-source projects could enhance their viability at an enterprise scale. ## 📖 References: - Sidler, Samuel. "Open Source Takes on Enterprise Risk Management." delta.blog. [Link to article](https://www.delta.blog/open-source-takes-on-enterprise-risk-management/) ## 🗣️ Paraphrase:  1. Sidler asserts that while open source has grown beyond niche applications, its decentralized nature complicates its adoption in enterprise settings, especially regarding risk management and governance. 2. The author suggests that structured governance and proactive risk mitigation are critical for making open-source projects like WordPress suitable for large-scale enterprise use, focusing on managing security vulnerabilities and licensing risks. ## 📰 Newsletter: 🚀 **Enterprise and Open Source: Risk and Reward** 🌐 Open source is powering the backbone of many enterprises, but it comes with unique challenges. Samuel Sidler's recent article dives into how companies are managing risks like licensing and security when scaling open-source projects like WordPress. It's an important read for those navigating the "messiness" of open source at scale. Check it out here: [Read More](https://www.delta.blog/open-source-takes-on-enterprise-risk-management/). Let's continue to make open source enterprise-friendly and safe for everyone! 🛠️✨ ## ✅ Action Items: - **Contributor Engagement**: This article highlights the importance of creating governance frameworks that make open-source projects more viable for enterprises. Advocating for stronger community-based governance aligns with my role in growing contributor engagement. - **OSPO Strategy**: My aspiration to become an OSPO director would involve ensuring transparency and risk management, both of which are crucial for sustaining enterprise-level adoption of open source. This article provides insights into areas that need attention in OSPOs, particularly governance and security. ## 🧪 Hypotheses: - Structured governance frameworks can reduce security vulnerabilities in open-source projects at the enterprise level. - Enterprises are more likely to adopt open source if clear risk mitigation strategies are in place. ### 📊 Methodology: - **Data Sources**: Collect survey data from enterprises currently using or considering open-source software. - **Research Design**: Compare enterprise outcomes between those using open-source projects with structured governance frameworks versus those without. - **Analysis Techniques**: Use regression analysis to determine the impact of governance on security and adoption rates. ### ❓ Questions: - What specific governance structures can best address the "messiness" of open-source ecosystems for enterprise use? - How can the open-source community better support enterprises in managing risk without compromising community values? ### 🔮 Future Research: - Investigate the impact of governance and structured risk management on the adoption rates of open-source software in large enterprises. - Study the balance between open community development and the security needs of enterprises. ### 💡 Implications:  Strengthening governance and risk management practices could increase the acceptance of open-source tools like WordPress in enterprise environments, ultimately leading to broader open-source adoption and more sustainable community contributions. ### 🧠 Learning Styles Assessment: - **Visual Learners (Spatial)**: - **Present**: Minimal visual content. - **Improve**: Add diagrams or flowcharts illustrating governance frameworks for enterprise risk management. - **Aural Learners (Auditory-Musical)**: - **Present**: None. - **Improve**: Include an audio version of the article for better accessibility. - **Verbal Learners (Linguistic)**: - **Present**: Rich in descriptive language and examples. - **Improve**: Expand on real-world examples of enterprises using open-source software to provide additional context. - **Physical Learners (Kinesthetic)**: - **Present**: None. - **Improve**: Suggest practical exercises like developing a mock risk management plan for an open-source project. - **Logical Learners (Mathematical)**: - **Present**: Logical analysis of governance challenges. - **Improve**: Add more quantitative data on enterprise adoption rates of open-source. - **Social Learners (Interpersonal)**: - **Present**: Minimal. - **Improve**: Encourage discussion about the balance between open-source values and enterprise needs. - **Solitary Learners (Intrapersonal)**: - **Present**: Reflective tone. - **Improve**: Include reflection prompts for readers to consider their perspectives on open-source risks. - **Naturalistic Learners**: - **Present**: None. - **Improve**: Use environmental analogies to explain the interconnectedness of the open-source community and enterprises. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: The article should use proper semantic HTML for accessibility. - **Improve**: Ensure all links and interactive elements are properly labeled for screen readers. - **Keyboard Navigation**: Content is likely accessible, but improvements could include adding clear - Document Tags: [[automattic]] [[matt mullenweg]] [[open source]] [[open source corporate contribution]] [[wordpress]] [[wordpress contribution]] [[wpdrama]] - Summary: WordPress’ market success tracks closely with enterprise acceptance. How will risk management organizations view the messiness of the ecosystem? - URL: https://www.delta.blog/open-source-takes-on-enterprise-risk-management/ Photo by [Loic Leray](https://unsplash.com/@loicleray?utm_source=ghost&utm_medium=referral&utm_campaign=api-credit) / [Unsplash](https://unsplash.com/?utm_source=ghost&utm_medium=referral&utm_campaign=api-credit) The wild saga continues... Over the weekend, Automattic publicly tweeted about a "responsibly disclosed" security issue in WP Engine's ACF product. Automattic's tweet read: > Automattic's security team has responsibly disclosed a vulnerability in @wp\_acf to @wpengine. As is standard, they have 30 days to issue a fix before public disclosure. We have reserved this CVE for the issue: [https://www.cve.org/CVERecord?id=CVE-2024-9529](https://www.cve.org/CVERecord?id=CVE-2024-9529&ref=delta.blog) The tweet was quickly deleted after significant pushback from the community, but the perceptual damage from this action actually feeds directly into today's topic. Before that, I have to issue **my very first correction**. In [Investments in the WordPress ecosystem](https://www.delta.blog/investments-in-the-wordpress-ecosystem/), I wrote about a handful of investments that have been actively discussed, or revealed publicly, during the Matt Mullenweg and WP Engine saga. About BlackRock, I specifically noted the following: > According to that document, as of March 31, 2024, BlackRock holds 94,117 shares of Automattic, at an original valuation of $7,999,945 (let's call it a cool $8 million even), but a present value of $4,127,030, or ~51% of their original value. The valuation is based on BlackRock's internal estimates, and not necessarily representative of the value these shares would have on the open market. Extrapolating a bit, we can guesstimate that Automattic had a valuation of ~$1.3 billion when BlackRock acquired its shares in 2021, while BlackRock now values Automattic at ~$690 million. That document references a [Consolidated Schedule of Investments](https://www.blackrock.com/us/individual/literature/first-quarter-report/fqr-retail-blackrock-science-and-technology-trust.pdf?ref=delta.blog), from the BlackRock Science and Technology Trust (BST). However, there is an additional document that shows a much larger monetary investment in Automattic. Specifically, [a semi-annual report from June 30, 2024](https://www.blackrock.com/us/individual/resources/regulatory-documents/stream-document?stream=reg&product=BST-AG&shareClass=NA&documentId=1982833%7E1982832%7E1958944%7E2021731%7E1864471%7E1864466&iframeUrlOverride=%2Fus%2Findividual%2Fliterature%2Fsemi-annual-report%2Fsar-retail-closed-end-equity-06-30.pdf&ref=delta.blog) includes a separate Consolidated Schedule of Investments that lists BlackRock's investment in Automattic within its BlackRock Science and Technology Term Trust (BSTZ) as 400,000 shares. As I am not a ~~high-wealth~~ post-economic individual, I am not clear on the differences between the BST and BSTZ trusts, but it's safe to assume that BlackRock's monetary stake is higher than I previously reported. And, it's entirely possible there are *additional* trusts in which BlackRock is holding Automattic shares. In writing this correction, I thought it beneficial to re-calculate Automattic's valuation, both in 2021 when BlackRock first invested, and today, after its write down. However, [on Twitter on October 3](https://x.com/photomatt/status/1842022428962148407?ref=delta.blog), Mullenweg noted the following (emphasis mine, spelling his):  [Matt Mullenweg](https://twitter.com/photomatt) [@photomatt](https://twitter.com/photomatt) Silver Lake controls WP Engine and owns 50%+ of the company. Blackrock owns 0.8% of Automattic and has no voting rights. They also own a part of pretty much every company in the US! [slickcharts.com/blackrock](https://www.slickcharts.com/blackrock) It's totally different, active vs passive investor. [Posted Oct 4, 2024 at 2:02AM](https://twitter.com/photomatt/status/1842022428962148407) The problem is that this is contrary to [what Mullenweg previously mentioned on Twitter on September 26](https://x.com/photomatt/status/1839348948190019874?ref=delta.blog)—and what I used in my previous post—that BlackRock owns 0.6% of Automattic.  [Matt Mullenweg](https://twitter.com/photomatt) [@photomatt](https://twitter.com/photomatt) Blackrock owns 0.6% of Automattic and has no voting rights. Silver Lake owns and controls a majority of WP Engine. I also wrote here: [ma.tt/2024/09/are-in…](https://ma.tt/2024/09/are-investors-bad/) [Posted Sep 26, 2024 at 4:58PM](https://twitter.com/photomatt/status/1839348948190019874) Which is correct and accurate? It's unclear. Is it possible that BlackRock's stake increased by 33% in a matter of days? That seems unlikely, but possible, if one or more large investors divested from their shares in Automattic. Using his most recent statement, that BlackRock owns 0.8% of Automattic, and assuming, for the sake of argument, BlackRock owns a combined 494,117 shares across its two investment vehicles, this works out to a 2021 valuation of ~$5.25 billion. **To be clear**, this more recent report *still* notes a ~51% write down of the value of the BSTZ shares, from $34,000,000 to $16,668,000, as of June 30, 2024. Either way, I did not get this correct the first time around, and it still may not encompass all of BlackRock's stake. I've added a note to the original post, referencing this correction. *Hat tip: Ivan for flagging the additional BlackRock shares to me.* Anyway, onward and upward... In spite of comparisons to glaciers and molasses, enterprise organizations around the world are constantly looking for the next big thing—the next way to engage their users and increase revenue, but *also* the next way to reduce costs and optimize team performance. It's a bit counterintuitive. Even as digital leaders at large organizations implement tried and true technology, they experiment on wild ideas that may never pan out, embracing *new* technology to reach *new* audiences. Their mandate, as corporate leaders of for-profit companies, is to be as profitable as possible, which in turn necessitates efficiency of operations, effectiveness of staff, and expansion into new markets. Each of these areas requires new, and improved, technology and practices. Mind you, this does not challenge the [technology adoption lifecycle](https://en.wikipedia.org/wiki/Technology_adoption_life_cycle?ref=delta.blog). Enterprises *frequently* fall in the later stages of Rogers' innovation adoption curve, representing the Late Majority or even Laggards. But, it's not unheard of for large organizations to embrace new technology. In particular, as the internet took root and social media flourished, enterprise organizations hesitated, then *jumped* off the cliff of new media and new technology... at least when it came to external marketing. Internally, however, these organizations are complex ecosystems, filled with procurement, change management, compliance, and risk mitigation. Do enterprise leaders *want* this level of bureaucracy? Yes and no. This is the push and pull between innovation and stability. Enterprise organizations need innovation to increase growth and reduce costs through new efficiencies, all in the interest of higher gross margin and profits. In turn, steering a massive ship requires thoughtfulness and consideration, lest you desire Titanic comparisons. Stability is key and risk management comes into play, with entire divisions devoted to reducing risk, even as leaders pine for new innovations and technology, unproven though they are. An enterprise leader dreams of being an Early Adopter, implementing a new technology ahead of the rest, and being later hailed as a visionary in their market. They want a proven thing, yes, but they want it as fast as possible, the quickest go-to-market conceivable, while also balancing the safety, security, and stability mandated in their fiduciary responsibilities. And this brings us to WordPress. Over the past decade, a transformation has been playing out within the CMS market. While many new media publishers jumped aboard the WordPress train in its early years (some as early as 2005), enterprise organizations remained hesitant—only a handful started experimenting with WordPress. But, that changed. First slowly, then rapidly. In its early years, enterprise avoidance of WordPress was unsurprising given the unknown technology, benefits, and risks. But a few, a handful at time, pushed it through the hurdles of enterprise bureaucracy. Massive businesses formed around scaling WordPress, not only WordPress-as-software, but WordPress-as-*risk*, meeting regulatory, compliance, and procurement demands. WordPress VIP, Pantheon, SiteGround, and yes, WP Engine, formed not only to develop the *infrastructure* needed for WordPress-as-software at scale, but to provide the structure and support risk management teams needed to approve the software. And once one enterprise organization approved, it became that much easier for the next, and the next. The editorial experience, even pre-Block Editor—as compared to contemporary competitors—was loved by marketing and content creation teams, who further pushed for WordPress, as leaders moved between companies. The snowball of WordPress rolled down the hill of enterprise. This boosted mid-market growth as well—the thinking went: if it's good for the [Mercks](https://www.merck.com/?ref=delta.blog), [Blackstones](https://www.blackstone.com/?ref=delta.blog), and [Standard Chartereds](https://www.sc.com/en/?ref=delta.blog) of the world, it's good for *everyone*. WordPress, once known only for its blogging prowess, became known for flexibility, extensibility, and even *security*, long its Achilles' heel. (Arguably, the wave of bespoke CMSes that formed rapidly over the past decade is due to WordPress—a hundred flowers blooming as organizations grew more intelligent about their digital presence, and better able to articulate their evolving needs.) The reason [43.5% of websites run WordPress](https://w3techs.com/technologies/details/cm-wordpress?ref=delta.blog) isn't because millions of bloggers rose through the ranks of the internet, but rather, because enterprise organizations have embraced it, leading to growth at *all* ends of the market. Put another way, success in the enterprise market begat success across the web. But, all of this success stands on back of mundane terms like procurement and risk management. If enterprise organizations start to see uncertainty, the risk-reward ratio shifts—why use WordPress if another product is less risky in the long run. Which *finally*... leads us to the Matt Mullenweg and WP Engine saga. In case it wasn't abundantly clear, enterprise organizations *hate* risk. Abhor it, even. The legal actions—both cease and desist orders, and now a lawsuit in federal court—are, by definition, risk. As risk management teams analyze WordPress-as-software, the legal actions challenging WordPress' intellectual property (IP) will, rightfully, get flagged. And, despite the trademark dispute explicitly avoiding the GPL licence, the door has been opened—what will be challenged next, and how will that affect *our* business? In evaluating WordPress-as-*risk*, the flag has been raised. Regulatory, compliance, and support structures only help so much, when legal threats are in the air. How far will Mullenweg go in his war to protect the WordPress trademark? It's all too... messy. The entire IP situation with WordPress is messier than closed source solutions like AEM, messier than even Drupal and Sanity. While most everyone loves [*watching* messy](https://en.wikipedia.org/wiki/The_Real_Housewives?ref=delta.blog), no one likes *being* messy. Perhaps more concerning, this is a bell that can't be un-rung. Words have been said, on the record, with no apparent softening over the past few weeks. If anything, positions have been hardened, strengthened as [dissenters within Automattic left the company](https://ma.tt/2024/10/alignment/?ref=delta.blog). And the escalation was *rapid*, from an enterprise standpoint—in March 2023, just 18 short months ago, Mullenweg applauded WP Engine publicly, only to go "scorched earth" in September 2024. If the switch can be so fast, so sudden, no amount of reassurance, direct or indirect, will assuage enterprise concerns or alleviate the perceived risk. Ultimately, this very public legal fight—whatever the original motivation—irreparably damages the WordPress brand in ways that are incalculable. Whatever power WordPress-as-software holds, with its numerous benefits, the legal battle has thrown up a red flag for risk management teams around the world. It's near impossible to overstate the effect this has on trust in the WordPress brand and product, though the effect is *certainly* greater than any alleged actions (or lack their of) from WP Engine or Silver Lake. But, again, enterprise moves slowly. It may take *years* before the damage to enterprise adoption is visible to outsiders. However, managed hosts and agencies will certainly feel pressure much sooner, as enterprise organizations begin to inquire about "options." In the end, it's anyone's guess what the extent of the damage will be, though the actions from Automattic this weekend can only add to the uncertainty about WordPress., Open Source Takes on Enterprise Risk Management, Samuel Sidler, 01j9k97btvte5nw98r5z8rkt4q.