Original research · updated July 2026
The OffVendor Lock-in Index
72 commercial products scored on the five dimensions that decide how hard leaving actually is. Higher = harder to leave. Compiled by the same editorial process as our migration guides; scoring rules and caveats are published below.
72
products scored
56
average lock-in (0–100)
80
hardest to leave: Oracle Database
0
easiest exit: CentOS Linux
The ten hardest products to leave
Composite of all five dimensions, 0–100. The bar is the score; the note says why.
- PL/SQL depth, audit exposure, and per-core economics are the textbook lock-in case; ora2pg and managed converters are mature but the code surface is the long pole.
- BTEQ scripts and decades of warehouse logic are among the heaviest proprietary surfaces in the index.
- Mule flows are an integration programming model, not just gateway config; exits are rewrites.
- Proprietary catalog and format plus decades of enterprise entrenchment; the retention tail is the lock.
- Appliance-plus-SaaS model and proprietary snapshot chains make partial exits particularly awkward.
- Years of SPL queries, dashboards, and detection content are the real migration, not the log data.
- Credential material plus conditional-access policy depth plus Microsoft 365 gravity is a three-layer bind.
- iRules are a full programming environment; estates carry years of traffic logic no converter fully translates.
- Forty years of enterprise integration patterns assume MQ semantics that open brokers only approximate.
- Private-equity-era pricing on a broker woven through legacy middleware estates.
How to read the heatmap
LLicensing & pricing power. Vendor's ability to unilaterally reprice or re-license: subscription-only moves, audits, bundles, usage metering.
DData & workload portability. Whether data, workloads, backups, identities, or models can leave in a format something else can read.
PProprietary surface. How much of your config and code targets vendor-only languages, APIs, and features.
EEcosystem & skills. How deeply tooling, staffing, and certification culture assume the product.
XExit-path maturity. Inverted: low when a drop-in fork or mature migration tooling exists, high when leaving means a rebuild.
Each cell is scored 1 (minimal friction) to 5 (severe friction): 12345 The composite normalizes the five scores to 0–100.
Virtualization
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| VMware vSphere | 5 | 3 | 4 | 4 | 2 | 65 |
| Subscription-only per-core bundles maximized repricing power, but virt-v2v-class tooling and several credible destinations keep the exit path well trodden. | ||||||
| XenServer (Citrix Hypervisor) | 3 | 2 | 3 | 3 | 1 | 35 |
| XCP-ng is a near drop-in fork that reads the same VM formats, one of the cheapest exits in enterprise IT. | ||||||
Databases
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Oracle Database | 5 | 4 | 5 | 5 | 2 | 80 |
| PL/SQL depth, audit exposure, and per-core economics are the textbook lock-in case; ora2pg and managed converters are mature but the code surface is the long pole. | ||||||
| IBM Db2 | 4 | 4 | 4 | 4 | 3 | 70 |
| Deep mainframe-era integration and thinner third-party migration tooling than Oracle's exit ecosystem. | ||||||
| Microsoft SQL Server | 4 | 3 | 4 | 4 | 2 | 60 |
| T-SQL, SSIS, and Windows coupling hold workloads in place even though the data itself exports cleanly. | ||||||
| MongoDB | 3 | 3 | 4 | 3 | 3 | 55 |
| SSPL licensing and a proprietary query API mean the friction is in the application layer, not the data export. | ||||||
Backup & DR
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Veritas NetBackup | 4 | 5 | 4 | 4 | 3 | 75 |
| Proprietary catalog and format plus decades of enterprise entrenchment; the retention tail is the lock. | ||||||
| Rubrik | 4 | 5 | 4 | 3 | 4 | 75 |
| Appliance-plus-SaaS model and proprietary snapshot chains make partial exits particularly awkward. | ||||||
| Commvault | 4 | 5 | 4 | 3 | 3 | 70 |
| Same retention-tail dynamic, with a broad proprietary feature surface on top. | ||||||
| Veeam Backup & Replication | 3 | 5 | 3 | 2 | 3 | 55 |
| Old backups stay readable only by the product that wrote them, so retention obligations keep it installed for years after you switch. | ||||||
Monitoring
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Splunk | 4 | 4 | 5 | 4 | 3 | 75 |
| Years of SPL queries, dashboards, and detection content are the real migration, not the log data. | ||||||
| Dynatrace | 4 | 4 | 4 | 3 | 3 | 65 |
| OneAgent and Davis automation are genuinely differentiated, which cuts both ways: harder to replicate on open stacks. | ||||||
| Datadog | 4 | 4 | 4 | 3 | 2 | 60 |
| Usage-based billing plus non-exportable metric history; OpenTelemetry makes the go-forward pipeline portable even though the past stays behind. | ||||||
| New Relic | 4 | 4 | 4 | 3 | 2 | 60 |
| Agent footprint and historical telemetry retention keep renewals sticky; OTel-based stacks are a viable destination. | ||||||
| SolarWinds | 3 | 3 | 3 | 3 | 3 | 50 |
| Moderate on every axis; the migration is mostly re-instrumenting checks rather than untangling proprietary depth. | ||||||
Storage & SAN
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| NetApp ONTAP | 4 | 3 | 4 | 4 | 2 | 60 |
| Data moves with host-side copy, but SnapMirror-era workflows and ONTAP features rarely translate one-to-one. | ||||||
| Dell PowerStore | 4 | 3 | 3 | 3 | 2 | 50 |
| Standard block/file semantics keep the exit conventional: migrate LUNs, re-point hosts, retire. | ||||||
| Pure Storage FlashArray | 4 | 3 | 3 | 3 | 2 | 50 |
| Evergreen subscription economics are the retention mechanism more than any technical barrier. | ||||||
| HPE Alletra | 4 | 3 | 3 | 3 | 2 | 50 |
| As with most SANs, the friction is operational cutover risk rather than data captivity. | ||||||
Operating Systems
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Windows Server | 4 | 3 | 4 | 4 | 3 | 65 |
| AD, IIS, and MSSQL coupling make this an application re-platforming exercise, not an OS swap. | ||||||
| SUSE Linux Enterprise | 3 | 2 | 2 | 2 | 2 | 30 |
| zypper-to-dnf and SUSE-specific management tooling add friction that plain RHEL clones don't have. | ||||||
| Red Hat Enterprise Linux | 3 | 1 | 2 | 2 | 1 | 20 |
| Workloads are portable Linux; migrate2rocky/almalinux-deploy make the conversion nearly mechanical. | ||||||
| Oracle Linux | 3 | 1 | 2 | 2 | 1 | 20 |
| RHEL-compatible base means the same near-mechanical conversion paths apply. | ||||||
| CentOS Linux | 1 | 1 | 1 | 1 | 1 | 0 |
| EOL ended the product rather than locking anyone in; the forced move is easy, just mandatory. | ||||||
Identity & Access
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Microsoft Entra ID | 4 | 5 | 4 | 4 | 3 | 75 |
| Credential material plus conditional-access policy depth plus Microsoft 365 gravity is a three-layer bind. | ||||||
| Okta | 4 | 5 | 3 | 3 | 3 | 65 |
| Password hashes generally cannot be exported, so every migration forces a user re-enrollment or reset wave. | ||||||
| Ping Identity | 4 | 4 | 4 | 3 | 3 | 65 |
| Long-lived federation configs and bespoke policy trees accumulate into the real switching cost. | ||||||
| ForgeRock | 4 | 4 | 4 | 3 | 3 | 65 |
| Heavily customized identity journeys resist mechanical translation to any other engine. | ||||||
Cybersecurity
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| CrowdStrike Falcon | 4 | 4 | 4 | 3 | 3 | 65 |
| Detection history and tuned policies live in the vendor cloud; a switch resets institutional memory. | ||||||
| SentinelOne | 4 | 4 | 4 | 3 | 3 | 65 |
| Same cloud-resident telemetry dynamic as its main rival; agents swap easily, the tuning doesn't. | ||||||
| Symantec Endpoint Security | 4 | 3 | 3 | 3 | 3 | 55 |
| Broadcom-era licensing pressure meets an older, less entangled agent estate. | ||||||
| Trend Micro | 3 | 3 | 3 | 3 | 3 | 50 |
| Moderate across the board; policy porting is the bulk of the work. | ||||||
IaC & Secrets
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| HashiCorp Vault | 3 | 3 | 3 | 3 | 2 | 45 |
| OpenBao forked the engine, but secrets migration and re-auth of every consumer still need a careful runbook. | ||||||
| Puppet Enterprise | 3 | 2 | 3 | 3 | 2 | 40 |
| The DSL and module estate is the sunk cost; the managed nodes themselves move easily. | ||||||
| HashiCorp Terraform | 3 | 2 | 3 | 2 | 1 | 30 |
| The BSL relicense triggered OpenTofu, a state-compatible drop-in fork, about as clean as exits get. | ||||||
Containers & PaaS
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Cloud Foundry (Tanzu AS) | 3 | 3 | 4 | 3 | 3 | 55 |
| The cf-push developer contract has no exact open equivalent, so the migration is a workflow change, not just a platform swap. | ||||||
| Red Hat OpenShift | 4 | 2 | 4 | 3 | 2 | 50 |
| Manifests are mostly portable Kubernetes, but Routes, Operators, and S2I builds need untangling first. | ||||||
| VMware Tanzu | 4 | 2 | 3 | 3 | 2 | 45 |
| Broadcom-era pricing meets a workload layer that is largely standard Kubernetes underneath. | ||||||
| Mirantis Kubernetes Engine | 3 | 2 | 2 | 2 | 2 | 30 |
| Swarm-to-Kubernetes conversion is well understood and the container images themselves are already portable. | ||||||
Data Warehouse
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Teradata | 5 | 4 | 5 | 4 | 3 | 80 |
| BTEQ scripts and decades of warehouse logic are among the heaviest proprietary surfaces in the index. | ||||||
| Snowflake | 4 | 3 | 4 | 3 | 2 | 55 |
| COPY-to-Parquet keeps raw data portable while credits pricing, Snowpark, and tasks pull workloads deeper in. | ||||||
| Google BigQuery | 4 | 3 | 4 | 3 | 2 | 55 |
| Easy table export contrasts with slot economics and SQL extensions that accumulate in every pipeline. | ||||||
| Amazon Redshift | 4 | 3 | 4 | 3 | 2 | 55 |
| UNLOAD to S3 keeps data portable; dialect quirks and AWS integration do the holding. | ||||||
CI/CD & DevOps
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Atlassian Bamboo | 4 | 3 | 4 | 3 | 3 | 60 |
| Data-center licensing changes plus plan configs that predate pipeline-as-code conventions. | ||||||
| GitLab (Premium/Ultimate) | 3 | 2 | 3 | 2 | 2 | 35 |
| Git history moves trivially; CI definitions and merge-request workflow are the translation work. | ||||||
| CircleCI | 3 | 2 | 3 | 2 | 2 | 35 |
| YAML pipelines translate readily; the exit is mostly re-plumbing secrets and runners. | ||||||
| Jenkins | 1 | 2 | 3 | 3 | 2 | 30 |
| Open source with no vendor to lock you in; teams leave over Groovy pipeline sprawl and maintenance burden instead. | ||||||
Load Balancers / ADC
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| F5 BIG-IP | 5 | 3 | 5 | 4 | 3 | 75 |
| iRules are a full programming environment; estates carry years of traffic logic no converter fully translates. | ||||||
| Citrix NetScaler ADC | 4 | 3 | 4 | 3 | 3 | 60 |
| Content-switching policies and rewrite rules need manual re-expression in any destination. | ||||||
| A10 Thunder ADC | 4 | 3 | 4 | 3 | 3 | 60 |
| aFleX scripting mirrors the F5 dynamic at somewhat smaller scale. | ||||||
| Kemp LoadMaster | 3 | 2 | 3 | 2 | 2 | 35 |
| Simpler feature surface keeps conversions to HAProxy/NGINX comparatively contained. | ||||||
Switches & Routers
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Cisco Catalyst / Nexus | 4 | 2 | 4 | 4 | 3 | 60 |
| Configs convert, but an IOS-certified operations culture is the stickiest asset in the rack. | ||||||
| Juniper Networks | 4 | 2 | 4 | 3 | 3 | 55 |
| Junos policy language and automation tooling embed deeply into network operations. | ||||||
| Arista Networks | 3 | 2 | 3 | 3 | 3 | 45 |
| EOS's Linux foundations and standard protocols keep the surface more portable than most. | ||||||
Firewalls
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Palo Alto Networks | 5 | 3 | 4 | 4 | 3 | 70 |
| Panorama-managed policy estates and per-feature subscriptions concentrate both cost and switching effort. | ||||||
| Fortinet FortiGate | 4 | 3 | 4 | 3 | 3 | 60 |
| FortiOS feature breadth means rulebase conversion is rarely the whole story. | ||||||
| Check Point | 4 | 3 | 4 | 3 | 3 | 60 |
| Decades-old rulebases with layered admin conventions resist clean mechanical export. | ||||||
| SonicWall | 3 | 3 | 3 | 2 | 3 | 45 |
| Smaller-estate deployments keep the practical exit surface manageable. | ||||||
Message & Streaming
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| IBM MQ | 5 | 4 | 4 | 4 | 3 | 75 |
| Forty years of enterprise integration patterns assume MQ semantics that open brokers only approximate. | ||||||
| TIBCO EMS | 5 | 4 | 4 | 4 | 3 | 75 |
| Private-equity-era pricing on a broker woven through legacy middleware estates. | ||||||
| Solace PubSub+ | 4 | 4 | 4 | 3 | 3 | 65 |
| Appliance heritage and proprietary topic semantics make like-for-like replacement uncommon. | ||||||
| Confluent Platform | 4 | 3 | 4 | 3 | 2 | 55 |
| MirrorMaker 2 moves topics to open Kafka; ksqlDB, connectors, and Schema Registry are the sticky extras. | ||||||
AI & LLMs
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Azure OpenAI | 4 | 5 | 4 | 3 | 2 | 65 |
| The same model captivity plus Azure networking, identity, and compliance integration on top. | ||||||
| OpenAI GPT | 4 | 5 | 4 | 2 | 2 | 60 |
| Prompts port easily but fine-tuned models cannot leave the platform, and behavior parity on open weights needs re-evaluation from scratch. | ||||||
Cloud Migration
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Amazon Web Services | 4 | 4 | 5 | 4 | 3 | 75 |
| Egress economics and hundreds of proprietary services make gravity, not any single contract, the lock. | ||||||
| Microsoft Azure | 4 | 4 | 5 | 4 | 3 | 75 |
| Microsoft licensing bundles reach beyond the cloud itself into identity and productivity estates. | ||||||
| Google Cloud | 4 | 4 | 4 | 3 | 3 | 65 |
| Slightly thinner proprietary surface than its rivals, with the same data-gravity fundamentals. | ||||||
VDI & EUC
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| Citrix DaaS / Virtual Apps & Desktops | 5 | 3 | 4 | 4 | 3 | 70 |
| Post-acquisition repricing on a product whose admin skill set is a career specialty of its own. | ||||||
| Omnissa Horizon (VMware Horizon) | 4 | 3 | 4 | 3 | 3 | 60 |
| The Omnissa transition adds vendor uncertainty to an already specialized stack. | ||||||
API Management
| Product | L | D | P | E | X | Lock-in |
|---|---|---|---|---|---|---|
| MuleSoft Anypoint | 5 | 4 | 5 | 4 | 3 | 80 |
| Mule flows are an integration programming model, not just gateway config; exits are rewrites. | ||||||
| Google Apigee | 4 | 3 | 4 | 3 | 3 | 60 |
| Proxy bundles export, but policy semantics and Google Cloud integration need re-architecture elsewhere. | ||||||
| Kong Enterprise | 3 | 2 | 3 | 2 | 1 | 30 |
| Declarative config and an OSS core underneath make the enterprise-to-OSS step unusually short. | ||||||
Methodology, caveats, and how to cite this
The index is an editorial assessment by the OffVendor Editorial Team, produced with the same process as our migration methodology: public licensing terms, vendor documentation, commonly reported customer experience, and first-hand knowledge of the migration tooling for each product.
Each product is scored 1–5 on the five dimensions above; the composite is the normalized sum. Scores describe the typical mid-size enterprise deployment, your contract, version, and architecture can move any score in either direction. These are general, commonly reported considerations, not statements of fact about any vendor's current terms, and they are not legal or procurement advice. Products are re-scored when licensing or ownership changes materially (Broadcom/VMware and HashiCorp/BSL both triggered re-scores).
You are welcome to cite or reproduce individual scores with attribution and a link: "OffVendor Lock-in Index 2026, offvendor.com/lock-in-index". Spotted a score you can argue with evidence? Email [email protected], the index improves through corrections.