CFEngine: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (Enterprise scored; Community is the engine inside)
Owner: Northern.tech AS (Oslo, Norway; private); no acquisition on record
Engine: CFEngine Community (cf-agent, cf-serverd, cf-hub), GPL v3
Licence: GPL v3 for Community; Commercial Open Source License for Enterprise, per host, subscription or perpetual; Enterprise free for up to 25 hosts; prices not published
Latest release: 3.28.0 (2026-07-10, non-LTS); 3.27.2 and 3.24.5 patch releases (2026-10-15)
Support lifecycle: an LTS about every 18 months, supported three years; 3.27 LTS to 2029-01-09, 3.24 LTS to 2027-07-31; non-LTS releases are unsupported
Next milestone: next LTS in summer 2027 with the 3.28 features (vendor statement, no month)
Targets: Linux hosts (Community), Linux and Windows hosts (Enterprise); read-only Docker and Podman inspection since 3.28; no modules for clouds, vSphere, Proxmox VE, Nutanix, Hyper-V, XCP-ng or KubeVirt
Tier: Configuration management
Archetype: Dependable builder, narrow field
Evidence grade: B. Release dates and lifecycle were read from the vendor's release blogs, GitHub tags and endoflife.date, the licence from the LICENSE file. Prices are not published. Scale claims are vendor statements without node counts, and releases before 3.15 were not traced to primary pages.

Scorecard

Dimension	Score	Direction
Capability today	50.4 / 100	higher is better
Momentum since end of 2022	+5.8 points (2015 to 2022: +3.0)	higher is better
Credibility	19.0 / 25	higher is better
Commercial risk	7.0 / 25	lower is better
Technical lock-in	11.0 / 25	lower is better
Integrator fit	9.0 / 20	higher is better
AI leverage	5.0 / 20	higher is better
Ledger Index	54.1 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	1	1	1	1
Configuration management depth (12)	4	4	4	4
State, planning and safety (12)	2	2	2.5	2.5
Language and authoring (10)	2.5	2.5	3	3
Orchestration and self-service (10)	1.5	1.5	1.5	2
Scale and control plane (8)	3.5	3.5	3.5	3.5
Security and compliance (10)	2.5	2.5	2.5	3.5
Bare metal and day-2 operations (8)	1.5	1.5	1.5	1.5
Ecosystem and integrations (8)	2	2	2.5	2.5
AI assistance (7)	0	0	0	2
Total / 100	41.6	41.6	44.6	50.4

Year by year: 2015: 41.6 · 2016: 41.6 · 2017: 41.6 · 2018: 41.6 · 2019: 41.6 · 2020: 41.6 · 2021: 43.4 · 2022: 44.6 · 2023: 45.6 · 2024: 45.6 · 2025: 47.6 · 2026: 50.4

What moved the score

Year	Domain	Change	Points	Trigger
2021	Ecosystem and integrations	2 → 2.5	+0.8	CFEngine Build: shared module index
2021	Language and authoring	2.5 → 3	+1.0	CFEngine Build: cfbs module index
2022	State, planning and safety	2 → 2.5	+1.2	3.21: cf-agent --simulate
2023	Orchestration and self-service	1.5 → 2	+1.0	3.22: host groups in Mission Portal
2025	Security and compliance	2.5 → 3.5	+2.0	3.25 and 3.26: audit log, TOTP two-factor, no default admin account
2026	AI assistance	0 → 2	+2.8	3.27 LTS: Mission Portal AI agent answers reporting questions; no code generation or MCP server

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-06	3.22: host groups in Mission Portal	Orchestration	C
2023-12	3.23: non-LTS feature release ahead of 3.24	Packaging	C
2024-07	3.24 LTS: CMDB group data, compliance reports about five times faster, Ubuntu 24 including ARM64	Scale	C
2025-01	3.25: Mission Portal audit log, TOTP two-factor, password rules, network protocol v4	Security	C
2025-05	3.26: no default admin account, setup code, cfbs analyze, new policy functions	Security	C
2025-12	3.21.8 and 3.24.3: patch releases on both LTS lines; they carry the fix for the command injection later tracked as CVE-2026-24712	Security	C
2026-01	3.27 LTS: AI agent in Mission Portal, CMDB redesign, cfbs convert, OpenSSL 3.6	AI	V
2026-01	3.27 ends standard support for Solaris, AIX, HP-UX, SUSE and Debian 11; extended support becomes a paid agreement	Packaging	P
2026-07	3.28: Docker and Podman container introspection in the Enterprise UI, OpenSSL 4.0.1	Configuration management	V
2026-07	Next LTS announced for summer 2027 with the 3.28 features	Packaging	C
2026-10	3.27.2 and 3.24.5: patch releases on both LTS lines	Security	C

Centre of gravity: Security (4), Packaging (3), Orchestration (1)
Blind spots (no items): Provisioning breadth, State and planning, Language, Bare metal, Ecosystem, Licensing
Driver mix: Vision 18%, Customer need 73%, Market window 0%, Upstream 0%, Portfolio 9%
Idea-to-need index: 0.20 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 19.0 / 25

Criterion	Score	Basis
Cadence	4.5	A feature release about every six months (2024-07, 2025-01, 2025-05, 2026-01, 2026-07) and patch releases on both LTS lines
Roadmap transparency	3	A blog per release and open GitHub; roadmap statements limited to the LTS rhythm
Say-do	4	3.25 features reached the 3.27 LTS twelve months later as announced; few promises to test
Velocity	3	Audit log, two-factor, AI agent and container view, mostly additive
Lifecycle stability	4.5	An LTS about every 18 months, supported three years with published end-of-life dates; platform drops announced with a paid extended option

Commercial risk: 7.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	0.5	No licence or price change found; 25 free hosts since 2009
Purchase constraints	1.5	Community edition free without limits; Enterprise by quote above 25 hosts
Channel and access	1.5	Open downloads and public repositories; partner terms not found
Owner stability	1.5	Private Norwegian company with the same product since 2008; no acquisition found
Cost of staying supported	2	Three-year LTS; from 3.27 Solaris, AIX, HP-UX and SUSE need a paid extended support agreement

Technical lock-in: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Promise language and masterfiles are specific to CFEngine
Export path	3.5	No converter found; GPL v3 code allows a fork
Stack coupling	0.5	Any Linux or Windows host
Hardware / cloud coupling	0.5	None
Skills and tooling coupling	3.5	Small skills pool

Integrator fit: 9.0 / 20

Criterion	Score	Basis
Partner programme openness	2	Not found; direct sales
Multi-tenancy and self-service	2	Role-based host visibility and report access
API and infrastructure-as-code	3	Enterprise REST API, cfbs, cf-remote
Skills and certification	2	Training offered; certification not found

AI leverage: 5.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	0	2015: None
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	3	2026: 3.27 LTS: Mission Portal AI agent answers questions from reporting data through visible SQL; OpenAI, Anthropic, Gemini, Ollama or any OpenAI-compatible endpoint
Agent openness	2	2	2	2015: Enterprise REST API; no official MCP server

Year by year: 2015: 2 · 2016: 2 · 2017: 2 · 2018: 2 · 2019: 2 · 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 5

AI say-do, 2023 to 2026: 1 AI items announced; 1 GA, 0 still preview, 0 pending, 0 dropped. The AI agent shipped in an LTS without a beta label.

CFEngine's one AI feature is an operator assistant that answers questions about the estate from reporting data, with the provider chosen by the customer, including a local model. It generates no policy code, and there is no agent interface beyond the REST API.

Reading

CFEngine is the steadiest product in this group: the same owner since 2008, the same free tier since 2009, a published LTS rhythm that has held, and no licence event to report. The price of that steadiness is scope. It configures hosts and nothing else, the Community edition is Linux only, 3.27 dropped Solaris, AIX, HP-UX and SUSE from standard support, and the skills pool is small. A buyer should check the platform list of the current LTS against their estate before anything else.

Open questions and items to re-score

SAML or OIDC single sign-on: not found in the current documentation.
Node counts behind the vendor's scale claims.
cfbs modules for clouds or hypervisors; the index was not browsed directly.
3.27.0 release date: the blog and endoflife.date say 2026-01-09; one search summary said 2026-01-29.
Data handling terms of the AI agent per provider.

	’21	’22	’23	’25	’26
Provisioning breadth
Configuration management depth
State, planning and safety		1
Language and authoring	1
Orchestration and self-service			1
Scale and control plane
Security and compliance				1
Bare metal and day-2 operations
Ecosystem and integrations	2
AI assistance					1