Salt: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (open-source project plus Broadcom's commercial VMware Salt, scored together)
Owner: Broadcom Inc., through VMware; Broadcom staff are the full-time core maintainers; founder Tom Hatch left Broadcom in May 2024 and core developer David Murphy retired on 2025-04-01
Engine: The open-source Salt engine (master, minions, salt-ssh); the commercial product adds the VCF Salt RaaS control plane
Licence: Apache-2.0 for the engine, no change found. Commercial: VMware Cloud Foundation SaltStack (formerly Tanzu Salt, Aria Automation Config, SaltStack Enterprise), supported by the VCF business unit; price and metric not published
Latest release: 3008.3 LTS, 3007.15 STS capstone and 3006.28 LTS, all 2026-09-30; 3008.0 LTS GA 2026-05-27
Support lifecycle: 3008 LTS active to June 2027, security fixes to June 2028; 3006 LTS security fixes only, to June 2027; the 3007 STS line closed with 3007.15; commercial VCF SaltStack end of support October 2028
Next milestone: none published; no 3009 plan found
Targets: Linux, Windows and macOS minions; network devices through proxy minions; non-minion hosts and appliances through Salt Resources (3008) and salt-ssh; Salt Cloud drivers for the main clouds (not enumerated). vSphere: core support deprecated in 3006.0 (2023-04-18), community saltext.vmware last tested against Salt 3004; Proxmox VE: community saltext-proxmox, last release 2.0.1 (2024-11-07); Nutanix, Hyper-V, XCP-ng and KubeVirt: no maintained module found; Kubernetes: community saltext-kubernetes 3.0.0 (2026-09-15)
Tier: Configuration management
Archetype: Capable core, shrinking under a portfolio owner
Evidence grade: B. Release dates, lifecycle windows, release notes for 3006 to 3008 and the project blog were read from saltproject.io, docs.saltproject.io and GitHub. Commercial pricing and metric were not found, ownership dates for the VMware and Broadcom acquisitions were not fetched, and releases before 2023 are dated only by version name.

Scorecard

Dimension	Score	Direction
Capability today	60.0 / 100	higher is better
Momentum since end of 2022	+1.7 points (2015 to 2022: +1.2)	higher is better
Credibility	12.5 / 25	higher is better
Commercial risk	15.5 / 25	lower is better
Technical lock-in	8.0 / 25	lower is better
Integrator fit	9.5 / 20	higher is better
AI leverage	1.5 / 20	higher is better
Ledger Index	47.5 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	2.5	2.5	2.5	2
Configuration management depth (12)	4	4.5	4.5	4.5
State, planning and safety (12)	2.5	2.5	2.5	3
Language and authoring (10)	3	3	3	3
Orchestration and self-service (10)	3.5	3.5	3.5	3.5
Scale and control plane (8)	4	4	4	4.5
Security and compliance (10)	2.5	2.5	2.5	3.5
Bare metal and day-2 operations (8)	2.5	2.5	2.5	2.5
Ecosystem and integrations (8)	3.5	3.5	3.5	3
AI assistance (7)	0	0	0	0
Total / 100	57.1	58.3	58.3	60.0

Year by year: 2015: 57.1 · 2016: 58.3 · 2017: 58.3 · 2018: 58.3 · 2019: 58.3 · 2020: 58.3 · 2021: 58.3 · 2022: 58.3 · 2023: 59.3 · 2024: 61.1 · 2025: 61.1 · 2026: 60.0

What moved the score

Year	Domain	Change	Points	Trigger
2016	Configuration management depth	4 → 4.5	+1.2	2016.3: proxy minions bring network devices under the same state system
2023	Security and compliance	2.5 → 3	+1.0	3006.0: netapi clients disabled by default and onedir packages
2024	Scale and control plane	4 → 4.5	+0.8	3007.0: master clustering for high availability; 3008.0 adds tunable worker pools and OpenTelemetry
2024	Security and compliance	3 → 3.5	+1.0	3007.0: Vault token renewal and revocation; x509_v2 default in 3008.0
2026	Ecosystem and integrations	3.5 → 3	-0.8	3008.0: about 750 modules out of core with no deprecation period; content depends on volunteer extensions and the community manager role has been vacant since 2024-09
2026	Provisioning breadth	2.5 → 2	-1.5	3008.0: community extensions, including the Proxmox and VMware modules, removed from core; coverage now rests on volunteer extensions with the Proxmox one idle since 2024-11
2026	State, planning and safety	2.5 → 3	+1.2	3008.0: state.graph shows the dependency graph before a run

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-04	3006.0 LTS: onedir packages only, netapi clients off by default, core vSphere support deprecated	Packaging	P
2024-01	Policy changes: enhancement proposal process ended, bulk of modules to leave core	Ecosystem	P
2024-01	Broadcom ends standalone sales of Aria products; sold inside VVF or VCF	Licensing	P
2024-03	3007.0 STS: master clustering for HA, Vault token renewal	Scale	C
2024-05	Founder Tom Hatch leaves Broadcom; Salt teams cut with other VMware teams	Ecosystem	P
2024-06	Community Core Maintainer Program launched	Ecosystem	C
2024-08	Great Module Migration: about 750 modules to leave core in 3008 without a deprecation period	Packaging	P
2024-10	Packages move to packages.broadcom.com; packages older than 3006 dropped	Packaging	P
2024-10	Commercial product decoupled from bundles as VCF SaltStack; end of support October 2028	Licensing	P
2025-01	POP and Idem archived; 3008 re-dated from fall 2024 to April 2025	Language	P
2025-04	Core developer David Murphy retires after more than ten years	Ecosystem	P
2025-06	Open Hour: 3008 moved to fall 2025; 3006 and 3007 support extended	Packaging	C
2026-04	Supply chain incident response: secrets and signing certificates rotated, Actions pinned, 3006.24 and 3007.14 reissued	Security	C
2026-05	3008.0 LTS: Salt Resources, OpenTelemetry, state.graph, community extensions removed	Configuration management	V
2026-09	3007.15 capstone closes the STS line; 3006 moves to security fixes only	Packaging	P

Centre of gravity: Packaging (5), Ecosystem (4), Licensing (2)
Blind spots (no items): Provisioning breadth, State and planning, Orchestration, Bare metal, AI
Driver mix: Vision 7%, Customer need 27%, Market window 0%, Upstream 0%, Portfolio 67%
Idea-to-need index: 0.20 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 12.5 / 25

Criterion	Score	Basis
Cadence	3	Point releases about monthly on the maintained lines; majors irregular, 26 months between 3007.0 and 3008.0
Roadmap transparency	3	Open Hour posts and the project blog; no written roadmap and no 3009 plan
Say-do	1.5	3008 LTS was promised for fall 2024, April 2025 and fall 2025 and shipped 2026-05-27
Velocity	2.5	One or two substantive items per major (clustering in 3007, Resources in 3008), with two years between majors
Lifecycle stability	2.5	LTS windows are clear, but the STS line ended early, 3006 dropped to security only and 3008 removed modules without a deprecation period

Commercial risk: 15.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3	Engine licence unchanged; the commercial product was repackaged twice since 2023 and standalone sales ended in January 2024
Purchase constraints	3	Engine is free; the commercial edition is quote only through Broadcom with no published metric
Channel and access	2.5	Open downloads for the engine; the 3008 compatibility patch for the commercial RaaS plugin is only on the Broadcom support portal
Owner stability	4	Post-acquisition owner with team cuts, founder and a core maintainer gone, and 19 of the 20 newest commits from one account in September 2026
Cost of staying supported	3	Forced move from 3006 to 3008 with module removals; commercial support ends October 2028

Technical lock-in: 8.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	SLS files are YAML and Jinja in plain text, Salt specific
Export path	3	No conversion path to another tool; states and pillar need rewriting
Stack coupling	1	Master and minion over ZeroMQ or TCP with bundled Python; the commercial UI needs the RaaS stack
Hardware / cloud coupling	0.5	Any host, fully offline
Skills and tooling coupling	2	Skills common among long-term users and scarcer in the market than Ansible's

Integrator fit: 9.5 / 20

Criterion	Score	Basis
Partner programme openness	2	No Salt-specific programme; the commercial edition goes through Broadcom's channel
Multi-tenancy and self-service	2	External auth ACLs on the master; tenant roles and a UI only in the commercial edition
API and infrastructure-as-code	3.5	salt-api, runners and the event bus; netapi clients are off by default since 3006.0
Skills and certification	2	No certification found; shrinking public community

AI leverage: 1.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	0	2015: None
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	1.5	1.5	1.5	2015: salt-api REST interface with external auth; no official MCP server for operators (the repository's MCP servers expose developer test tooling)

Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was announced for Salt between 2023 and 2026 in the sources read.

Salt has no AI code generation, no assistant and no agent interface for operators. The only AI-related code in the project serves its own developers, so the score rests on the REST API alone.

Reading

Salt still does the hard parts well: an agent fleet with an event bus, master clustering, scheduled enforcement and a dry run that works everywhere, which is why its configuration, scale and orchestration scores match or beat Ansible's engine. Everything around that core has contracted since Broadcom took over: modules left core without a deprecation period, the vSphere and Proxmox paths are deprecated or idle, named maintainers have left and the LTS slipped three times. The one thing a buyer should check is the team behind the next release, because the open-source cadence now depends on a handful of Broadcom engineers and the commercial edition has a published end of support in October 2028.

Open questions and items to re-score

Commercial price, metric and edition terms for VCF SaltStack were not found.
Dates of the VMware acquisition of SaltStack (2020) and the Broadcom closing (2023) were not fetched.
Steps dated 2016 (proxy minions) use the version name 2016.3 from the lifecycle table; the release note was not read.
The 3006 security end date: the docs table says June 2027, a GitHub discussion reported January 2027.
Whether FIPS mode and SSO exist in the open-source edition, and who maintains saltext-vcf.
The current size of the core team; the commit concentration is a single observation window.

	’16	’23	’24	’26
Provisioning breadth
Configuration management depth	1
State, planning and safety				1
Language and authoring
Orchestration and self-service
Scale and control plane			2
Security and compliance		1	1
Bare metal and day-2 operations
Ecosystem and integrations
AI assistance