SolarWinds Observability Self-Hosted: Monitoring Ledger 2026

Part of the Infrastructure Monitoring Ledger (edition 2026-10-04). How the scores work: methodology.

Snapshot

Tier: Leader incumbent
Owner: Turn/River Capital, private equity, take-private closed 2025-04-16 (Silver Lake and Thoma Bravo before; public 2018-2025)
Licence model: Annual per-node subscription in Essentials, Advanced and Premier tiers; legacy perpetual module licences on maintenance only
Products scored: SolarWinds Observability Self-Hosted 2026.4 on SolarWinds Platform: NPM, SAM, NCM, NTA, IPAM, VNQM, VMAN, SRM, Log Analyzer
Latest release: SolarWinds Observability Self-Hosted 2026.4, 2026-09-01
Next signal: 2027.x: final removal of Network Atlas; SW1 closed-loop runbook execution and Proxmox Ceph monitoring, no dates given
Archetype: Broad incumbent, private-equity owned
Evidence grade: B. Release notes and filings are primary (A), but the AI evidence dates differ from the release table and some AI items may describe the SaaS edition.

Scorecard

Dimension	Score	Direction
Capability today	89.4 / 100	higher is better
Momentum since end of 2022	+3.8 points	higher is better
Credibility	19.5 / 25	higher is better
Commercial risk	16.0 / 25	lower is better
Technical lock-in	14.0 / 25	lower is better
Integrator fit	13.5 / 20	higher is better
AI leverage	11.5 / 20	higher is better
Ledger Index	68.3 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Server, virtualization and storage (12)	4	4	4.5	4.5
Network monitoring (12)	4.5	5	5	5
Application and service monitoring (10)	4	4	4.5	4.5
Data collection and scale (12)	4	4.5	4.5	4.5
Alerting and event management (12)	3.5	4	4	4.5
Visualisation and reporting (8)	3.5	4	4.5	4.5
Logs and traces (8)	2.5	3.5	4	4
Automation and remediation (8)	3	3.5	4	4.5
Security and compliance (8)	3	4	4	4.5
New-platform support (VMware exit) (10)	1	3	3.5	4
Total / 100	67.6	80.0	85.6	89.4

Year by year: 2016: 67.6 · 2017: 67.6 · 2018: 67.6 · 2019: 80.0 · 2020: 78.4 · 2021: 79.2 · 2022: 85.6 · 2023: 85.6 · 2024: 85.6 · 2025: 87.4 · 2026: 89.4

What moved the score

Year	Domain	Change	Points	Trigger
2019	Alerting and event management	3.5 → 4	+1.2	Orion 2019.4: alert mute scheduling, certified ServiceNow app, trap and syslog deduplication rules
2019	Automation and remediation	3 → 3.5	+0.8	Orion 2019.4: SWIS REST API via OrionSDK; certified two-way ServiceNow integration
2019	Data collection and scale	4 → 4.5	+1.2	Orion 2019.4: 100 polling engines and 1,000,000 elements per deployment; centralized upgrades
2019	Logs and traces	2.5 → 3.5	+1.6	Orion 2018.4/2019.4: Log Analyzer with syslog and Windows events, full-text search, log alerts
2019	Network monitoring	4.5 → 5	+1.2	Orion 2019.4: Network Insight for Nexus, ACI, Palo Alto; Meraki; Orion Maps topology; NCM firmware audit
2019	New-platform support (VMware exit)	1 → 3	+4.0	VMAN 2019.4: native Nutanix AHV via Prism API; AWS and Azure VM monitoring
2019	Security and compliance	3 → 4	+1.6	Orion 2019.4: SAML SSO, FIPS 140-2 mode, audit log of admin changes
2019	Visualisation and reporting	3.5 → 4	+0.8	Orion 2019.2/2019.4: browser Orion Maps, PerfStack canvas, scheduled PDF and Excel reports
2020	Security and compliance	4 → 3	-1.6	SUNBURST supply-chain backdoor in Orion builds disclosed 2020-12: minus 1.0 (the security record)
2021	Security and compliance	3 → 3.5	+0.8	Orion 2020.2.6, 2021-10: first release from the rebuilt Next-Generation Build System; new signing certificates
2022	Application and service monitoring	4 → 4.5	+1.0	Platform 2022.4: DPA integration, application dependency mapping, recorded synthetic transactions
2022	Automation and remediation	3.5 → 4	+0.8	Platform 2022.4: webhooks to ServiceNow and Jira; SAM service restarts; NCM config rollback
2022	Logs and traces	3.5 → 4	+0.8	Platform 2022.4: Log Viewer in HCO Advanced; log events overlaid on metrics in PerfStack
2022	New-platform support (VMware exit)	3 → 3.5	+1.0	Platform 2022.4: Kubernetes clusters by daemonset; AWS, Azure and GCP IaaS
2022	Security and compliance	3.5 → 4	+0.8	Platform 2022.4: MFA; Secure by Design build pipeline in place; no Orion KEV entries 2023-2026
2022	Server, virtualization and storage	4 → 4.5	+1.2	Platform 2022.4: Kubernetes nodes by daemonset agent, Nutanix AHV and cloud VMs beside on-prem servers
2022	Visualisation and reporting	4 → 4.5	+0.8	Platform 2020.2 to 2022.4: Modern Dashboards with custom queries, map link overlays, PDF export
2025	New-platform support (VMware exit)	3.5 → 4	+1.0	2025.4: native Proxmox VE 8 discovery and metrics; no XCP-ng, KubeVirt or OpenStack templates
2025	Security and compliance	4 → 4.5	+0.8	v2024.2 certified Common Criteria EAL 2+ and FIPS 140-2, DoDIN APL in 2025-01; air-gapped install; no multi-tenancy
2026	Alerting and event management	4 → 4.5	+1.2	2025.2 recurring maintenance windows; 2026.1 Squadcast on-call and escalation; 2026.4 SLA mute
2026	Automation and remediation	4 → 4.5	+0.8	2026.4: Ansible remediation triggered from alerts; no official Terraform provider for self-hosted

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-05	2023.2: SD-WAN policy monitoring for Cisco Viptela and Aruba	D2 Network	C
2023-07	Next-Generation Build System aligned with NIST SSDF	D9 Security	V
2024-02	2024.1: renamed SolarWinds Observability Self-Hosted; wireless heat maps in Intelligent Maps	D12 Packaging and licensing	P
2024-06	2024.2: NVIDIA GPU monitoring in SAM	D1 Server and virtualization	M
2024-06	2024.2: Network Atlas import into Intelligent Maps	D6 Visualisation and reporting	C
2025-01	v2024.2 certified Common Criteria EAL 2+ and FIPS 140-2; DoDIN APL	D9 Security	C
2025-03	Acquires Squadcast incident response and on-call platform	D5 Alerting and events	P
2025-04	Turn/River Capital completes take-private	D12 Packaging and licensing	P
2025-06	2025.2: scheduled recurring maintenance windows	D5 Alerting and events	C
2025-10	2025.4: native Proxmox VE monitoring; automated HA repair	D1 Server and virtualization	M
2026-02	2026.1: Squadcast incident response integration; Proxmox datastore metrics	D5 Alerting and events	P
2026-06	2026.2: SW1 AI agent preview; Discovery Central onboarding	D7 AI-assisted operations	V
2026-09	2026.4: SW1 GA; Ansible remediation from alerts; SLA mute for maintenance	D7 AI-assisted operations	V

Centre of gravity: Alerting and events (3), Security (2), Packaging and licensing (2)
Driver mix: Vision 23%, Customer need 31%, Market window 15%, Upstream 0%, Portfolio 31%

Credibility: 19.5 / 25

Criterion	Score	Basis
Cadence	4.5	Two or three platform releases a year with dated release notes, 2023.1 to 2026.4
Roadmap transparency	3.5	Public release notes and deprecation notices, THWACK roadmap threads; no written public roadmap
Say-do	4.5	14 of 14 tracked 2023-2026 items GA within 12 months; 9 within three months
Velocity	4	Several capabilities per release, e.g. Proxmox, HA repair, maintenance windows, SW1 in 2025-2026
Lifecycle stability	3	Renames in 2022 and 2024; Network Atlas deprecated; new features withheld from perpetual licences

Say-do record, 2023 to 2026: 14 items 2023-2026: 14 shipped, 9 within three months, 5 with 4 to 11 months lag (Squadcast integration 11 months), none dropped. Many items were announced on or near the GA date.

Commercial risk: 16.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3.5	2022 move to node subscriptions; 2024 perpetual maintenance up 10 to 25 percent to push migration
Purchase constraints	3.5	New sales subscription only, tiered bundles, list prices quote-gated
Channel and access	1.5	Free 30-day trial, public documentation, open Registered partner tier
Owner stability	4	Private-equity take-private by Turn/River in 2025-04; CEO succession announced 2026-08
Cost of staying supported	3.5	Proxmox, SW1 and map parity features only on subscription; perpetual maintenance price rises

Security record of the product itself: No flaw in the scored Orion/SolarWinds Platform products has a KEV date in 2023-2026 (CVE-2020-10148 and CVE-2016-3643 were added 2021-11-03). SUNBURST (disclosed 2020-12, fixed in 2020.2.1 HF2) lowers Security by 1.0 in 2020; recovery credited to the Next-Generation Build System from 2021. Serv-U CVE-2021-35211 and Web Help Desk CVE-2024-28986 (KEV 2024-08-15) are other products, context only (the security record).

Technical lock-in: 14.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	4	Proprietary SQL Server schema with rollup tables; templates in proprietary XML with SolarWinds macros
Export path	3	SWIS REST queries and CSV/Excel reports; no bulk history export or rule conversion tools
Stack coupling	4	Windows Server and Microsoft SQL Server mandatory; own agent; agentless SNMP, WMI, SSH available
Hardware / cloud coupling	0.5	Any x86 hardware or VM; fully air-gapped operation with offline licensing
Skills and tooling coupling	2.5	SWQL and Orion tooling are proprietary, but the skills pool is large

Integrator fit: 13.5 / 20

Criterion	Score	Basis
Partner programme openness	4	Transform Partner Program since 2022-10, four tiers, about 90 percent of enterprise revenue via channel
Multi-tenancy and self-service	2	Single tenant per instance; account limitations and EOC rollup only, no MSP portal or billing
API and infrastructure-as-code	3	SWIS REST API with Python and PowerShell SDKs; Terraform only for SaaS; Ansible collection is community
Skills and certification	4.5	SolarWinds Certified Professional tracks for NPM, SAM, NCM and Self-Hosted; THWACK community of 190,000

AI leverage: 11.5 / 20

Strand	Today	Latest step
AIOps on monitoring data	3.5	2026: 2025.4 anomaly-based interface alerts; 2026.4 SW1 root-cause diagnosis GA
AI platform stack	2.5	2026: 2026.4: SW1 GA in the self-hosted product; local model gateway still preview since 2025-05
AI-assisted operations	3.5	2026: 2026.4: SW1 GA with log troubleshooting, AI dashboards and config assist; recommends, does not act
Agent openness	2	2016: SWIS REST API covering inventory, alerts and metrics; only a community MCP server exists

AI say-do: 3 announced, 2 GA, 1 preview (local model gateway), 0 pending, 0 dropped. Anomaly detection and SW1 summarise and recommend; SW1 reached GA in self-hosted only in 2026.4.

Reading

SolarWinds is turning its Orion estate into a subscription self-hosted observability suite with an AI agent and incident response on top. The record shows the broadest network and server coverage in the field, steady releases and kept promises, with Proxmox added in 2025 and SW1 GA in 2026. Buyers trade that breadth for a Windows and SQL Server stack, single-tenant design, subscription pressure and a new private-equity owner.

Open questions and evidence caveats

SUNBURST recovery is credited from documented build changes; buyers in regulated sectors may still weigh the 2020 incident.
The AI evidence dates several items differently from the release table, and some AI items may describe the SaaS edition.
OpenTelemetry log and trace intake in the self-hosted product is stated but not tied to a specific release.
Per-node prices are quote-gated; the ranges in the research are reseller estimates.