Editions¶
Vista Platform ships as a free, source-available Vista Platform Core plus two paid editions — Vista Platform Enterprise and Vista Platform MSP. An edition is a licensing boundary that decides whether a capability exists in a build at all. It is not the same thing as a tier — tiers are commercial packaging that a deployment's operator authors and assigns, in every edition including Core; an edition decides which capabilities a tier is allowed to grant, and whether anything can be charged for it.
Anything not listed on this page is Core.
Core¶
Free and source-available. One team securing its own estate.
Everything not listed as Enterprise or MSP below. Full discovery (active OT/ICS probing included), the complete crypto inventory and CMDB, compliance evaluation against the free frameworks, CBOM generation and CycloneDX export, RBAC, local users and invitations, audit logging, RLS tenant isolation, the mTLS service mesh, and the sensor and agent source. Subscription tiers and the entitlements they compose are Core too — a Core deployment authors, assigns and enforces them; what Core lacks is any way to charge for them.
Enterprise¶
A company with auditors and an identity provider.
Core, plus compliance authoring, federated identity, audit-grade CBOM evidence, external system integration, and the regulated framework catalog.
MSP¶
Selling this as a service to others.
Enterprise, plus the multi-tenant management plane. Note that tenant isolation itself is Core — MSP sells the plane that manages tenants, not the model that isolates them.
Paid capabilities¶
| Capability | Edition | What it does | Documentation |
|---|---|---|---|
| Own AI Model Provider | Enterprise | Tenant may connect its own AI model provider (Anthropic, or any OpenAI-compatible endpoint) from Settings → AI assistant, instead of using the one this deployment provides | Guide |
| Self-Service Billing | MSP | Tenant-facing subscription, invoices, plan change and payment portal (admin-service /my-billing). Absent from Core; usage-against-limits is unconditional. | in MSP docs |
| CBOM Signing & Attestation | Enterprise | Cryptographic signing of CBOM artifacts with compliance-attestation layers | in Enterprise docs |
| CMDB / ITSM Sync | Enterprise | Sync inventory out to an external CMDB or ITSM (ServiceNow, Device42, SolarWinds) | in Enterprise docs |
| NetBox Connector | Enterprise | Import sites, prefixes, VLANs, device types and devices from a NetBox network source of truth, see the drift between NetBox and discovered inventory, and optionally sync selected classes with NetBox in both directions, every write planned first. | in Enterprise docs |
| Custom Branding | Enterprise | White-label admin and web UI: replace the product logo, favicon and display name with your own. Brand colors are included in every edition. | in Enterprise docs |
| Custom Compliance Policies | Enterprise | Tenant may author their own compliance frameworks beyond platform-published ones | in Enterprise docs |
| OT Inventory Lens | Enterprise | OT-specific inventory view and dashboards | No self-service UI yet |
| SIEM Export | Enterprise | Forward audit events to an external SIEM (Splunk, Datadog, Elastic, webhook) | in Enterprise docs |
| SSO / SAML | Enterprise | Single sign-on via your own identity provider — OIDC (Google, Microsoft, Azure AD) or SAML 2.0 — with group-to-role mapping and an org-wide authentication policy | in Enterprise docs |
| Threshold Overrides | Enterprise | Tenant may customize measurement thresholds on subscribed platform-framework controls | No self-service UI yet |
Why each of these is paid¶
Enterprise: compliance authoring
Core keeps the full evaluation + materialization engine and the free frameworks; authoring your own policy and retuning shipped thresholds is the paid surface.
custom_policies · threshold_overrides
Enterprise: CBOM evidence
Core generates CBOM artifacts and exports CycloneDX. Signing, attestation layers, and drift comparison are the audit-grade surface.
cbom_signing
Enterprise: identity
Core ships local users, invitations, and RBAC. Federated identity in all three flavors (tenant OIDC/SAML, social signup, staff SSO) is paid.
sso_saml
Enterprise: white-label
Core keeps the palette/theme selector and saves brand colors (a single org styling itself). Replacing the product marks (logo, favicon, display name) with your own is the paid surface.
custom_branding
Enterprise: external system integration
Core keeps the entire internal CMDB (assets, crypto configurations, certificates, keys, every lens). Syncing it OUT to a foreign CMDB/ITSM — ServiceNow, Device42, SolarWinds — is the paid surface.
cmdb_sync
Enterprise: network source of truth
Core keeps every discovery path that FINDS a device. Connecting a customer's NetBox (their statement of what the network is meant to be, and the sites/prefixes/VLANs that give an address its meaning) is the paid surface: the import and the drift view that compares the two, and the opt-in two-way sync that also pushes selected classes back to NetBox. Listed separately from cmdb_sync rather than folded into it: a CMDB sync pushes inventory out to an ITSM, this exchanges topology with a network source of truth, and a tenant may well want one without the other.
connector_netbox
Enterprise: bring your own AI model provider
Core has no model clients at all (ADR-0008 edition placement), so there is nothing for a Core tenant to connect. On Enterprise every tenant may connect its own provider; on MSP a plan decides, which is what lets a service provider choose between including a model in the plan and letting customers bring theirs.
ai_tenant_provider
Enterprise + MSP: audit forwarding
Core logs every audit event and serves every audit query. Forwarding them to an external SIEM (Splunk, Datadog, Elastic, webhook) is paid. Listed as Enterprise because MSP is a superset — EditionFor returns the MINIMUM edition that may grant the item.
siem_export
Enterprise: OT/ICS
The OT-specific inventory lens. OT active probing is deliberately NOT listed: it is Core, an ordinary switch that every tier ships turned on and that a plan or a per-tenant exception can turn off. Its safety never rested on a paywall — OT probes run only when a person asks for them on a scan, and automatic scanning refuses them outright.
ot_primary_lens
MSP: monetization
The tenant-facing self-service billing surface — subscription, invoices, plan change, payment portal — is served by admin-service/ee/billingapi (/my-billing/**). It exists for a service provider billing its own customers. An Enterprise company runs the platform for itself and has nobody to bill, so an Enterprise licence does not cover it (owner decision 2026-09-23). Core mounts none of it. Tier ASSIGNMENT and usage-against-limits stay Core, so entitlements still resolve and Settings → Usage & Limits still works.
billing_portal
Generative AI capabilities¶
The five generative AI seams — narrator, author, enricher, ask/query and remediator — are Enterprise. Like the MSP surface below, they are carved by which SOURCE ships in a build (the public export deletes each seam's ee/ implementation package outright), not by a billable item, so they have no row in the table above either. Every one of them has a rule-based null default that answers in every edition, Core included — see AI assistant for what each falls back to without a model.
| Seam | What it does | Documentation |
|---|---|---|
| Ask / Query | Ask a question about your inventory in plain language. The model's whole output is one line of the query language, shown to you editable, before anything runs — never rows the model guessed at. | in Enterprise docs |
| Author | Draft compliance controls from a standard you paste in, each draft citing the passage it came from. Nothing is saved until you accept it. | in Enterprise docs |
| Enricher | Propose an end-of-life catalogue row for a product the offline catalogue has no answer for, citing the vendor's own lifecycle page. | Guide |
| Narrator | Narrate what changed between two CBOM artifacts in prose, each sentence citing the component or finding it describes. | in Enterprise docs |
| Remediator | Draft a remediation plan for a finding as an editable proposal. Never applied automatically. | in Enterprise docs |
MSP management plane¶
The MSP edition is carved by which services ship, not by capability flags, so these areas have no entry in the table above. Tenant isolation is Core — MSP sells the plane that manages tenants, not the model that isolates them.
| Area | What it covers |
|---|---|
| Tenant lifecycle | Creating, suspending, migrating and deleting tenants; the tenant switcher and cross-tenant views. |
| Billing and subscriptions | Payment provider wiring, invoicing, plans and pricing, trials, and the subscription lifecycle. |
| Announcements | Platform-wide notices to tenants. The authoring API exists; delivery to tenants, and the console page with it, are not built yet. |
| Support tickets | Operator-side support queue spanning tenants. |
| Cost monitoring | Per-tenant cost attribution and platform cost dashboards. |
| Cross-tenant security and SIEM | Fleet-wide security posture and audit forwarding across every tenant, as distinct from a single tenant's own SIEM export. |
| Legal acceptance ledger | The record of which tenant accepted which version of the terms. Authoring and serving the documents themselves is Core. |