Everyone talks about Vault OSS like it's a toy. It's not. For 90% of shops, it does the job. But HashiCorp's sales team pushes Enterprise hard, and their docs obfuscate what you actually lose by not paying. I've run both in load tests. Here's the raw breakdown.
The big, tangible gaps aren't about the core secret engine. They're about operations, governance, and scaling. You can build a secure system with OSS, but you'll be building a lot of the management glue yourself.
**What you genuinely miss in OSS:**
* **Multi-Factor Authentication (MFA) for login:** OSS only has MFA for `sudo` operations (e.g., `vault token create`). Enterprise adds MFA to the initial `vault login`. This is a major compliance checkbox for many.
* **Integrated Storage Autopunctuation:** In OSS, the integrated storage backend (Raft) needs manual `vault operator raft autopilot` commands or custom scripts to handle dead nodes. Enterprise has this automated. If a node dies, you're manually intervening with OSS.
* **Namespaces:** This is the big one. Enterprise namespaces aren't just folders; they provide true tenant isolation with delegated auth and policy management. In OSS, you're faking it with clever pathing and policies, which gets messy.
* **Performance Replication (not DR):** OSS has DR replication for survival only. Enterprise Performance Replication lets you serve reads from secondaries, crucial for global low-latency setups. Without it, all reads go to your primary cluster.
* **Control Groups:** Enterprise can require multiple authorized entities to approve a secret request before it's released. OSS can't do this natively. You'd need to build an external workflow.
**What you can work around (with pain):**
* **HSM integration:** OSS supports it via the `pkcs11` seal. It's just not as polished.
* **Monitoring:** You rely on the raw metrics endpoint and your own dashboards. No pre-built Vault-specific dashboards from HashiCorp.
* **Backup/DR:** The core `vault operator` commands exist in OSS. You script and schedule them yourself.
Example of the MFA difference? In OSS, your `vault login` might just need a password. In Enterprise, you can enforce this:
```hcl
# This is an Enterprise-only auth method config
path "auth/userpass/login/*" {
capabilities = ["create"]
mfa_methods = ["my_totp"]
}
```
Bottom line: If you need true multi-tenancy, automated storage management, or global read scaling, you're looking at Enterprise. If you're a single team or can handle the ops overhead, OSS is perfectly viable. Don't let them scare you into a purchase until you've mapped these gaps to your actual requirements.
-- bb
-- bb
I'm a platform engineer at a fintech with about 200 developers; we manage over 300 microservices and previously ran Vault OSS for three years before migrating to Enterprise last year.
* **Operational Scaling Gap:** The most painful OSS limit is integrated storage management. In Enterprise, the autopilot feature automatically removes dead nodes and manages server stability. With OSS, a failed node requires manual `vault operator raft remove-peer` and a cleanup script. We experienced 30-45 minutes of degraded performance during an AZ outage before manual intervention, while Enterprise recovers in under 5.
* **True Multi-tenancy Cost:** For OSS, you emulate namespaces with path-based policies and separate auth backends. This becomes a configuration management burden beyond ~15 distinct teams. Enterprise namespaces provide delegated admin and isolated quotas. We budget ~$45k/year for Enterprise, but the alternative was building and maintaining a custom management layer estimated at 1.5 FTE of ongoing platform work.
* **Compliance & Auth Surface:** OSS lacks MFA on initial user login, only for sudo operations. Enterprise provides integrated MFA (TOTP, Okta, PingID) at login, which was a non-negotiable requirement for our SOC2 audit. Implementing a secure proxy to enforce pre-login MFA for OSS added complexity and a new failure point.
* **Performance at Scale:** Both handle core secret operations similarly. However, OSS performance degrades under heavy policy evaluation loads in a multi-tenant scenario. In our load tests, OSS held ~2k req/s per node before latency spikes, while Enterprise with namespaces held ~2.5k req/s, as policy evaluation is isolated per namespace.
I recommend Enterprise if you have more than 10 distinct teams requiring isolated policy management or have strict compliance requirements for login MFA. For OSS, you need a dedicated platform team to build the automation it lacks. If your use case is a single product team or a static infrastructure secret store, OSS is perfectly viable. To make a clean call, tell us your team count and whether you need login MFA for compliance.
benchmark or bust