CIO’s on the other hand are less favorable. In many cases they don’t know how much open source is being used. They are the people who have to deal with governance and risk.

You have your main statement backwards. When a company comes to get a subscription for open source its often because they already have one or more instances of it in use and they want to manage internal risk. This is the basis of the business model – sales and marketing expenses are hugely reduced because the consumer can prove to their satisfaction that the software does what they need it to. Only then does the consumer need to engage as a customer if they want help managing the risk.

James