Open Source vs Licensed Software: Real TCO for Indian SMEs

A ₹9.4 lakh invoice and a very quiet room

In November 2023, a 140-seat engineering firm off Old Madras Road showed us a renewal quote from a large software vendor. ₹9.4 lakh for the year, up from ₹6.1 lakh the year before. Nothing had been added. The seat count had gone up by eleven because HR hired. The CFO asked a fair question: what is this actually doing for us?

We pulled the logs. Of 140 licensed seats, 71 people had logged in during the previous 30 days. The rest were dormant accounts nobody had reclaimed after people left or moved roles. That is not a vendor problem. That is an asset-management problem, and it is the single most common reason SMEs overpay for software. It is also the reason the open source versus licensed debate so often gets framed wrongly. The question is not which is cheaper. It is which parts of your stack you can afford to run without a throat to choke, and which parts you cannot.

We are SynergyScape. We have deployed both since 2001 — Samba and Zimbra next to Windows Server and Exchange, Zabbix next to SolarWinds, Nextcloud next to SharePoint. We have no ideological position on either. What follows is the arithmetic we actually run when a client asks us to compare.

Where open source genuinely wins

Three workloads account for the overwhelming majority of real open-source savings in Indian SMEs: file storage, internal mail, and infrastructure monitoring. There is a fourth — the database tier — but that one is more nuanced and I will get to it.

The reason these three work is not that the software is free. It is that they are mature, the failure modes are well-documented, and a competent Linux administrator can support them without a vendor on speed dial. When all three conditions hold, open source wins on cost by a wide margin. When even one fails, the math flips.

File servers: the cleanest saving in the whole stack

A 100-user office needs somewhere between 4TB and 12TB of usable file storage, depending on whether they are a design shop or a services firm. Here is what 2026 pricing looks like for the two credible paths.

The year-one saving on the Linux path is roughly ₹4-5.4 lakh for 100 users. That is real. It does not evaporate in year two or three. Across a five-year horizon you are looking at ₹20 lakh or more, and that is before you consider that most SMEs never actually buy all the CALs they are supposed to. (If you are being audited, you should. Microsoft's compliance checks in India have become noticeably more aggressive since 2024.)

What you give up: Group Policy is gone, and you will replace it with Ansible playbooks or a Samba-specific tool like the Samba AD DC's own policy engine — which works, but not the way your Windows administrator expects. NTFS ACLs behave differently under Samba and the mapping is imperfect. Software that expects Windows file locking (older Tally installations, some CAD tools, a few ERP clients) may misbehave. We have seen a ₹40 lakh Autodesk Vault deployment fall over because the PDM backend assumed Windows SMB semantics. Test before you migrate.

Where Samba makes no sense is the small office — under 25 users — where nobody has Linux skills and the cost of a Windows Server Essentials-class licence is a rounding error against the risk of an unmaintained file server. Below that threshold, buy the licence.

Internal mail: the saving is real, the migration is not free

This one is more contentious than it used to be, because Microsoft 365 Business Basic at roughly ₹155 per user per month (2026 India pricing, annual commitment) is genuinely cheap. For 100 users that is ₹1,86,000 a year for mail, calendar, Teams, and 1TB of OneDrive each.

Zimbra Collaboration (the Network Edition, not the open source edition) for 100 users runs around ₹1,30,000-₹1,80,000 a year in licensing, plus you host it. On-prem hardware, backup, and a part-time administrator push it to ₹2,50,000-₹3,20,000 in year one. It is not cheaper than M365 Business Basic. It is cheaper than M365 Business Standard at ₹420/user/month, and materially cheaper than the E3 tier that most SMEs get pushed toward.

Where Zimbra or a similar on-prem mail system genuinely wins:

• You have a regulatory or contractual reason to keep mail on your own infrastructure
• Your mailbox sizes are huge (archival is expensive on cloud tiers)
• You are over 250 users and the per-seat cloud cost is now ₹12-15 lakh a year
• You already have a data centre footprint you are paying for anyway

The trap most people fall into is comparing Zimbra open source edition against M365 and concluding the saving is ₹1.86 lakh. It is — until you price the spam filtering, the AV scanning, the backup (Veeam Backup for Microsoft 365 does not help you here; you need filesystem-level backup), and the person who restarts the mail server at 11pm. We have never seen a sub-100-user organisation come out ahead on self-hosted mail once those costs are counted. Above 200 users, it flips.

Monitoring: the clearest open-source win

Zabbix 7.0, Prometheus with Grafana, or LibreNMS will do everything a 200-seat SME needs to monitor servers, switches, firewalls and UPS units. It will do it at zero licence cost. The licensed alternatives — SolarWinds Network Performance Monitor, ManageEngine OpManager — run ₹1,20,000-₹4,00,000 a year depending on node count and modules.

There is almost no trade-off here worth mentioning. Zabbix is more capable than most SMEs will ever need. The catch is that it needs somebody to design the templates, define thresholds, and respond to alerts. That is the same person you need for Samba. If you already have them, the saving is pure. If you do not, you are buying an AMC from a partner like us to fill the gap, and the price of that AMC (₹35,000-₹60,000 a year for a 200-node environment) is still well south of the licensed tools.

The database tier, and why we are cautious

PostgreSQL 17 and MySQL 8.4 are excellent. They are also not the point of comparison most SMEs think they are making. If your ERP runs on SQL Server and your vendor supports only SQL Server, moving to PostgreSQL is not a licensing decision. It is an application-replacement decision, and the licence saving will be swamped by the migration cost many times over. Do not let anyone talk you into it unless the application vendor has already certified the move.

Where PostgreSQL does win cleanly is greenfield work — internal tools, custom applications, reporting warehouses. At that point the saving is genuine and there is no incumbent to fight.

Where the support cost erases the saving

This is where advocacy gets dishonest. There are workloads where open-source support is either thin, expensive, or both — and where an SME that chose open source to save money ends up spending more.

Directory services at scale

Samba AD works. We run it for clients up to about 150 seats. Past that, when you start needing cross-forest trust, granular password policies, certificate services tied to the domain, and conditional access rules that talk to Intune, you are rewriting Microsoft's product with playbooks. The cost of that engineering, at ₹1,800-₹3,000 an hour for a competent Linux consultant in Bangalore, exceeds the CAL cost somewhere between 150 and 250 seats depending on complexity. Below 150, it is competitive. Above 250, unless you have a specialist on payroll, buy the licences.

Endpoint security

Microsoft Defender for Business at ₹230-₹300 per user per month (2026, India, via CSP) is, frankly, under-priced for what it delivers — EDR, attack surface reduction, and central management through the Defender portal. The open-source alternatives (Wazuh, Velociraptor, OSQuery) are excellent tools, and Wazuh in particular is a serious product. But the minute you deploy them at an SME, you have signed up to run a SIEM with no SOC behind it. Alerts nobody reads are worse than no alerts, because they generate compliance paperwork that says you have controls you do not have. For a 100-user firm, Wazuh plus an engineer to run it costs more than Defender for Business plus the time saved. This is a case where the licensing cost is the cheap option, and pretending otherwise is how SMEs end up with a ₹4 lakh a year logging bill and zero detections.

CAD and design tools

There is no open-source substitute for AutoCAD, SolidWorks, or Revit that any Indian fabrication or construction firm can use for client work. LibreCAD and FreeCAD exist, are improving, and are not interoperable at the file-format level that matters. If you are a design firm, this line item is fixed cost. Budget ₹85,000-₹2,40,000 per seat per year for AutoCAD (2026, subscription-only) and stop looking for a workaround.

Tally and the Indian accounting stack

Tally Prime runs on Windows, requires SQL Server or its own data engine, and the licences for the connectors and the ODBC layers are not free. There are open-source accounting tools but none of them speak the Indian GST filing formats in a way your CA will accept. Treat Tally as a fixed cost. The open-source battle is not fought here.

The support-quality trap

There is one more cost, and it is the one nobody prices. Free software has free support in the way that a public library has free legal advice. The forums are good. The enterprise support tiers (Red Hat, SUSE, Canonical's Ubuntu Pro, Percona for MySQL) are genuinely excellent and start around ₹18,000-₹45,000 per server per year. But between the free forums and the enterprise contract there is a wide gap where most SMEs land — and in that gap, when something breaks at 2am, you are depending on a partner like us to know the answer, and you are paying for that.

The failure story that changed how we quote

In August 2022, a 90-seat logistics firm in Peenya asked us to build a Samba file server to replace an ageing Windows Server 2012 R2 box. The saving was clean: about ₹3.2 lakh against Windows Server 2019 Standard plus CALs. We did it. Ubuntu 20.04, Samba 4.13, LVM volumes on a Dell R740, Veeam Agent for Linux for backup. It ran for fourteen months without incident. Then in October 2023 the finance year-end press began and the server filled its LVM volume at 8:47pm on a Friday.

Here is the sequence.

• Samba kept accepting writes. ext4 does not fail gracefully when an LVM thin pool is exhausted; it does what the kernel tells it to, which was to allocate and keep going.
• The volume did not fill with files. It was over-provisioned on thin LVM, and snapshots from a second script that nobody had documented were consuming space in the pool.
• Veeam Agent for Linux stopped taking snapshots at 9:12pm. The alert went to an email address belonging to an engineer who had left in July.
• On Monday morning, 41 Tally data files and about 9,000 documents were corrupt. Not lost — corrupt, which is worse.
• We recovered from a nightly backup taken at 2am Saturday, losing about 19 hours of work. Six days of manual rekeying by three accounts staff, plus two days of our engineering time at no charge because we had signed a fixed-fee AMC that did not distinguish.
• The firm's own estimate of the business impact was ₹4.1 lakh in delayed invoices and one client penalty.

What fixed it: a four-hourly snapshot schedule moved off thin LVM, a Zabbix alert on both filesystem usage and snapshot pool usage routed to a shared mailbox, and a monthly restore test written into the AMC. Total incremental cost: ₹38,000 one-time plus ₹9,000 a year in monitoring changes. Cheaper than one more incident.

The lesson is not that Samba failed. Windows Server with thin-provisioned VHDX would have done exactly the same thing. The lesson is that open-source deployments often skip the boring operational scaffolding — the alerting, the documented runbook, the restore tests — because the saving is visible and the scaffolding is not. We now quote that scaffolding on every Linux deployment we do, and we have lost deals because of it. That is the correct outcome.

A worked TCO for a 100-user Bangalore firm

Here is the comparison we run when a client asks us to justify a decision. It assumes a 100-user professional services firm, five-year horizon, Bangalore, 2026 prices.

The two stacks converge. In year one, open source looks ₹2-3 lakh cheaper. By year five, the extra headcount has eaten the gap. That does not mean open source is worse. It means the saving is not where the advocates say it is. It is real in small numbers where the existing team has the skills, and it is illusory in medium-sized firms where a partial hire is needed just to keep the lights on.

Now change one variable. Suppose the firm already employs a Linux administrator for a separate product — a SaaS platform, an in-house analytics stack, anything. Suddenly the extra headcount is not a cost, because it is already paid for. In that case the open-source path saves roughly ₹28-33 lakh across five years. Same software. Same staff. Different starting position. That is the point: the decision is about your existing skills, not about the software.

For firms that want help running this analysis before committing, our software and licensing practice does exactly this as a fixed-fee engagement (₹45,000-₹75,000, 2026 pricing) for firms up to 250 seats.

The Bangalore realities that shift the numbers

A few things apply in this city in ways that global TCO calculators ignore.

Power and the cost of self-hosting

If you self-host mail or file services, you need reliable power. Most Bangalore office buildings on the ORR and Whitefield corridors have decent grid supply, but the Cauvery layout and older industrial areas still see four to six hour outages in the pre-monsoon weeks. That means a UPS sized for at least 30 minutes on the critical rack and, if uptime matters, a small DG backup. Add ₹45,000-₹1,80,000 one-time and ₹12,000-₹40,000 a year in maintenance. Cloud-hosted software does not care about your UPS. On-prem open source does. Price it.

Monsoon and cabling

We have seen three separate incidents where water ingress during the June-September monsoon took out structured cabling in freshly fitted-out offices whose contractors had used indoor-rated cable for runs through semi-exposed corridors. That is an infrastructure problem, not a software problem, but it affects both stacks equally. The point is only that if you self-host, your failure surface widens. Cloud-hosted tools keep working when your cabling is wet; your on-prem Samba does not.

ISP lead times

If you are on a leased line with a 45-90 day provisioning window (BSNL and Airtel both still quote this in outer-ring areas), self-hosting at the office implies a business-continuity gap that cloud tools do not. A second ISP at ₹18,000-₹45,000 a month mitigates it. That is another ₹2.2-5.4 lakh a year — which, if you are honest, is a hidden cost of self-hosting that most TCO comparisons ignore.

GST and cross-border licensing

Most commercial software licences from US or EU vendors attract 18% GST on the Indian reseller invoice. Open-source enterprise support bought directly from Canonical, Red Hat, or Percona often does not go through an Indian reseller, which means the input tax credit is not available and you eat the equivalent amount. On a ₹1.5 lakh support contract that is ₹27,000 a year — not a reason to avoid open source, but the sort of thing that influences whether the finance head signs off. Insist that your vendor invoice from an Indian entity wherever possible.

DPDP and data residency

Under India's Digital Personal Data Protection Act, 2023 (with the rules still being operationalised through 2025-2026), your obligations on personal data apply regardless of which stack you use. The mistake we see is firms assuming self-hosting makes compliance easier. It does not — the technical and organisational measures are the same, and self-hosting shifts more of the burden onto your own team. Where it genuinely helps is if a specific client contract requires data residency and you have not negotiated a cloud tier that supports it. In most SME cases, hosted Microsoft or Google services already offer India regions and are easier to audit than a Samba server in a server cabinet. If you want a read on your own compliance position, talk to us rather than assume.

CERT-In and the security baseline

The April 2022 CERT-In directions (retention of logs for 180 days, incident reporting within six hours) apply whichever stack you run. The practical difference:

• Licensed software typically produces logs in formats that CERT-In auditors are used to seeing. Microsoft and most commercial vendors have templates.
• Open-source tools produce more and better logs, but you have to build the pipeline. Zabbix into a log store into a retention policy is a project, not a checkbox.

Neither is more secure. But if you are being audited — and more SMEs are now, because of client cascades — the licensed stack usually gets you to the audit trail faster. Budget for that.

What we actually recommend

There is no single answer. There is a shape of answer that fits most Indian SMEs with 20-500 staff, and it looks like this.

We do not sell software. We sell deployment, integration and support for whichever stack the client chooses. That means we lose when clients choose open source and gain when they choose licensed, or vice versa, depending entirely on which deployment shape fits them. It also means we have no interest in pretending one side always wins.

If you are at the point where you are weighing a renewal quote against a migration, our software services page lays out what an honest evaluation costs. The evaluation itself typically pays for itself in a single renewal cycle, if only by surfacing the dormant licences.

The questions we get asked most

Is open source really free?

No. The licence is free. The systems it runs on, the people who run it, the backup, the power, and the support are not. The right comparison is total cost of ownership, not licence cost. Our worked TCO above shows a 100-user firm converging to roughly the same five-year total on both stacks, which surprises people.

Can I mix licensed and open source in one office?

Yes, and almost every SME we work with does. Microsoft 365 for mail and productivity, Samba or Windows Server for files, Zabbix for monitoring, Wazuh or Defender for endpoints. The hybrid gives you the strengths of both without the ideological baggage. It is the default and the safest.

What about Windows on the desktop — can we move to Linux?

For most Indian SMEs, no, not in bulk. The blocker is not the desktop — Ubuntu 24.04 is fine for email and documents — it is the long tail: Tally, AutoCAD, the occasional MS Access database that the accounts team still uses, and the vendor-supplied tools for GST portal and bank reconciliation. If you want to test the water, do it with the 10% of users who genuinely only need a browser and a mail client. Anything wider is a project with a five-year horizon.

How do I justify the software budget to my CFO?

Show them a licence usage report on the existing stack first. In most SMEs we audit, 25-40% of licensed seats are dormant. Reclaiming them typically pays for the entire migration or evaluation project for the year. That is usually a more convincing message than any open-source argument.

Is open source less secure?

No. Heartbleed and Log4Shell were both open source. So were a dozen commercial security incidents the same year. Security depends on how fast you patch, how well you monitor, and whether the stack is understood by the team that runs it — not on the licence.

Will my auditor accept open-source tools for CERT-In compliance?

Yes, if the logs and retention are in place. The auditor does not care which software wrote the log. They care that it exists, is complete for 180 days, and is available on request. Open-source tools produce excellent logs — but you have to build the pipeline yourself, and that is where audits fail.

What to do this week

Open your software invoice folder and pull the last 12 months. Count the seats across your three biggest vendor contracts — productivity suite, endpoint security, and your primary business application. Then ask your IT provider or your internal team for a login-activity report for each. Any contract where fewer than 75% of paid seats have logged in during the last 30 days has a reclaimable saving worth between ₹30,000 and ₹2,40,000 a year at typical 2026 SME rates. Reclaim those first. Then, and only then, argue about open source, because the licences you are not using are a cheaper win than the licences you could replace.

If you want help running the reclaim and the TCO comparison together, our team does this for firms of 20-500 staff across Bangalore. The contact page is the quickest way in — bring the invoice PDFs and we will do the arithmetic with you.