Four mature configuration-management engines, four different trade-offs. They differ on agents, Windows, speed at scale, and licensing as of 2026, and where Gardience fits: a supported console, compliance, and change-control layer on open-source Salt for mixed Windows and Linux fleets.
See it, get a plan with pricing, or try it on your own machines. Choose one:
Pick a time. We walk through a live Windows and Linux fleet, your questions first.
Pick a timeYour work email is all we need. Within one business day: a pilot plan for your fleet, answers to the security questions your team will ask, and pricing.
Free for 90 days on up to 25 machines, no credit card. Installs in 4 to 5 minutes on one Linux server.
Start free trialPublished list prices for 1,000 servers a year, seen October 2026: Red Hat Ansible Automation Platform Premium $192,500 (AWS Marketplace), Progress Chef Enterprise $189,000, SUSE Multi-Linux Manager $134,000 for Linux virtual machines only, and Gardience Team $15,000, flat, Windows and Linux included. See every price, with sources.
In plain numbers: at 1,000 servers, Ansible Automation Platform Premium lists at nearly 13 times the price of Gardience, and SUSE Multi-Linux Manager at nearly 9 times, for Linux alone. Against AAP that is $177,500 a year back in your budget, or $532,500 over three years. Both bill per node, every year, so the cost climbs with every server you add. Gardience is priced per fleet: adding servers inside your tier costs nothing.
| Gardience | Ansible Automation Platform | SUSE Multi-Linux Manager | Tanzu Salt | |
|---|---|---|---|---|
| Price, 1,000 servers a year | $15,000 flat, Windows and Linux | $192,500 (Premium, AWS Marketplace list) | $134,000 (Linux VMs only, SUSE store list) | No public price; sold within VMware Cloud Foundation |
| How it is priced | Per fleet; growth inside a tier is free, see every price with sources | Per node, every year, in 100-node packs | Per managed system or socket pair | Contract; support ends October 2028 |
| Speed at scale | Live connection to every server: 1,020 servers patched in 13 minutes in one approved run | Connects per run; large fleets go in parallel batches | Agent-based (Salt); scheduled actions | Agent-based (Salt) |
| Windows and Linux in one console | Yes | Yes (Windows over WinRM or SSH) | Linux only; Windows support was closed as "not planned" upstream | Yes |
| Patch and compliance reporting | Built in: pending updates, security baseline (STIG and CIS aligned) and drift for every machine, with evidence packs | Through playbooks and add-ons | Yes, for Linux | Yes |
| Vulnerabilities (CVEs) | Built in for Debian, Ubuntu, the Red Hat family, and Windows: every CVE with the machines it reaches and whether a fix is waiting; Fix a CVE installs only that CVE's updates on only the exposed machines, with approval; alerts for new CVEs; import a scanner's CSV export | Through Red Hat Lightspeed (formerly Insights) for connected RHEL systems: a CVE list and remediation playbooks | CVE Audit for its Linux clients, based on OVAL data since 5.2 | Tanzu Salt Vulnerability: its own assessment, or an imported Tenable, Rapid7, or Qualys scan, then remediation |
| Change control | Approvals with a two-person rule, change windows, locks, change-ticket checks (ServiceNow, Jira) | Workflow approvals | Action chains and scheduling | Role-based access |
| Audit trail | Tamper-evident hash-chained log, forwarded to your SIEM | Activity stream | Event history | Activity log |
| Runs existing Ansible playbooks | Yes, over the Salt connection, no WinRM or SSH keys needed | Yes | Yes, through an Ansible control node | No |
| Package repositories | Uses the update sources you already have: vendor repositories, an internal mirror, Red Hat Satellite, SUSE RMT, or Multi-Linux Manager, or WSUS. Keep them for content; Gardience runs everything else | A separate product, Red Hat Satellite | Built in: channels and content lifecycle | Uses your existing repositories |
| Air-gapped install | Yes: signed offline bundle, one command | Yes | Yes | Yes |
| Terraform | Provider for Terraform and OpenTofu: machines join and get their state on first boot (join rules), groups, saved states, and event rules as code, and machines leave the fleet on destroy | Official provider for running Automation Platform job templates and inventories from Terraform | No provider in the public registries; a community prototype was shown at openSUSE Conference 2025 | No provider documented |
| Event-driven automation | Built in, no YAML: restart stopped services, warn on full disks, configure new machines as they join; every firing audited | Event-Driven Ansible (rulebooks reacting to outside events, then running playbooks) | Salt reactors and beacons, configured by hand | Salt reactors and beacons |
| AI assistant | Built in and supported: plain English to a checked runbook, command, or state that a person approves and runs; answers questions about the fleet from live data (read-only, off until an admin turns it on); a daily briefing with suggested actions; an MCP server for your own agents; Claude, OpenAI, or any OpenAI-compatible model, including one you host inside an air-gapped network; no extra license or platform to buy | Lightspeed intelligent assistant, generally available on OpenShift with a model hosted on Red Hat AI; its MCP server in technology preview | An MCP server, in technology preview | No assistant documented |
Gardience is not a fifth engine. It is open-source Salt, hardened and tested release by release, with the console, compliance, and change control that enterprises need on top, and support behind it. It manages Windows and Linux in one place, it runs the Ansible playbooks you already have, so you do not have to rewrite them, and its built-in AI assistant turns plain English into the exact Salt work, which runs only when a person approves it. And it costs a fraction of the per-node platforms: $15,000 a year for 1,000 Windows and Linux servers, flat.
| Salt | Ansible | Puppet | Chef | |
|---|---|---|---|---|
| How it reaches machines | Agent (minion) on a persistent encrypted ZeroMQ connection; agentless mode via salt-ssh | Agentless, over SSH (Linux) and WinRM or SSH (Windows) | Agent that pulls its configuration on a schedule (every 30 minutes by default) | Agent that pulls its configuration on a schedule |
| Windows | Native Windows agent | Supported through WinRM or SSH | Native Windows agent | Native Windows agent |
| How you write it | YAML states with Jinja; Python for extensions | YAML playbooks | Puppet's own declarative language | Ruby-based recipes |
| Speed at scale | Event bus: a command reaches thousands of connected machines in seconds, results stream back live | Push per run; large fleets are split into parallel batches | Converges each machine on its next check-in | Converges each machine on its next check-in |
| Open source status (2026) | Apache 2.0, maintained by the Salt Project | ansible-core is GPLv3 | Since early 2025, new Puppet builds ship from a private repository; production use above 25 nodes needs a commercial license. The community fork is OpenVox | Source is Apache 2.0; Progress Chef's free tier is for personal, non-commercial use, business use needs a commercial license |
| Commercial edition | Broadcom Tanzu Salt (end of support October 2028), or Gardience | Red Hat Ansible Automation Platform, priced per node | Puppet Enterprise (Perforce) | Progress Chef |
Your AAP or Multi-Linux Manager bill is not a problem for your budget, or you have a large, healthy Puppet or Chef codebase and the licensing works for you. Switching engines is real work; do it for a reason.
Your Ansible Automation Platform or Multi-Linux Manager renewal is one of the biggest lines in your tools budget, and it grows every time the fleet does. Gardience runs the playbooks you already have, covers Windows and Linux for one flat price, and costs a fraction as much. Also if you run Salt (or Uyuni or Multi-Linux Manager) and need Windows covered too; you need patch and compliance evidence for auditors; or your Tanzu Salt support ends in 2028 and you want to keep your Salt states.
Facts as of October 2026, from each vendor's public documentation and announcements: Broadcom on Tanzu Salt support, Progress Chef licensing, The New Stack on Puppet and OpenVox, Uyuni Windows support issue, Red Hat on the Lightspeed assistant (generally available in 2.6), Red Hat on its MCP server (technology preview in 2.7), SUSE on its MCP server, Red Hat on its Terraform provider, openSUSE Conference 2025: Uyuni with Ansible and Terraform, Red Hat on Lightspeed vulnerability remediation, SUSE on CVE Audit, Broadcom on Tanzu Salt scan imports. Salt, Ansible, Puppet, Chef, SUSE, and Tanzu are trademarks of their respective owners. This comparison is independent, not endorsed by any of them, and features change: check each vendor before you decide. Spotted something out of date? Tell us and we will fix it.