Why teams are switching to Gardience.

Leaving Broadcom's Salt console before 2028, outgrowing free Salt, or tired of per-node pricing: keep your Salt and move to one flat-priced console.

The gap

Your fleet is mixed. Your supported tooling is not.

SUSE Multi-Linux Manager and Uyuni do the Linux estate well, and leave Windows out. So the Windows fleet ends up in a second tool, a spreadsheet, or nowhere, with no single view across both. In a regulated shop that still answers for every endpoint, that is an audit finding waiting to happen.

Salt already manages Windows and Linux together. The commercial console that put a supported UI on it moved from SaltStack to VMware to Broadcom, which now sells it by the CPU core and has scheduled its support to end in 2028. The open-source pieces work, but nobody is standing behind them with a release you can pin and a phone number you can call. Gardience is that supported console, for the whole fleet.

What you are living with now

  • Windows managed in one place, Linux in another
  • Agents set up by hand, machine by machine
  • No single patch view across both
  • Community tooling you patch yourself, and a Sunday CVE that is your problem

With Gardience

  • Windows and Linux in one console, on the Salt you already run
  • Whole inventories join with one playbook, no manual approvals
  • One patch and compliance view, with signed evidence for auditors
  • Tested, signed releases and a CVE-fix SLA, with a person to call
Why teams are switching now

The big vendors moved the goalposts. Gardience did not.

In the last two years the tools most Windows and Linux shops relied on were sold, deprecated, closed up, or breached. Every point below is from the vendor's own documentation or the U.S. government's exploited-vulnerability list.

Broadcom (VMware) Salt

An end date, and Salt 3008 breaks it.

Broadcom's commercial Salt console is supported only to October 2028, or sooner if your contract ends first. Upgrading your masters to Salt 3008 cuts them off from the console until a patched plugin is installed by hand on every master. It is sold per CPU core, with a 16-core minimum per processor.

Gardience: runs on Salt 3008 LTS today, keeps your states, pillars, keys, and agents, and costs one flat yearly price. Free migration assessment.
Microsoft WSUS

Deprecated. The replacement is a per-server cloud bill.

Microsoft deprecated Windows Server Update Services in September 2024: no new features. Its answer for servers is Azure Update Manager, which charges $5 per server per month for machines outside Azure and needs them connected to Azure.

Gardience: patches Windows Server 2016 to 2025 and Windows 10 and 11 from your own server, including machines with no internet at all (offline catalog scans), at one flat price for the whole fleet.
Perforce Puppet

The free packages went behind a license.

In 2025 Perforce moved Puppet's packages to a private repository; using them beyond 25 nodes needs a commercial license. The community forked the project to keep a public build.

Gardience: built on open-source Salt. Your agents are standard Salt agents and your states are plain Salt: if you ever leave, everything keeps running without us.
Ivanti Endpoint Manager

On the government's actively-exploited list. Again.

In March 2026 CISA added an Ivanti Endpoint Manager flaw to its Known Exploited Vulnerabilities catalog: attackers with network access could pull credentials from the core server without signing in. The tool that manages every endpoint is the one attackers want most.

Gardience: no anonymous path in, no admin who can bypass approvals, a tamper-evident audit log, and every release passes an automated attack suite before it is signed. Security details.
CISA KEV catalog, CVE-2026-1603, added 9 March 2026

Broadcom, VMware, Microsoft, Perforce, Puppet, and Ivanti are trademarks of their owners. Gardience is independent and not affiliated with any of them.

Leaving Broadcom's Salt console

Keep your Salt. Drop the per-core bill and the 2028 deadline.

The commercial Salt console has changed names four times: SaltStack Enterprise, vRealize Automation SaltStack Config, Aria Automation Config, Tanzu Salt, and now VCF Salt. Broadcom has set its support to end in October 2028, or sooner if your contract ends first. It is sold as a per-core subscription with a 16-core minimum per processor, and Broadcom documents that upgrading to open-source Salt 3008 disconnects its masters from the console until a patched plugin is installed by hand on each one. Gardience runs on the same open-source Salt underneath, so your fleet moves without a rewrite.

Same Salt underneath

Your states, pillars, minions, and keys carry over. Gardience runs on current open-source Salt, which is still actively released and supported through 2028.

Flat fee, not per core

One yearly price for the fleet, Windows and Linux. No core counts, no 16-core minimums, and you can run it in the cloud. See the math.

Migration, done with you

We inventory your jobs, schedules, and roles, map them to Gardience templates and RBAC, and cut over one node group at a time with both consoles running side by side. Migration is included in the first year.

On Tanzu Salt, Aria Automation Config, or SaltStack Config? We review your masters, states, and renewal date, and send a written plan with effort and cost. No charge, no commitment.

Sources: Broadcom KB 413088 (product transition and October 2028 end of support), VMware SaltStack program terms, May 2025 (per-core licensing), KB 448159 (Salt 3008 breaks the master plugin; manual patch), Salt support lifecycle. VMware, Tanzu, and Broadcom are trademarks of their owners. Gardience is independent and not affiliated with Broadcom.

Free Salt and Gardience

Salt runs your commands. Gardience runs your fleet.

Salt is free, fast, and proven, and Gardience keeps all of it: your states, your agents, and a direct Salt view, so nothing your Salt people know is lost. What Gardience adds is everything an operations team needs on top, including the people who will never learn Salt. Here is the same job done both ways.

The job
Salt on its own
With Gardience
Patch Tuesday on 500 Windows and Linux servers
Salt on its ownWrite update commands or states for each operating system, then read raw output machine by machine
GardiencePick the group and press Patch: pilot ring first, a second person approves, reboots wait until each machine is back, and a report shows anything still missing
Find the machines with a known security hole
Salt on its ownNothing built in; bring your own scanner
GardienceEvery machine checked against published vulnerabilities, the ones under active attack listed first, and one button to fix them where a fix exists
Prove compliance to an auditor
Salt on its ownNo reports; collect job output yourself
GardienceA scored STIG / CIS-aligned baseline for every machine, and a signed evidence pack in one click
Let the help desk restart a service
Salt on its ownGive them Salt command access, or write and maintain access rules by hand
GardienceA form that does that one task, only on the machines their role allows
Know who changed what, months later
Salt on its ownSalt's job history, which the master clears after a set time
GardienceA tamper-evident log of every action and every machine's result, under the person's name, forwarded to your SIEM
Sign in
Salt on its ownThe command line on the master, or salt-api with its sign-in set up by hand
GardienceSingle sign-on over SAML or OpenID Connect, Active Directory, one-time codes, and roles
A laptop is off the VPN during the change
Salt on its ownThat machine fails; you rerun the job later
GardienceThe work waits and runs the moment it reconnects
Someone new who does not know Salt
Salt on its ownLearn Salt's command syntax and state files first
GardienceButtons, forms, and runbooks, and your own AI assistant can answer questions about the fleet; any change it asks for waits for a person to approve
Install and keep it running
Salt on its ownSet up the master, salt-api, TLS, and keys yourself; fixes when the project ships them, and no one to call
GardienceOne hardened install, also fully offline; every release tested on Salt 3006, 3007, and 3008; security fixes on a deadline, and a person to call
Flat price, not per node

At 1,000 machines, Gardience costs 92% less than per-node licensing at list.

Ansible Automation Platform is priced per managed node, every year, and the bill grows with every machine you add. Gardience is one flat yearly price for the fleet.

250 machines, per year
AAP Premium: $57,750
$6,000
Gardience Starter
1,000 machines, per year
AAP Premium: $192,500
$15,000
Gardience Team. You save $177,500.
5,000 machines, per year
AAP Premium: $962,500
from $40,000
Gardience Government & enterprise

Per-node figures use Ansible Automation Platform Premium list pricing on AWS Marketplace ($19,250 per 100-node pack per year, seen October 2026; 250 machines means buying three packs, and 5,000 is fifty packs before any volume discount). Your quote may differ. See the full math.

Ready to try it? Free for 90 days on up to 25 machines, no credit card. Installs in 4 to 5 minutes.
Get in touch

Tell us about your fleet.

Two or three lines is enough. A person will reply and set up a short call to size it.