shouldiuse.io

VERDICT

Should I use HashiCorp?

Not disclosed - hashicorp.com

Depends. Buy if you're a mid-to-large org with dedicated platform engineers and enterprise budget — Terraform and Vault are category leaders. Small teams, startups, and open-source purists should use OpenBao, Infisical, or managed cloud KMS instead.

Confidence

Medium. Based on 20+ public sources; exact enterprise pricing is opaque in evidence, so figures carry caveats.

Ratings

  • Value for money
  • Ease of useNo clear user evidence
  • Feature depth
  • Support qualityNo direct evidence
  • Security posture

Pricing

$0

Free / Community

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
EnterpriseContact sales

Best for

  • Platform teams running multi-cloud Terraform estates
  • Enterprises centralizing secrets management
  • Security teams needing identity-based access
  • Orgs with budget for dedicated infra engineers

Not for

  • Small teams with a handful of servers — serious overkill
  • Startups that can't absorb $100k+ tooling bills
  • Open-source purists burned by BSL licensing
  • Anyone wanting secrets storage without running Vault ops

Gotchas - check before you buy

high

Vault enterprise renewals report big price hikes; negotiate hard at renewal

medium

Per-client Vault pricing: costs scale sharply with workload growth

medium

BSL license limits some use; OpenBao fork is the escape path

medium

No transparent list pricing; contact-sales model and fixed concurrency tiers

Pros and cons

Pros

  • Category leader: #1 secrets management, #2 in IaC rankings
  • Open-source core with large community (Vault on GitHub)
  • Trusted at extreme scale — case studies up to 10,000 clouds
  • Now backed by IBM's enterprise support and reach

Cons

  • Vault enterprise reportedly ~$150k; contact-sales pricing
  • Customers report enterprise renewal price increases
  • License switch to BSL triggered OpenBao fork
  • Repeated Vault CVEs, including auth bypass and RCE
  • Post-IBM direction debated across community threads

Sources & method

Analyzed 9/20/2026 - 11 sources - Multiple Vault CVEs in 2025–26 including RCE and auth bypass; actively disclosed and patched via HCSEC advisories.

official x1review x5security x3news x2
  • CVE-2025-6000: Vault RCE vulnerability, Remote code execution flaw in HashiCorp Vault disclosed May 2026.
  • CVE-2026-5006: Vault auth bypass, Vault flaw allowed login without authentication.
  • Nine Vault logic flaws found via zero-day research, Researchers found undisclosed logic flaws in Vault authn/authz; worked with HashiCorp on disclosure.
  • HCSEC-2025-22: multiple Vault vulnerabilities, HashiCorp advisory covering multiple vulnerabilities in Vault and Vault Enterprise.

Key stats

  • Value for money: 2/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 2/5. Vault ~$150k cited; renewal hikes reported
  • Ease of use. No clear user evidence
  • Feature depth: 5/5. Ranks #1 secrets management, #2 IaC
  • Support quality. No direct evidence
  • Security posture: 2/5. Multiple Vault CVEs: auth bypass, RCE
  • 3.8/5 G2 rating 141 reviews (rfp.wiki)
  • 118 IBM Terraform G2 reviews formerly HashiCorp Terraform
  • Yes Free tier Vault Community; HCP Terraform free tier
  • $1.9B Valuation 2018 peak; acquired by IBM 2024

Pricing

Free / Community

$0

  • Vault Community, self-managed
  • HCP Terraform free tier
  • Per-client fees kick in as you scale

Enterprise

Not disclosed

  • Vault ~$150k cited (dated HN comment)
  • Terraform per-resource / fixed concurrency tiers
  • Renewal price increases reported

Security

Multiple Vault CVEs in 2025–26 including RCE and auth bypass; actively disclosed and patched via HCSEC advisories.

  • CVE-2025-6000: Vault RCE vulnerabilityRemote code execution flaw in HashiCorp Vault disclosed May 2026.⁷
  • CVE-2026-5006: Vault auth bypassVault flaw allowed login without authentication.⁸
  • Nine Vault logic flaws found via zero-day researchResearchers found undisclosed logic flaws in Vault authn/authz; worked with HashiCorp on disclosure.⁹
  • HCSEC-2025-22: multiple Vault vulnerabilitiesHashiCorp advisory covering multiple vulnerabilities in Vault and Vault Enterprise.

What users say

Reviews praise technical depth but frequently gripe about pricing, licensing changes, and post-IBM direction.

“Have you looked at what hashicorp charges for vault? It's like $150k...”
Hacker News
“Hashicorp lost its way”
Reddit, r/Terraform
“I am a fan of Hashicorp”
Reddit, r/devops

Companies that use it

  • US Dept of Defense
  • Canva
  • Basler Kantonalbank
  • Schlumberger
  • Anthem
Full analysis

Based on 20+ public sources; exact enterprise pricing is opaque in evidence, so figures carry caveats.

Powerful but pricey: Vault and Terraform are enterprise-grade; small teams will drown. Watch BSL licensing and renewal hikes.

Methodology

Based on 20+ public sources; exact enterprise pricing is opaque in evidence, so figures carry caveats.

Sources

  1. HashiCorp Products | G2 Seller Reviewsg2.com
    review
  2. HashiCorp vs HCLSoftware — Verdictrfp.wiki
    review
  3. IBM Terraform (formerly HashiCorp Terraform) Reviewsg2.com
    review
  4. HN: What HashiCorp charges for Vaultnews.ycombinator.com
    review
  5. Vault Enterprise renewal price increases — Redditreddit.com
    review
  6. HashiCorp Vault Pricing 2026: Free, Until the Per-Client Feeenvmanager.com
    official
  7. CVE-2025-6000: HashiCorp Vault RCEsentinelone.com
    security
  8. CVE-2026-5006: Vault Auth Bypasssentinelone.com
    security
  9. Cracking the Vault: zero-day flaws in HashiCorp Vaultcyata.ai
    security
  10. IBM to Acquire HashiCorpnewsroom.ibm.com
    news
  11. OpenBao — open-source Vault forkopenbao.org
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.