SAM is usually sold as audit insurance. It is also a security control, a cost-reduction programme, due diligence for an acquisition, and the only reliable basis for rationalising your applications.
Software asset management, or SAM, is the practice of managing your software licensing obligations while optimising the value and cost of what you have bought. The benefits are partly the obvious ones and partly not. Here are the five that matter most.
A core principle of any working SAM programme is that you can see your whole infrastructure.
The days of relying on guesswork, accepting blind spots and manually stitching together inventory from a handful of discovery tools are over. A modern ITAM and SAM platform gives you one centralised view of all your hardware and software, in one place.
That gets you a live, complete view of what is deployed. Enrich it with automated software recognition — the Software Recognition Database behind CerteroX SAM holds more than 3.5 million titles — and you learn what all that discovered software actually is, in terms of publisher, version, edition and licensable product. At that point you have an accurate, meaningful list you can work from, for SAM and for anything else that requires you to understand your software in detail.
One distinction is worth holding onto. Do not mistake ITAM discovery and inventory for mobile device management, such as Microsoft Intune. MDM requires devices to be enrolled, which means you already have to know about them. Asset discovery works the other way round: it actively tells you what is out there. CerteroX ITAM integrates with Intune and with SCCM, but it does not depend on either to find a machine — network discovery sweeps a class-C subnet in under five seconds over NetBIOS, SNMP and ICMP, and finds the devices before anyone has enrolled them.
Security tops this list because the exploit that hurts you is almost never the novel one. It is the known vulnerability in a version you did not realise was still running somewhere. When an advisory lands, the question is immediate and specific: which machines are running the affected version, in which edition, at which patch level? An organisation with complete software visibility answers that in minutes and targets the upgrade. An organisation without it starts by trying to work out what it owns — and reports back to the business with a caveat instead of an assurance.
CerteroX SAM’s Software Recognition Service carries release, end-of-support and extended-support dates alongside each title, so software that has aged out of support surfaces as a lifecycle position rather than as a surprise during an incident.
Businesses live under the periodic risk of being audited by one or more of their software vendors, usually when they least expect it. We have covered what goes wrong in Software Vendor Audits: what can go wrong?, and audit frequency has risen rather than fallen away with subscription models — the numbers are in Are Software Audits Still a Risk in 2025?.
Even top-tier unlimited or all-you-can-eat agreements do not fully protect you from being asked to prove you deployed what you were entitled to deploy. These are not chance occurrences. They are informed, well-calculated plays. Vendors of the scale of Microsoft, Oracle, IBM and SAP have a reasonable idea of what an audit will recover before they commission it — otherwise they would not carry the cost of bringing in external auditors. Audits are investments.
Protecting the business from that unplanned, unbudgeted expenditure and disruption is the first objective of a serious SAM programme. Understanding where compliance risk sits is the position from which you can actually act: make changes, correct under-licensing, and do it on your timetable rather than the vendor’s. With expert guidance, exposure can be eliminated in line with an optimal licensing strategy rather than an emergency purchase.
This is why the calculation matters more than the record. CerteroX SAM computes an effective licence position continuously — purchased, used, available, required, variance and exposure — with dedicated engines for Microsoft, Oracle, IBM, SAP, Adobe and Salesforce, because the hard part of Oracle is options and core factors, and the hard part of Microsoft is cores and cluster topology, not a count of installations.
Above all, SAM done properly means you are in control. You proceed with the year according to plan, and you do not bring the business into disrepute through a messy, well-publicised dispute with a software vendor.
Arguably this should be number one, since reducing cost is the point. Audits are as costly as they are disruptive — but SAM does not only protect you from the mistakes that become expensive when you are audited. It also stops you overspending in the first place.
The scale of that overspend is easiest to measure in SaaS, where the vendor meters usage for you. 46% of SaaS licences go entirely unused; the average organisation uses 54% of what it pays for. On-premises software is harder to measure, but the underlying behaviour is the same: software gets bought for a project, assigned to a person, and never revisited.
Application monitoring — software usage metering — is what turns that from an assumption into evidence. It measures how much software is actually used, and feeds the optimisation process of identifying what can safely be removed and reclaimed into a pool for redistribution to people who need it, reducing the need to buy more.
In CerteroX SAM this is the AppsMonitor file-based metering: first-used and last-used tracking per title, and a percentage-used utilisation figure over a rolling 90-day window, with Terminal Server and RDS remote usage tracked per device. In CerteroX SaaS Management the equivalent is unused-licence detection at 30 or more days of zero usage, with reclaim, reassign, downgrade and archive actions attached to the finding.
That reduces cost directly. It also tells the business what it genuinely requires, so the next procurement round starts from what you need rather than what you renewed last year.
During any MAD activity, all assets have to be verified, and software licences are assets. In a large organisation their total value can run to millions, and so can the risk if the entity being traded is not properly licensed. A change of ownership can affect existing licensing provisions, so the contracts with each vendor need to be properly understood before the transaction completes, not after.
A merger also introduces a step change in complexity, which is a reliable trigger for a vendor to request a formal audit. Due diligence therefore has to extend to software licence compliance. Tactical services from SAM specialists exist for exactly this: clarity quickly, and an understanding of the full legal and financial impact of transferring software assets.
You may need to ensure that assets held by specific legal entities come across correctly, or that shortfalls are corrected before ownership transfers. The last thing anyone wants is to buy a business and discover they have inherited a multi-million-pound licensing liability at the moment a vendor decides to audit.
We have seen organisations become dependent on a small, unlicensed piece of software. That means no guarantees and no clear understanding of how a critical part of the business will continue to function. The software may be end of life and out of support. It may fall behind the rest of the infrastructure when an upgrade is needed and none is available. The vendor may discover the usage and begin proceedings to stop it.
Whatever the specifics, a licence sets out the commitments of both vendor and customer. Understanding what you hold and what you use — including non-commercial tier two and tier three software — is a real part of protecting business continuity, not a bureaucratic one.
Beyond that, overlapping products increase the cost of supporting end users and the overhead of running and maintaining applications that could be rationalised down to fewer, cheaper or more strategic options. SAM gives you visibility of that overlap, along with the licensing terms, the lifecycle position, the cost and the actual usage, so the decision can be made on evidence.
Where the overlap is in SaaS, CerteroX SaaS Management ranks it directly: app rationalisation detects functional overlap between applications and orders the findings by recoverable saving, so the conversation starts with the duplicate that costs the most rather than the one somebody happened to notice.
Other posts covering the same ground.
What an audit actually is, how it differs from a SAM review, what triggers one, and what you can do about it once the letter has arrived — including whether a completed audit can still be challenged.
Oracle asks to see your Java deployments before it will sell you more subscriptions. Why Java is the hardest thing in your environment to count, what the employee-based subscription changed, and how to build a deployment record you can actually defend.
Microsoft bundled Office 365, Windows 10 Enterprise and Enterprise Mobility + Security into a single SKU in late 2016. The bundle has been renamed twice since, and the licensing problem it created has not changed at all.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.