Licensing mechanics, audit defence, cloud waste, SaaS sprawl and shadow AI. Written for the people who answer for them, and detailed enough to use in a renewal.
The pieces we would hand you first if you asked what is actually changing right now.
The Certero AI Assistant lets authorised users ask plain-English questions of live asset, software and licence data. It is off until an administrator enables it, and it can never return data the person asking is not already entitled to see.
Shadow AI moves faster than Shadow IT and carries a wider blast radius. What it is, why the old playbooks do not cover it, and the discovery standard you need before any policy can hold.
All 205 posts, covering hardware, licensing, subscriptions, cloud spend and the governance that has to sit over all of it. Search it, filter it or read straight down.
Topic
Year
The Certero AI Assistant lets authorised users ask plain-English questions of live asset, software and licence data. It is off until an administrator enables it, and it can never return data the person asking is not already entitled to see.
Most AI spend is not arriving as new invoices. It is arriving inside software you already own, priced per token, owned by nobody. Six commercialisation patterns, why per-seat governance cannot see them, and what to do instead.
Hybrid IT broke the ITAM tools built for the data centre. What unified discovery, software recognition and governance actually have to cover when your assets span on-premises, virtual, cloud and SaaS — and how to test a vendor against it.
What a SaaS management platform has to do in 2026, how the market divides, and the six criteria to score your shortlist against — including where Shadow AI detection now sits as a first-class requirement rather than a tag.
Shadow AI moves faster than Shadow IT and carries a wider blast radius. What it is, why the old playbooks do not cover it, and the discovery standard you need before any policy can hold.
Running ITAM, SAM, SaaS and cloud management as four separate tools creates a reconciliation tax. What a genuine all-in-one platform has to deliver, and how to test a vendor claim before you buy.
Security tools only protect what they can see. ITAM and SAM close the visibility gaps that leave legacy machines, unsupported software and mixed-platform hardware outside your defences.
Most breaches are not exotic. They start with an old machine, forgotten software or a misconfigured endpoint nobody owned. ITAM is the layer that finds them first.
IT asset management stopped being an audit chore some time ago. Here is what it now does for finance, security, procurement and the service desk — and what changes the moment the data becomes trustworthy.
Most AI use inside large organisations never reaches IT. Here is why it happens, what it actually risks, and how to get control of it without banning the tools your teams have already found useful.
FinOps was built for the cloud and stops at the data centre door. ITAM knows the assets and licences underneath. Neither is complete alone — and hybrid cost control needs both working from the same data.
Microsoft's research found 71% of UK employees using unapproved AI tools at work — and most of them untroubled by the risk. Without visibility of what is running, GDPR compliance becomes impossible to evidence.
Cloud and SaaS dominate the budget conversation, but every workload still lands on a physical machine. When hardware visibility drifts, security, finance and IT all start working from numbers nobody trusts.
Locking an application down at user level does not make you compliant with a per-device licence. In a Citrix or RDS environment, one user with access can cost you a licence for every device in the organisation.
A third-party summary of a vendor can be wrong, and it stays wrong for as long as people read it. The case for checking a vendor's facts at source — and the current, sourced record for Certero.
An audit is won or lost on the quality of your inventory long before the letter arrives. Six ways data goes wrong, and what it takes to have the answer already in hand.
A business continuity checklist for ITAM and SAM leaders — licensing when staff work from personal devices, temporary rights changes that are never reversed, unsanctioned software, and keeping sight of machines that no longer touch the corporate network.
An Oracle Unlimited Licence Agreement is only unlimited within its clauses. What certification actually asks of you, where toxic consumption creeps in, and why the measurement work has to start at the beginning of the term rather than the last six months.
Functionality gets a tool onto your shortlist. Architecture decides what it costs you afterwards — in onboarding time, in time to value, and in what happens the day you want to add a discipline you did not buy.
Before optimisation, rationalisation or audit defence, most organisations need something less glamorous: a trustworthy answer to what they actually own. Why the foundational phase deserves its own name — and what counts as "stuff" now that most of it never touches your network.
SaaS moved software buying out of IT and turned the software asset manager from a compliance auditor into an active manager of subscriptions, usage and access. What that shift demands, and what it now takes to keep up with it.
SaaS removes the under-licensing risk, not the discipline. The question stops being "am I compliant?" and becomes "am I using what I pay for, and does the leaver still have access?"
Remote and hybrid working scattered devices, licences and cloud instances well beyond the corporate network. A walk through the four problems that creates — visibility, security, licensing and cloud cost — and what it takes to close each one.
Two of the things that most reliably sink an audit defence — an entitlement record you cannot reconstruct, and the assumption that moving to the cloud removed the problem.
Four ways to structure a software asset management programme — buy and run it, buy and wrap a service around it, outsource onto someone else’s technology, or outsource onto the provider’s own. What each one actually costs you in time, skills and accountability.
Public sector IT budgets rarely stretch to everything on the list. Three places to find the money you already have — cost reallocation, getting more out of ageing assets, and an optimised licence position.
Virtualisation changed how software is licensed, not just how it is deployed. Add usage-based metrics and indirect access, and the gap between what you run and what you owe gets very expensive.
A 2020-cycle read on CIO priorities — talent, devolved decision-making, culture, data, automation and new technology — and what each one meant for ITAM and SAM teams. Revisited with what the tooling can actually do now.
Six Microsoft Product Terms changes that took effect on 1 September 2025 — Copilot Chat entering the Core Online Services list, Visual Studio moving under the MCA, Windows 10 ESU through CSP, and more. What each one changes, and what to do about it.
Microsoft removes Enterprise Agreement discounting on Online Services, SPLA use ends on the hyperscalers, SAP withdraws special discounts on-premises, Broadcom faces a lawsuit from Tesco, and Oracle Java keeps pushing customers towards OpenJDK. What changed in August 2025, and what it means for your licence position.
Ten books and reports for ITAM leaders who want to think beyond the asset register — covering digital transformation, cloud economics, decision-making and the leadership skills the job actually demands.
Eight shifts reshaping ITAM through 2025 — from the gap between MDM and true lifecycle management, to multi-cloud visibility, compliance automation, security convergence and workflow orchestration. What each one means, and what to do about it.
Manual IT operations do not scale. A practical look at where automation pays back first — incident response, patching, provisioning and backup — and how to adopt it without creating isolated pockets of scripting.
IT asset management has moved past inventory and compliance checklists. What CIOs should expect from an ITAM programme now: live data, hybrid coverage, automation, compliance integration and lifecycle sustainability.
Microsoft's August 2025 Product Terms changes: Extended Term standardised across programmes, Exchange and Skype for Business Server Subscription Editions, the Exchange and Windows 10 ESU programmes, and the Dynamics 365 F&O enforcement dates.
Shadow IT is not a discipline problem, it is a friction problem. What unapproved tools actually cost in wasted spend, security exposure and compliance risk — and the five steps that bring them back under governance without slowing teams down.
Unused licences, duplicated tools and unmanaged SaaS quietly consume a large share of the software budget. Here is where the waste hides, and the named capabilities in CerteroX that find it and act on it.
Healthcare IT teams routinely run without an asset inventory, a compliance position or an owner for either. This is what it takes to go from no visibility to a single record of truth — and what published NHS and healthcare customers report.
The licensing and vendor news that mattered in August 2025: Microsoft product terms and price rises, Oracle Java soft audits, the Adobe subscription case, VMware versus Siemens, and the EU Digital Networks Act.
Five numbers on SaaS waste — unused licences, portfolio sprawl, dollars burned, AI spend growth and cloud waste — and why visibility alone never fixes any of them.
A practical evaluation guide for IT Asset Management platforms — what to test, what to ask vendors, and how to tell unified asset intelligence from a stitched-together toolset.
What actually happens in a vendor software audit — notification, kick-off, data collection, findings, response and resolution — and the preparation that decides how much it costs you.
Cloud waste is systematic, predictable and preventable. What actually causes it, what it costs the business, and the six-step discipline that brings it back under control.
The ten compliance failures that show up again and again in mature IT functions — manual tracking, hybrid blind spots, misread licence terms, unmanaged SaaS — and the controls that close each one.
SaaS visibility stopped being a procurement problem some time ago. It is now the control that finance and security both depend on — and neither can enforce a policy against an application they cannot see.
Audit frequency went up, not down, as software moved to subscription. Meanwhile a fixed share of cloud spend is wasted every month. Both are real, and only one of them is a certainty.
Hybrid is the prevailing IT model, and the hardest thing about it is not architecture — it is knowing what you have. Without one view across on-premises, private and public cloud, every workload decision is a guess.
SAM is usually sold as audit insurance. It is also a security control, a cost-reduction programme, due diligence for an acquisition, and the only reliable basis for rationalising your applications.
Cloud sprawl, decentralised buying and relentless audit pressure are pushing older ITAM setups past the point they were designed for. Here is where they crack first, and the four moves that keep you ahead of it.
The average enterprise now runs 305 SaaS applications and leaves 46% of its licences unused. Here is where the money actually goes, why the risk is not only financial, and the six controls that stop the bleed.
The licensing changes that mattered in June and July 2025 — Microsoft Product Terms, the return of the SAMOSA Act, the end of the Microsoft 365 nonprofit grant, Adobe's AI credit cuts, a Dutch ruling against Broadcom, and rising Oracle Java audit activity.
FinOps began as a reaction to engineers being able to spend money faster than finance could see it. Here is how it got from there to a formal discipline that now covers SaaS, licensing and AI as well as cloud.
CerteroX was announced in San Diego as one platform bringing cloud cost management and SaaS optimisation together. Here is what was said at the show, and what the platform actually ships today.
A clean discovery report is not the same as a complete one. What separates real asset discovery from device administration, and the four checks that tell you whether your current tooling is missing things.
Renew, rescope or exit — an Oracle ULA gives you three routes and a narrow window to choose between them. The questions to settle first, and a six-point health check to see how ready you actually are.
Windows 10 support ended in October 2025. If you are still finishing the migration — or paying for Extended Security Updates while you do — these are the questions to settle and a readiness check to score yourself against.
Java 17 was free under the No-Fee Terms and Conditions only up to Update 12. From 17.0.13 it moved to the Oracle Technology Network licence — and any production use pulls you into a subscription priced on your whole workforce.
Audits rarely arrive at random. Ten patterns that reliably attract a vendor's attention — from a drop in support spend to a reseller who thinks there is a deal in it — and what to have in place before any of them apply to you.
Certification is a contractual declaration made under a 30-day clock, and Oracle will question it. What the post-ULA position actually looks like, and how to build an exit you can evidence rather than one you hope holds.
Since January 2023 Oracle has sold Java SE on an employee metric, so the licensable unit is your whole workforce rather than the machines that run it. How to find every JDK, JRE and bundled runtime, pin the version and update level, and put a defensible number against it.
Three different Oracle Java licences apply depending on which version you installed and when. What each one permits, when a no-fee licence stops being no-fee, and how to work out which of your JVMs are actually chargeable.
Shadow SaaS is what happens when buying software stops needing IT. What it costs you in security, compliance and spend — and the three converging discovery signals that now find it, including the AI tools nobody declared.
A six-step plan for building a SAM programme that covers on-premises, SaaS and cloud as one problem rather than two — scope, maturity, people and technology, accountability, and what to do first.
A ULA gives you unlimited volume of a named set of Oracle products for a fixed term. What that actually covers, why the certification at the end behaves like an audit, and the decisions you should make on day one rather than in month thirty.
The software asset manager owns the compliance position, but the value of the role is wider than that: risk prioritisation, procurement intelligence, tooling and the answers nobody else in the business can give.
An audit notification rarely lands with the people who can answer it. A software audit task force brings the right stakeholders together, defines who is accountable for what, and gives the response a single voice.
Ten questions organisations ask when a publisher audit lands — on the right to audit, delaying it, limiting scope, dictating tools, challenging findings and negotiating the settlement — with the honest answer to each.
Buying a licence does not make you the owner of the software. It grants you a right to use it under conditions — and those conditions are where both your compliance risk and your unclaimed value are hiding.
The OTN licence is the free Java grant that still governs most of the Java actually running in enterprises. What it permits, where it stops being free, how it differs from the BCL before it and the NFTC after it.
A CMDB is a database. ITAM is a business process. Confusing the two leaves you with a configuration record that is neither complete enough to trust nor detailed enough to license from — and five practical ways to fix it.
In January 2023 Oracle replaced the Java SE Subscription with the Java SE Universal Subscription, and amended the wording again in March. The metric moved from hosts to employees. Here is what changed, who it hits, and what the upgrade cycle has done since.
The NFTC covers Oracle JDK 17 and later and permits free use — including commercial and production use. It also expires on a schedule. The conditions that invalidate it, and the upgrade cadence that keeps it valid.
Oracle enables every database option by default when you install or clone an image. Chopt is how you find out and turn them off — and why it is a change-control step, not a licensing position.
Microsoft lifted the block on assigning two Exchange Online licences to the same user. The error goes away, the mailbox keeps the best plan — and every licence assigned is still billed.
What an audit actually is, how it differs from a SAM review, what triggers one, and what you can do about it once the letter has arrived — including whether a completed audit can still be challenged.
SAM is usually justified as audit insurance. It is also cost reduction, a security control, acquisition due diligence, a stronger negotiating position, and the only reliable basis for rationalising applications.
Five places Microsoft spend leaks — Microsoft 365 subscriptions, Windows Server Datacenter cores, Azure Hybrid Benefit, SQL Server editions and over-estimated Enterprise Agreements — and what it takes to close each one.
Microsoft's Outsourcing Software Management clause turns on one definition — the Authorised Outsourcer — and one condition almost everyone gets caught by. Here is what the three sections actually say.
Not every ITAM or SAM platform survives the move to the cloud intact. The questions worth asking a vendor before you accept a hosted option — on functionality, tenancy, upgrade control, integration and security.
How to tell whether an ITAM or SAM vendor can actually do what they say — security credentials, the one publisher verification that genuinely exists, independent customer evidence, and testing the outputs yourself.
Oracle asks to see your Java deployments before it will sell you more subscriptions. Why Java is the hardest thing in your environment to count, what the employee-based subscription changed, and how to build a deployment record you can actually defend.
EBS 12.1 dropped to Sustaining Support in January 2022. A migration is the one moment you are allowed to ask what you actually own — and E-Business Suite responsibilities are where the recoverable licences hide.
Four things that stall a transformation programme — organisational resistance, data silos, legacy infrastructure and the skills gap — and what each one actually requires of your IT asset data before you can move past it.
Software audits are usually discussed as a financial risk. The people who have to answer them carry a different cost. Certero consultants on what an audit letter does to a team, and what has to be true before it arrives for that not to happen.
Cutting the ITAM and SAM budget looks like a saving and usually is not. How to tell whether the tooling you already run is producing evidence of value — and what a platform has to cover to be credible now that SaaS, cloud and AI are on the bill.
How to assess SAM maturity honestly, and what to do about the gaps once you can see them — whether that means switching on more of the platform, bringing in publisher expertise, or building the in-house team through skills transfer.
Moving to cloud changes the shape of the attack surface, not just its location. Why third-party sprawl and rushed adoption create the exposure — and what complete visibility across devices, software, SaaS and cloud actually has to include.
Digital transformation is a philosophy with business intelligence at its heart, not a project with a completion date. Why it has no endpoint, what has to be true of your data before you can start, and what happens to organisations that decline.
Certero’s vendor licensing specialists on where the line sits between what a SAM platform computes and what only a human can decide — contract clauses, restricted-use rights, divestments and audit tactics.
An Oracle licensing consultant on why she stopped trusting the layer between raw script output and a licence position — and what changed when the rules were driven by licensing experts and the raw data stayed visible.
A publisher’s audit report is a submission, not a verdict. What an independent audit defence actually does, the questions that separate a SAM partner from a reseller, and why an audit report is still worth challenging after it lands.
Six myths about Oracle LMS-verified tooling, answered — what verification does and does not mean, what happens to your data, how false positives are handled, and why script output and platform data are complementary rather than rival.
More than forty seasoned software asset management professionals were asked for one piece of advice for someone starting out in a SAM role. Their answers fell into four categories, and none of them was "buy a tool".
Five predictions made at the start of 2020: a wave of rip-and-replace in SAM tooling, a wider audience for inventory data, cloud growing without going first, targeted audit activity, and organisations finally dismantling the Frankenstack.
Due diligence covers the balance sheet and rarely covers the licence position — which is exactly why publishers watch acquisitions closely. What both sides need to know before the deal closes, and what to do when neither has a SAM programme.
Discovery and inventory are not the same thing, and most tools that claim the first are only good at the second. Six criteria for choosing between them, and why "good enough" coverage stops being good enough the moment anyone outside SAM uses your data.
IBM licensing runs on hundreds of metrics, but three of them decide most of your position. What Processor Value Units, Resource Value Units and the user-based family actually measure, and what has to be true of your inventory before any of it reconciles.
End of support is not really a patching problem, it is an inventory problem. Written ahead of the January 2020 cut-off, the argument holds for every deadline since: you cannot remediate the machines your asset register has never seen.
ILMT is effectively mandatory if you take IBM sub-capacity licensing, but running it is not the same as being compliant. Where its automatic bundling stops, why its reports can overstate your usage, and what has to sit alongside it.
Application Specific Full Use licences are Oracle software sold through a partner and locked to that partner's application. What qualifies, who carries the support obligation, who carries the compliance risk, and why ASFU customers can face two different audit routes.
Anyone But IT is how software is sold now. That does not make SAM obsolete — it changes the job from gatekeeping to guidance, and it makes discovery the part you cannot skip.
The data centre is where licensing gets expensive and where generic tools stop being useful. Six practical rules for managing Oracle, IBM, SAP and Microsoft licensing before an audit notice arrives.
A five-minute grounding in how Oracle licenses its technology and application products, what the OMA and Ordering Document actually grant you, and what an audit or a licence review involves.
Senior stakeholders decide whether to fund your ITAM and SAM programme. Treat them like investors: work out what each group actually needs, then show the data you can already give them.
An Effective Licence Position is the reconciliation of what you have deployed against what you are entitled to use. It is easy to describe and genuinely hard to build. Here is what goes into one, and why an annual snapshot is no longer good enough.
Agent-based mobile device management sees more and annoys users. Agent-less sees less and stays out of the way. The trade-off is real — but the more useful question in 2026 is why mobile is being managed in a separate tool at all.
From 1 November 2019, Software Assurance on SQL Server started covering three additional instances rather than one — including a disaster recovery instance in Azure. It is worth money, but only if you can prove which SQL versions and editions you actually run.
Multiple inventory tools, an aggregation service, a bolt-on recognition database, a disconnected licence application and a third-party reporting layer. Stitched together, animated by a large surge of integration effort, and not quite all there. Six reasons a Frankenstack fails.
From 1 October 2019, Windows licences bought without Software Assurance and Licence Mobility could no longer be deployed on dedicated hosted services from Microsoft's Listed Providers. Who it hit, which products it covered, and why the rule still matters.
An Enterprise Agreement is a trust-based contract, and the true-up is where the trust gets tested. What has to be counted, what Microsoft expects you to inventory, and why the work starts 120 days before the anniversary rather than 30.
An orientation in Oracle licensing: what development, test and production environments each require, how support agreements change your rights, and the difference between Processor, Named User Plus and the legacy metrics you may still be carrying.
Notes from a series of round tables with senior SAM stakeholders at SAMS Europe. Two things stopped SAM contributing to transformation programmes: relationships with people outside the function, and tools built for yesterday's scope.
The difference between a genuine SAM platform and a rebranded collection of tools, and the eight criteria worth testing before you sign anything.
Why fragmented hardware and software tracking derails a cloud migration, and what has to be true of your asset data before you start retiring things.
Most cloud-delivered asset management tools cover software and quietly drop the hardware and cloud data underneath it. Four places that gap costs you money.
Why data centre asset management tools built by acquisition leave you doing the work by hand, and what to demand instead for IBM, SAP and Oracle.
Legacy ITAM and SAM tools slow change programmes down by demanding manual work at every step. Here is what automating discovery, licensing and cloud cost control actually removes — and what CerteroX automates today.
Mobile device management works properly when phones and tablets sit in the same inventory as everything else you own. Here is what CerteroX ITAM does with enrolled iOS and Android devices, and why the single record matters.
Asset management either accelerates a change programme or quietly holds it up. The difference is whether your data is accurate on demand — and what your tools make you do by hand to get it.
A working introduction to the hardware life cycle — plan, acquire, commission, maintain, retire — and what an ITAM platform has to do at each stage to be worth having.
When Microsoft patched a wormable Remote Desktop flaw serious enough to warrant emergency updates for Windows XP, the hard part was not the patch. It was working out which machines you owned that needed it. That is a hardware asset management problem, and it has not gone away.
Salesforce instances grow wild — leavers keep their seats, admins install AppExchange packages nobody reviews, and the renewal arrives larger than anyone forecast. Where the waste actually accumulates, and the controls that stop it recurring.
Fragmented functionality, lengthy implementations and datasets that have to be stitched together by hand. Why the architecture of a legacy ITAM or SAM tool becomes your problem, and what a single data model changes.
The 2019 change that ended free public updates for commercial use of Java SE 8, what happened in the years that followed, and how to build a Java deployment record that survives contact with an auditor.
Software asset management needs both technology and skilled people, but the industry has polarised into tools that over-promise and services that bill by the day. A look at why customers keep going round in circles, and what actually breaks the cycle.
A practical checklist for judging whether your software asset management platform and provider are earning their keep — and a realistic look at what you can actually do about it when the answer is no.
What an Oracle licence review actually is, how the audit process runs from the notification letter onwards, and what to have in place before it arrives.
Why a CMDB populated only from your service management tool will always be incomplete, and what changes when asset and licensing data feeds it directly.
Providers compete on the size of their normalisation database. Size is the wrong measure. What decides whether recognition is any good is how each entry got there.
SAM is usually justified on licence cost and audit exposure. The security case is stronger and less often made: you cannot secure software you cannot see, name or date.
Most organisations run several asset management tools because they were bought one problem at a time. The cost is not the licences — it is that no two of them agree.
An advanced SAM programme needs technology and process. If you are buying the process from someone else, these are the ten things worth checking before you sign.
The MPSA is an evergreen, transactional agreement built around purchasing accounts and pooled points. Here is how the structure works, where it beats an Enterprise Agreement, and what you need in place before you sign anything.
Macs and iPhones arrived in the workplace one department at a time, and most management tooling still treats them as an exception. They should be inventoried, metered and licensed on exactly the same terms as everything else you own.
Most SAM programmes are built on Active Directory and an agent deployment, which means they are built on a list that is already wrong. Discovery is not a preliminary step to software asset management — it is the foundation the rest of it stands on.
A corporate app store gives users the frictionless experience they already expect and gives IT the control it keeps losing. It reduces shadow IT, improves licence compliance, tightens security and cuts service desk load — but only if it also covers the SaaS people reach through a browser.
Reclaiming hardware and licences that nobody is using is the cheapest saving available to an IT team. What it takes is metering you can trust, a policy people will accept, and an inventory that actually finds everything.
A companion to our piece on why a single platform matters. This one looks at how CerteroX is actually built — one data model, five products, and the design decision underneath both.
Asset management got harder one asset class at a time, and most organisations answered each one with a separate tool. The result is a stack of disconnected systems and no single view. Here is why that architecture is the problem, not the symptom.
Agent-based discovery and agentless discovery each fail in places the other covers. The useful question is not which one to buy, but whether your tool can run both against one data model.
The 2016 Mirai botnet took websites offline using unsecured CCTV cameras. The lesson for IT asset management has not changed: you cannot secure a device you have never discovered.
Acquisition is the first step in software asset management, which makes it the one where mistakes compound. Buying outside the agreement, buying through the wrong reseller, and deploying the wrong version to the wrong device all start here.
In 2016 the UK & Ireland SAP User Group asked SAP to define what indirect usage actually means once machines start talking to the ERP. SAP answered in 2018, and the answer changed the maths.
Microsoft bundled Office 365, Windows 10 Enterprise and Enterprise Mobility + Security into a single SKU in late 2016. The bundle has been renamed twice since, and the licensing problem it created has not changed at all.
The technical half of the Oracle compliance problem: proving actual usage, indirect access through non-Oracle applications, the hard and soft partitioning rules that turn a virtualisation saving into an audit finding, and assembling the Oracle Server Worksheet.
Software asset management began as an audit response, became a compliance discipline, then a cost discipline. The data it produces is now the thing that matters most — and the asset classes it has to cover have grown to include SaaS, cloud and AI.
Why Oracle licensing goes wrong before anyone touches a server: tailored agreements that drift, the difference between a processor and a core, obsolete licence metrics still in use, duplicate named users, and options that are enabled by default whether you bought them or not.
Most organisations start SAM as audit insurance. The cost case is the stronger one: less overspend on software and hardware, cheaper support through rationalisation, in-house expertise built deliberately, and a negotiating position based on your own numbers.
Indirect access is where a licence bill arrives for users you never counted, because they reached the system through something else. What multiplexing looks like, how each publisher treats it differently, and how to identify it before a true-up does.
A raw discovery list is not an inventory. Why inconsistent titles, editions and publishers make software data unusable for licensing decisions, and what normalisation has to do before the data is worth acting on.
Discovery tells you what exists. Control is a process problem, and it breaks at the two ends of the lifecycle — how assets get authorised, and what happens when a person leaves. What to automate at each end.
If you cannot measure what you have, you cannot manage it — and you certainly cannot defend it. The four things that most often break IT asset identification: tool sprawl, incomplete discovery, missing attributes, and entitlement nobody can produce.
Compliance tells you whether you are safe. Optimisation tells you whether you are wasting money. They are different questions, and only one of them is answered by buying more licences.
Software is an asset with unusual properties — it can be acquired by anyone in seconds, it leaves no physical trace, and the paperwork proving you are entitled to it is easy to lose. Each of those is a distinct commercial risk.
SCCM is good at what it was built for and was never built for software asset management. You do not have to throw it away to close the gap — but you do have to know precisely where the gap is.
When a major publisher stops auditing, the compliance risk falls and the commercial risk does not. Ten years on, that turns out to have been the more expensive of the two.
SAP's own LAW and USMM reports were built to help SAP settle a true-up, not to help you optimise. What an Effective Licence Position actually requires, and the four things LAW will never tell you.
SCCM can tell you a file exists on a disk. It cannot tell you whether the application was installed, whether it belongs to a suite, or which edition you are running — and every one of those decides what you owe.
Your SAP system already holds most of the data an Effective Licence Position needs. The difficulty is extraction, normalisation and two specific traps — duplicate accounts across systems, and users who never log in but still consume a licence.
SAP does not licence by installs, servers or CPUs. It licences named users by access rights — and the licence you assign does not restrict what the user can do. That single asymmetry is where SAP overspend comes from.
Desktop and laptop energy is one of the few IT savings you can measure before and after with real numbers. The hard part is not the technology — it is the business case, the IT buy-in and the policy design.
Asia Pacific has the highest rate of unlicensed software use in the world, and the BSA has been settling cases in Australia and paying rewards to the employees who report them. What that means for anyone without a defensible licence position.
Tool-agnostic consultancy sounds like independence. In practice it often means abandoning the platform you already paid for and rebuilding your licence position by hand in a spreadsheet — which is out of date the day it is signed off.
Compliance tells you whether you are safe. Optimisation tells you what you are wasting. The six steps that turn a licence position into recovered budget — and what changes now that a large share of the spend is SaaS.
Shadow IT is a signal before it is a threat — people route around IT when provisioning is too slow. Self-service removes the reason it happens. Discovery tells you where it already has.
A software asset management plan is four decisions, not a document: what you actually need, what you standardise on, where the entitlement evidence lives, and how software and hardware are mapped to each other.
Software is now one of the largest and least controlled lines in the budget. Software asset management is the discipline that makes it forecastable — and it reduces risk at the same time.
Matching licences to installed software sounds simple and is not. Three activities decide whether it works: normalising the inventory, understanding how the software is actually used, and applying entitlement to the result.
An English High Court ruling on a licence audit clause set out how precisely audit rights have to be drafted to be relied on. The checklist it produced is worth running against your own publisher agreements before the next audit letter arrives.
You cannot start Software Asset Management everywhere at once. Five criteria — risk, spend, volume, strategy and transition — for deciding which publishers to tackle first, and what has changed about that decision since SaaS and AI joined the list.
Knowing what you bought and what you installed is only half a licence position. Why measured usage is the half that saves money — and how the two problems that made it hard, virtualisation and cloud applications, are handled today.
A SAM maturity assessment gives you a point-in-time benchmark and a plan to improve on it. What the four maturity levels mean, what a proper assessment covers, and why the scope of that assessment now has to reach SaaS, cloud and AI.
A geo-fence turns a location into a control. Here is what geo-fencing actually does to a mobile device that leaves its assigned site, what it does not do, and how to set the boundaries so the alerts mean something.
Virtualisation saves money until Oracle disagrees about what you have licensed. The distinction between hard and soft partitioning is where that argument is won or lost, and it turns on data most organisations do not collect.
The inventory you build to survive an audit is the same inventory your security team has been asking for. Unsupported versions, unpatched installs, unauthorised software and forgotten access are licensing problems and security problems at the same time.
A self-service catalogue with approval built in gives users software faster, gives IT its afternoons back, and gives the organisation a record of who asked for what and why. The last of those is the one that pays.
An effective licence position keeps you compliant. It does not, on its own, make you cheaper. Optimisation is what turns compliance work into money back — and it runs on two things, use rights and usage data.
A bipartisan US bill made software licence management a statutory obligation for federal agencies, with automated discovery written into the text. The reasoning behind it applies well beyond government.
Publishing an application to a restricted user group in Citrix does nothing for a per-device licence. The control has to be enforced where the licence is measured — at the device — and you have to be able to prove it was.
Most organisations that believe they have full discovery are working from instinct rather than evidence. Complete coverage needs several independent methods that corroborate each other — and today "everything" includes SaaS, cloud and AI, which no network scan will ever find.
The original 2016 version of this post reported a customer survey we can no longer substantiate. What survives is the argument underneath it: idle computing is one of the few costs you can remove without anyone giving anything up — and you cannot schedule what you have not discovered.
SAP licenses on usage, then declines to define usage precisely. Named user types, package metrics measured on business volume, and the two things that have changed most since this was written — document-based Digital Access and the move to S/4HANA.
The five ways unlicensed Microsoft software gets into an organisation — hard disk loading, unauthorised downloads, standalone certificates, leaked volume keys and auction-site resale — updated for a world where almost none of it arrives on a disc.
Once the inventory is done, the work is stopping the same mess reassembling. Four policies worth writing — acquisition, use, intake and recovery — plus the two the original list predates: SaaS purchasing and leaver offboarding.
Counting installs is the easy part. Turning an inventory into a defensible licence position means normalising the data, understanding how the software is actually used, and applying the entitlement you hold against it.
The obstacles to a working software asset management programme fall into three groups — inventory, entitlement and the organisation itself. Two of them are now largely solvable with tooling. The third still is not.
A plain-English glossary of the terms you meet when you take on software licensing — the disciplines, the contract language, and the newer vocabulary that SaaS, cloud and AI have added to the list.
BYOD is usually argued for on cost, productivity and morale. All three hold up — but only if you can still see what the devices are doing, which is the part the policy rarely covers.
Enrolment, platform diversity and device security were the three things that made mobile management hard. Two of them have changed shape completely, and the third answer is no longer a separate product.
A baseline review is how you get to a defensible Effective Licence Position for one publisher. Here is what the five stages actually involve, and which of them you should never have to run again.
The desktop is the easy half. Data centre software licensing breaks on three things — publisher metrics, platform variety and virtualisation — and generic discovery tools fail on all three.
Moving from device-licensed Office to per-user Microsoft 365 subscriptions solves the version problem and creates a different one. Here is what changes commercially, what to negotiate before you sign, and what you have to measure afterwards.
Most organisations that buy mobile device management software never make it mandatory. The gap is almost never the tooling — it is the absence of a policy that applies to every department without exception.
Written in 2016, when IBM had just started replacing Windows PCs with Macs at scale and Android fragmentation was making broad mobile support expensive. The argument holds up better than the prediction.
Compliance, efficiency and agility is a better frame for a SAM business case than governance and risk. The hard part is costing the benefit — which is now something the tooling can do for you.
There is no silver bullet in asset discovery, but there is a short list of things a tool must do natively. Six attributes to test a discovery product against, and what each one looks like when it actually works.
An audit letter is not an emergency, it is a project. Five stages — governance, communication, inventory, entitlement and the effective licence position — and the order you do them in decides the outcome.
Windows Server 2016 moved Standard and Datacenter Edition from processors to physical cores, with two-core packs and per-server minimums. Ten years on, that model still governs how Microsoft server licensing is counted — and it is still counted wrong.
Jailbreaking and rooting are privilege escalation — they dismantle the security model the device was sold with. Here is what that actually exposes, and what detecting it depends on.
Six steps to standing up software asset management: maturity, business case, tooling, process, audit readiness and team. One of them has changed fundamentally since the framework was written.
Getting software to people quickly, keeping it secure and staying licensed are usually treated as three problems. Self-service deployment turns them into one process, with the approval, the entitlement check and the audit record all captured at the moment of request.
Virtualisation saves money on hardware and quietly changes what you owe on software. Small changes to a cluster — a host added, a VM allowed to move — can move a licence position by a large amount. Here are the questions to ask before you build, and what can now be tracked automatically.
A licence optimisation programme costs money. Doing nothing costs more, but the bill arrives as an audit settlement rather than a budget line, so it never gets compared. Four questions that turn the cost of inaction into a number a budget holder can act on.
Your right to use software comes from the agreement, not from the install. Upgrade, downgrade, virtualisation, secondary use, disaster recovery and multiple installations are the six scenarios that decide most licence positions — and the six that spreadsheets get wrong.
Every software product has a shelf life. Written when Certero rebuilt its products from the ground up rather than bolting old ones together — and updated to describe what that rebuild actually became.
That is everything, all 137 posts of it.
Nothing matches that.
Try a broader search, or drop one of the filters.
Posts about visibility, licensing and cost only matter if the platform behind them holds up. Bring the hardest claim on this page and put it to a technical person with the product open.
Nothing is gated, and reading a post does not put you on a scoring model or a call list.