Since January 2023 Oracle has sold Java SE on an employee metric, so the licensable unit is your whole workforce rather than the machines that run it. How to find every JDK, JRE and bundled runtime, pin the version and update level, and put a defensible number against it.
Concerned about Oracle Java licensing changes? Most organisations are, and most of them cannot answer the first question the change raises: what Java have we actually got, and where is it?
That is not incompetence. Java is unusually difficult to inventory. It arrives bundled inside other vendors’ products, gets installed by developers who then move teams, persists on desktops years after the application that needed it was retired, and shows up under half a dozen different folder names. Meanwhile the licensing rules moved underneath it — twice.
This guide covers what changed, how to find every installation, and how to put a credible number against what you find.
Two changes matter, and they compound.
January 2023: the employee metric. Oracle replaced the Java SE Subscription with the Java SE Universal Subscription and changed the metric from named user and processor to employee. The subscription is now sold against your total employee count, not the number of people or machines that use Java. Oracle defines “employee” broadly — full-time and part-time staff, plus contractors, consultants and outsourcers supporting internal operations.
The consequence is severe and asymmetric. One machine running one chargeable Java installation makes your entire workforce the licensable unit. Nothing about the size of your Java footprint moderates the number.
The No-Fee Terms and Conditions expiry. Oracle’s NFTC licence makes a Long-Term Release free to “support internal business operations”, but only while it is the current LTR and for twelve months after the next one arrives. For Java 17 that window closed in 2024: Updates 1 to 12 are covered, and 17.0.13, released 15 October 2024, moved to the Oracle Technology Network licence, which does not permit production use. We covered that transition in detail in Oracle Java 17 became chargeable in October 2024.
Put together: an accepted update prompt on one production machine can move you from no licence cost to a subscription priced on your whole headcount. That is why the inventory question is not administrative housekeeping.
You need four facts about every Java installation you own. Each one is harder than it sounds.
Physical hosts and desktops both, and every operating system you run — not just the Windows fleet. Java sits on Linux servers, on developer Macs, and on the AIX, HP-UX and Solaris systems that most discovery tools quietly skip.
The harder half is the Java you did not install. Runtimes ship bundled inside third-party applications, in installation directories that carry the vendor’s name rather than Oracle’s. A registry-based or add/remove-programs approach will not see them.
This is a software recognition problem rather than a scanning problem. CerteroX SAM recognises installed software against the Software Recognition Database — over 3.5 million normalised titles — so an Oracle runtime resolves to an Oracle runtime regardless of how it was packaged, what the folder is called, or which product dragged it in.
“We have Java 17” is not an answer to a licensing question. 17.0.12 and 17.0.13 sit on different licence agreements with entirely different consequences. Version and update-level recognition, normalised across publishers, is what converts an inventory list into a licence position.
The same applies across the older releases. Java 8 and 11 have their own histories of licence changes and public-update end dates, and organisations routinely have all of them running simultaneously without knowing it.
The riskiest event in Java licensing is not a deployment; it is an update. Oracle serves updates from its own infrastructure and retains records of what was downloaded. An update accepted by a user in good faith is enough to change the licence agreement that installation sits under.
So the useful view is not a static snapshot but a record over time: which machines changed update level, when, and whether that crossed a licensing boundary. Continuous inventory gives you that. An annual audit sweep does not.
This is the fact that saves money, and it is the one most inventories omit. AppsMonitor meters file-based usage with first-used and last-used tracking and a rolling 90-day utilisation figure. Java installations that nothing has invoked in three months are removal candidates — and removal is the cheapest form of compliance available to anyone.
In practice a meaningful share of an organisation’s Java footprint turns out to be dormant: left behind by decommissioned applications, or installed on desktops for something the user stopped doing years ago. You cannot make that argument without usage data, and you cannot remove software safely without it either.
Discovery tells you what you have. It does not tell you what to do. To make a decision you need each installation to carry a cost, so the options can be compared as numbers rather than opinions.
CerteroX ITAM supports manual and automatic costing rules against assets, so a recognised installation can carry an attributed cost and roll up by department, location or organisational unit through dynamic groups. That turns the Java question into the three comparisons that actually decide it:
Subscribe. The cost of an Oracle Java SE Universal Subscription is a function of your employee count, not your Java footprint. It is a single number and it is mostly outside your control — which is precisely why it needs to be set against the alternatives rather than accepted by default.
Migrate. Moving to a non-Oracle distribution of OpenJDK removes the licence requirement but carries migration effort, testing and a support decision. Costing this properly means knowing how many installations there are, how many applications depend on them, and which of those applications are still in use.
Remove. Every dormant installation you remove reduces both the migration effort and the compliance surface. This is usually the largest and cheapest win in the programme, and it is invisible without usage metering.
Most organisations end up doing all three, in different proportions across different parts of the environment. The proportions are what the data decides.
Whatever you decide, the record has to survive being questioned. Oracle Java has been one of the more active compliance areas since the metric changed, and the conversation opens with Oracle’s download records rather than your inventory.
Two things make that conversation shorter. The first is a continuous compliance position rather than a point-in-time reconciliation, so the position you would declare today is always available and always current. The second is the provenance of the data: Certero is a verified third-party tool vendor with Oracle License Management Services. In Certero’s own published wording, being a verified third-party toolset means that Oracle’s audit team can accept data from Certero during an official audit, as an alternative to installing Oracle License Management measurement tools.
That is a conditional, not a guarantee. It is still a much better place to start than a spreadsheet built under time pressure.
Start with discovery and be honest about the answer. Most organisations that run this exercise properly find between two and five times as many Java installations as they expected, spread across more operating systems and more update levels than anyone had assumed. That is the normal result, not a bad one — it is the first time the question has been asked with a tool capable of answering it.
From there the sequence is straightforward: remove what nothing uses, pin what has to stay on a covered update, migrate what can move, and subscribe for what is genuinely left. The order matters, because each step shrinks the one after it.
Book a demo and see what Java discovery returns — every installation, every update level, every edition — with a technical person on the call to answer for it.
Other posts covering the same ground.
Locking an application down at user level does not make you compliant with a per-device licence. In a Citrix or RDS environment, one user with access can cost you a licence for every device in the organisation.
A third-party summary of a vendor can be wrong, and it stays wrong for as long as people read it. The case for checking a vendor's facts at source — and the current, sourced record for Certero.
An audit is won or lost on the quality of your inventory long before the letter arrives. Six ways data goes wrong, and what it takes to have the answer already in hand.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.