You cannot start Software Asset Management everywhere at once. Five criteria — risk, spend, volume, strategy and transition — for deciding which publishers to tackle first, and what has changed about that decision since SaaS and AI joined the list.
When you first implement a Software Asset Management programme you will almost certainly need to prioritise which publisher to focus on. You cannot start everywhere. The organisation runs software from dozens of publishers, and the work of getting one of them properly under control is measured in months, not afternoons.
The average enterprise has software from Microsoft, SAP, IBM and Oracle at minimum, and each of those publishers has its own policies, its own licensing rules and its own tooling for demonstrating compliance. Oracle’s core factors and options-and-packs problem looks nothing like IBM’s sub-capacity reporting problem, which looks nothing like SAP’s named-user classification problem. There is no single technique that clears all of them, which is exactly why you have to choose an order.
A lot of people go with gut feel. Gut feel is often right, but it is difficult to defend in a budget meeting. There are five factors that, considered together, give you a defensible answer.
Risk. Risk comes from several directions. Have you recently been audited by a publisher who found material non-compliance? If so, they are more likely to come back. Have you read about a publisher being particularly active in your country or your market sector? That raises the odds too. The second source of risk is business change — a merger, an acquisition or a disposal. If either organisation involved is a significant user of a given publisher’s software, that kind of activity is very likely to trigger an audit.
Spend. This one is tangible and easy to measure. The more you spend with a publisher, the higher they should sit on your list. It is also the criterion that makes the business case for the programme, because spend is the number a finance director already recognises.
Volume. The highest volume of installed software in most organisations is Microsoft. Volume does not always track spend — data centre products carry far more cost per licence than desktop ones — but a very large number of licences means a very large surface area for both non-compliance and overspend. High volume belongs high on the list.
Strategy. Is a publisher’s software strategic to where the business is going? If the next three years of the roadmap depend on it, the licensing position around it should be understood now, while you still have room to negotiate.
Transition. Are you increasing or decreasing your use of a publisher’s software? Rapid movement in either direction attracts attention and raises audit risk. Note that this cuts both ways: even where you are actively migrating away from a publisher, that publisher may deserve priority — the exit is precisely when the entitlement history gets messy and precisely when they are most likely to look.
Assess your publishers against the five criteria and weight each factor for your own circumstances. A heavily acquisitive business should weight risk and transition. A business under cost pressure should weight spend and volume. The weighting is a judgement call; the point of writing it down is that it turns an instinct into something you can review in six months and adjust.
That gives you a top three or five to concentrate on first. It will be impossible to focus on every publisher your organisation uses, and attempting it is the most common way SAM programmes stall.
There is a gap in the method as originally written, and it has grown steadily since. The five criteria above assume you know who your publishers are — which holds when software arrives through procurement and lands on a machine you inventory.
Much of it no longer does. The average enterprise portfolio runs to 305 SaaS applications, and a large share of those were bought on a card by a team that never spoke to IT. They generate spend, they generate risk, and they never appear in a software inventory, so they never enter the prioritisation exercise at all. AI tools are the sharpest version of the same problem: adopted individually, invisible centrally, and carrying data-access questions that a licence count would not surface anyway.
The practical consequence is that prioritisation now has two stages rather than one. First, find out who your publishers actually are. Then apply the five criteria to the full list, not to the portion of it that procurement happens to know about.
CerteroX SaaS Management handles the first stage with three converging discovery signals — identity provider sync from Entra ID and Okta, connector sync pulling authoritative user and licence lists from 47 vendor APIs, and a browser extension that attributes usage per user. Applications are classified from feature tags in a catalogue of more than 35,000 applications, which is what lets Shadow AI detection keep working as new tools appear, rather than depending on a hardcoded list that ages the day it ships.
Once you have your priority list, the tooling question follows from it. You need a centralised view across the publishers you have chosen, and depth on each of them individually.
CerteroX SAM carries dedicated licence engines for Microsoft, Oracle, IBM, SAP, Adobe and Salesforce. That matters because the shortcut most platforms take is a generic count — 400 installs of Oracle Database — which tells you nothing about which options are enabled, which cores are licensable under which core factor, or which hosts are covered down by an Enterprise Edition pool. The audit finding lives in that gap.
Underneath it, CerteroX ITAM provides the inventory across Windows, macOS, Linux, AIX, HP-UX and Solaris, along with virtual infrastructure, mobile and cloud — one agent, ten discovery methods, one schema. And CerteroX SaaS Management and CerteroX Cloud Management extend the same data model to the subscriptions and cloud accounts that never had an installer.
The original advice was to find a partner who could cover desktop, data centre and cloud. That list is now longer: desktop, data centre, cloud, SaaS and AI. The principle behind it has not changed — pick your publishers deliberately, and make sure the platform underneath can follow you to the next ones.
If you would like help assessing which publishers your SAM activities should focus on, get in touch.
Other posts covering the same ground.
Before optimisation, rationalisation or audit defence, most organisations need something less glamorous: a trustworthy answer to what they actually own. Why the foundational phase deserves its own name — and what counts as "stuff" now that most of it never touches your network.
Discovery and inventory are not the same thing, and most tools that claim the first are only good at the second. Six criteria for choosing between them, and why "good enough" coverage stops being good enough the moment anyone outside SAM uses your data.
Providers compete on the size of their normalisation database. Size is the wrong measure. What decides whether recognition is any good is how each entry got there.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.