The position should exist
before the letter does.
Publisher-grade licence engines for Microsoft, Oracle, IBM, SAP, Adobe and Salesforce compute purchased, used, available, required, variance and exposure on every inventory cycle. When the letter arrives you are checking a number, not building one.
Answered on one platform. One data model across ITAM, SAM, SaaS, Cloud and AI.
Effective Licence Position
IllustrativeSQL Server 2019 Enterprise · per core
Recalculated on every inventory cycle
- Licensable footprint 13 hosts, cluster-aware
- 176 cores
- Excluded from licensing MSDN, lab, second use · approved
- −24 cores
- Required
- 152 cores
- Purchased MLS import + 2 agreements
- 128 cores
- Variance
- −24 cores
Exposure
24 cores
The problem
Ninety days is not enough time to build a licence position.
It is barely enough time to find the agreements. The work that decides the outcome is the work you did before the letter arrived.
- 01 day 3 of 90
The entitlement is in four places and one of them left the company.
Volume agreements in a shared mailbox. An OEM entitlement on a server nobody has opened in years. A purchasing system whose record of the deal stops at the invoice total. Before you can argue about compliance you have to prove what you bought.
Licences, transactions, agreements, maintenance, suppliers and publishers SAM
- 02 installed ≠ used
Four hundred installs. The publisher does not care how many are running.
You should. The copies nobody has opened since March are the difference between a purchase order and a harvest. An install count without a usage record hands the publisher the number and hands you the invoice.
% Used utilisation metric over a rolling 90-day window SAM
- 03 unevidenced exclusions
Every MSDN, lab and second-use device counts against you by default.
They are excluded under terms you actually signed, but only if you can show which device, which entitlement and who approved it. An exclusion you cannot evidence is not an exclusion at all; it is a finding.
Exclude From Licensing workflow for MSDN, dev, training and second-use devices SAM
- 04 the machines you cannot reach
The AIX frame, the air-gapped lab and the locked-down trading floor.
A publisher counts everything deployed, including the machines your agent never reached. Anything you cannot inventory you have to estimate, and an estimate always resolves in the publisher’s favour.
Agentless and command-line inventory (csinvcli) for locked-down environments ITAM
- None of that is achievable inside a response window. All of it is unremarkable if the position is already computed.
Customer
“My advice to other organizations contemplating RFP’s for ITAM and SAM is: just take Certero.”
- devices
- 4,000
Recognition
The only vendor named Customers’ Choice in the 2024 Gartner® Peer Insights™ Voice of the Customer for Software Asset Management Tools.
4× Customers’ Choice in the category: 2019, 2020, 2021, 2024
Read the announcementGARTNER is a registered trademark and service mark, and PEER INSIGHTS is a trademark and service mark, of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates.
Three of the five disciplines.
Each runs standalone and shares one asset model, so the parts of this that span products need no integration work.
- Primary CerteroX SAM Six publisher engines, the entitlement maths and the effective licence position. Product page
- Also applies CerteroX ITAM Ten discovery methods, so what the publisher is counting is something you can see too. Product page
- Also applies CerteroX SaaS Management Subscription seats and vendor-authoritative licence lists, counted in the same position. Product page
The position, built in five moves.
Each move is a set of named capabilities you can point at. Together they produce a number with evidence underneath every line of it.
-
Establish what is deployed
Ten discovery methods land in one schema. There is no reconciliation project because there is nothing to reconcile.
- Network Discovery across NetBIOS, SNMP and ICMP ITAM
- Native inventory agent for Windows, macOS, Linux, AIX, HP-UX and Solaris ITAM
- Standalone inventory for air-gapped and offline systems ITAM
- Duplicate system detection and stale device archiving ITAM
- Non-persistent VDI inventory support ITAM
-
Recognise what it actually is
Recognition turns raw inventory into the titles, editions and versions a publisher would accept, so an executable name becomes a licensable product.
- Software Recognition Database with centrally maintained title categorisation SAM
- Software Identification (SWID) tags with UNSPSC classification SAM
- Publisher normalisation and version recognition SAM
- Software Recognition Service — release date, end of support and extended support dates SAM
-
Measure what is used
Usage is the only thing that turns a shortfall into a choice. Ninety days of it, per device and per user.
- AppsMonitor file-based usage metering with first-used and last-used tracking SAM
- % Used utilisation metric over a rolling 90-day window SAM
- Terminal Server and RDS remote-usage tracking per device SAM
- Access Control rules for RDS, Citrix and VDI streamed-application licensing SAM
-
Prove what you own
Entitlement is a record with a supplier, a date and a document behind it.
- Licences, transactions, agreements, maintenance, suppliers and publishers SAM
- Microsoft Licence Statement (MLS) import SAM
- Volume licence, retail, OEM and FPP transaction capture SAM
- Downgrade rights and second-use entitlement handling SAM
- Subscription flags with expiry tracking SAM
-
Compute it, and keep computing it
The position is recalculated with the inventory, and every adjustment leaves a trail.
- Effective Licence Position: purchased, used, available, required, variance, exposure SAM
- Overspend and additional-licence-required calculation SAM
- Continuous compliance position rather than point-in-time reconciliation SAM
- Audit trail across agreements, transactions and exclusions SAM
- Reporting Levels restricting visibility by organisational unit or location SAM
Ask to see any one of these running in the product itself, on the screen where it happens.
Open a line. The evidence is underneath it.
Purchased, used, available, required, variance, exposure: six quantities, one publisher, one licence metric. Here they are for SQL Server 2019 Enterprise on cores, with the working left in.
Effective Licence Position
recomputed 04:12 · inventory cycle 6 of 6
Illustrative · sample data Illustrative interface · sample dataSQL Server 2019 Enterprise · per core
Microsoft · core licensing · cluster and virtualisation aware
Open a line
Evidence · Licensable footprint
The count opens into the hosts it came from, each with the basis it was counted on. Cluster nodes are licensed individually; virtual instances carry the four-core minimum.
| Host | Basis | Cores |
|---|---|---|
| sql-prod-01 | Physical · 2 sockets × 16 cores | 32 |
| sql-prod-02 | Physical · 2 sockets × 16 cores | 32 |
| sqlclu-n1 | Cluster node 1 of 3 · 2 × 12 cores | 24 |
| sqlclu-n2 | Cluster node 2 of 3 · 2 × 12 cores | 24 |
| sqlclu-n3 | Cluster node 3 of 3 · 2 × 12 cores | 24 |
| sql-vm-rpt-01 | Virtual · 8 vCPU | 8 |
| sql-vm-rpt-02 | Virtual · 8 vCPU | 8 |
| + 6 virtual instances | Virtual · four-core minimum applied | 24 |
Inventoried by the native agent on the last cycle. No host here was typed in by anybody: the cluster relationship, the socket count and the vCPU allocation are all read from the machine.
Assignment types: per device, per processor, per core SAM
Evidence · Excluded from licensing
This is the line an auditor pulls on first. Each exclusion opens into the device, the entitlement that permits it and the role that approved it, with the date.
| Device | Entitlement that permits it | Cores |
|---|---|---|
| sql-vm-dev-01 | Visual Studio Enterprise — dev/test rights · approved by SAM Manager, 14 Mar | −4 |
| sql-vm-dev-02 | Visual Studio Enterprise — dev/test rights · approved by SAM Manager, 14 Mar | −4 |
| sql-vm-dev-03 | Visual Studio Enterprise — dev/test rights · approved by SAM Manager, 14 Mar | −4 |
| sql-vm-app-03 | Second-use rights on a licensed primary · approved by Licensing Lead, 09 Jan | −4 |
| sql-vm-rpt-02 | Training lab — non-production terms · approved by Licensing Lead, 02 Feb | −8 |
Five devices, five entitlement records, five approvals. Take the exclusions away and the requirement climbs to 176 cores. Everything that stops that happening is in this table.
Exclude From Licensing workflow for MSDN, dev, training and second-use devices SAM
Evidence · Required
The requirement is the footprint less the evidenced exclusions, recomputed whenever either side of that sum changes.
| Component | Where it comes from | Cores |
|---|---|---|
| Licensable footprint | 13 hosts, read from inventory | 176 |
| Excluded from licensing | 5 devices, each with an entitlement | −24 |
| Required | Computed on every inventory cycle | 152 |
Add a host and the requirement moves that night. Withdraw an approval and it moves that night. Nothing here carries a date it was last agreed.
Continuous compliance position rather than point-in-time reconciliation SAM
Evidence · Purchased
Entitlement is a record with a supplier, a date and a document behind it. Opening this line gives you the transactions themselves.
| Source | Record | Cores |
|---|---|---|
| Microsoft Licence Statement | Imported 04:12 today · Enterprise Agreement | 88 |
| Volume licence agreement · 2023 | Transaction, purchase order and invoice attached | 24 |
| Volume licence agreement · 2024 | Transaction, purchase order and invoice attached | 16 |
| Downgrade rights | 2022 entitlement covering 2019 deployments | applied |
The MLS import is Microsoft’s own statement of what you bought, read straight into the entitlement store. The two volume agreements carry their supplier, their dates and their documents.
Microsoft Licence Statement (MLS) import SAM
Evidence · Variance
Twenty-four cores short. Before that becomes a purchase order, the rolling ninety-day usage window says how much of it is a genuine shortfall and how much is simply unharvested.
| Instance | % Used · rolling 90 days | Cores |
|---|---|---|
| sql-vm-rpt-01 | 0% · last used 118 days ago | 8 |
| sql-vm-app-01 | 0% · no session ever recorded | 4 |
| sql-vm-app-02 | 1% · last used 74 days ago | 4 |
| sql-prod-01 | 94% · in constant use | 32 |
| Recoverable before purchase | Three instances, near-zero use | 16 |
Sixteen of the twenty-four cores sit on instances nobody has opened. The remaining eight is a real shortfall, and it is the only number in this whole exercise anybody needs to spend money on.
% Used utilisation metric over a rolling 90-day window SAM
↑ ↓ move between lines
Figures on this panel are sample data. Your own position opens the same way: every line traceable to the records it was computed from.
Exposure
24 cores · 8 after harvest
What good looks like.
Five things that are true of an organisation that is not afraid of the post.
- 01
The position is dated today.
Not the quarter you last ran a reconciliation. Compliance is recomputed on the same cycle as inventory, so the number in the meeting is the number in the tool.
- 02
Every figure opens onto its evidence.
Nobody queues behind the SAM team for a spreadsheet and nobody rebuilds a figure from memory. Every change to an agreement, a transaction or an exclusion stays in the audit trail, so who moved a number, and when, is still answerable a year later.
- 03
Usage decides the purchase.
Before anyone signs for a shortfall, the rolling ninety-day usage window says whether the shortfall is real or merely unharvested. Most of them are unharvested.
- 04
Unlicensed installs stop happening.
Application blacklisting and prohibition rules, plus Governance Policies for unauthorised software, mean the next audit starts from cleaner ground than this one did.
- 05
Scope is yours to set.
Reporting Levels restrict visibility by organisational unit or location, so a regional audit is answered with regional data and nothing else travels.
Questions worth asking us.
Not the one you came with? Ask it directly and we will answer it in writing.
We already run a reconciliation before every audit. Why change?
A reconciliation is a project with a start date, which means the position is accurate on the day it finishes and decaying from then on. CerteroX recomputes the effective licence position on the same cycle as inventory. In practice a publisher letter becomes a diary entry.
Will the publisher accept our measurement data?
Oracle already does. Certero is verified by Oracle License Management Services, so Oracle’s audit team can accept data from Certero during an official audit, as an alternative to installing Oracle’s own measurement tools. For other publishers the value is different: you arrive with a defensible position, the evidence behind each line, and the exclusions you are entitled to but were not taking.
We are exposed to Microsoft, Oracle and IBM. Is that three tools?
One. Six publishers have dedicated engines (Microsoft, Oracle, IBM, SAP, Adobe and Salesforce) running on the same inventory, the same entitlement store and the same evidence trail. The depth is per publisher; the data model is not.
Half our exposure is on systems we cannot put an agent on.
Then use one of the other nine methods. Agentless and command-line inventory (csinvcli) covers locked-down environments, standalone inventory covers air-gapped systems, network discovery finds what nothing has ever inventoried, and Active Directory import brings in the objects you already trust. All ten methods land in one schema.
Do SaaS subscriptions and cloud licences come into an audit?
Increasingly, yes, and they are the entitlements least likely to be recorded anywhere. Connector sync pulls authoritative user and licence lists straight from the vendor, so subscription seats sit in the same position as perpetual licences instead of in somebody’s renewal spreadsheet.
How long before we have a position we would show a publisher?
That depends on what you are running, and anyone quoting you a number without seeing it is guessing. Discovery is quick: a class-C subnet sweeps in under five seconds. The honest constraint is how long it takes to get your entitlement documents into one place, and that work is worth doing whether or not you buy anything.
Name the publisher.
We will bring the position.
A full effective licence position at real scale, opened line by line, with the evidence underneath and the exclusions most organisations never claim. Whichever publisher has your attention is the one we start on.
No gated PDF, a technical person on the call, and a written position afterwards.