When a software vendor sends an audit notice, the clock starts. We've defended thousands of audits — and reduced exposure by tens of millions per engagement. AI-forensic analysis. Specialist negotiation. Every time.
Most audits begin with a vendor — or their appointed third-party auditor — claiming significant non-compliance. The numbers cited in the initial position paper are rarely the numbers you end up paying. Everything between is negotiation.
That negotiation hinges on three things: how thoroughly you understand your contracts, how accurately you can measure your deployment, and how confidently you can challenge the auditor's methodology. That's where most internal teams get into trouble — not because they're incapable, but because each of those three skills is its own discipline.
We've been on both sides of the table. We know how vendor licensing teams build their cases. Our AI forensic engine analyses contracts and deployment data in parallel — surfacing methodology divergences and challenge points before the auditor's position paper even lands. We know how to negotiate a settlement that protects your bottom line and your operating relationship with the vendor.
Every major software vendor audits differently. Their methodologies, their appointed auditors, and the specific pressure points they exploit are known quantities to us — because we've defended against every one of them.
IBM audits — particularly around ILMT/BigFix sub-capacity reporting, ECM, and Passport Advantage contractual terms — generate some of the largest exposure claims in enterprise software. IBM's appointed auditors routinely apply sub-capacity rules incorrectly and conflate PVU counts across virtualised environments.
Oracle licence reviews are systematically aggressive, leveraging the complexity of virtualisation licensing rules, ULA certification, and processor metric definitions to maximise initial exposure claims. The gap between the opening position and a settled figure is frequently 60–80%.
Microsoft true-ups, SAM engagement follow-ons, and post-EA True-Up disputes most often turn on device vs. user assignment rules, hybrid benefit eligibility, and M365 licensing tier conflicts — areas where the complexity of Microsoft's licensing framework creates genuine ambiguity that can be challenged.
SAP indirect access claims — where third-party systems connecting to SAP are deemed to require named user licences — represent some of the most commercially dangerous audit territory in enterprise software. SAP's licence metric complexity across S/4HANA, BTP, and legacy modules creates extensive challenge opportunity.
From the moment the notice arrives to post-settlement hardening — every action is sequenced, time-boxed, and AI-assisted. The exposure gauge tracks our progress in real time.
Machine learning cross-references contract language against auditor methodology claims — surfacing divergences that human review would take weeks to find.
Automated deployment measurement runs in parallel with the vendor's own audit process — giving us a forensic baseline to challenge their numbers before they're even shared.
Post-settlement, we deploy automated licence controls and continuous monitoring — so compliance gaps are detected and resolved before the next audit cycle begins.
Every licence audit defence engagement covers these areas — adapted in scale and depth to your environment, contracts, and timeline.
Audit defence rarely stands alone. The strongest defence is built before the audit notice arrives — and the cleanest settlement is sustained by what comes after.
The best audit defence is being permanently audit-ready. Our managed SAM service maintains a defensible licence baseline year-round — so the next vendor audit finds nothing to complain about.
Learn moreAudit findings expose SAM programme weaknesses. Our maturity assessment identifies exactly where your programme needs strengthening — and builds the roadmap to get there.
Learn moreIf you've received an audit notice — or you're hearing rumblings that one is coming — the first 72 hours matter. Book a call now. We'll review the notice, talk through the vendor's likely position, and tell you whether you need our help or your internal team can handle it.