Software Audits Hit 62% of Surveyed Firms as License Costs Climb

Audits went from occasional to routine

For years, enterprise IT teams treated a software audit as a rare and unpleasant surprise. A survey run by Unisphere Research and sponsored by LicenseFortress suggests that view no longer holds. Between 2023 and 2025, the share of respondents who said a major software vendor had audited them in the past year rose from 40% to 62%.11 The study drew on more than 300 database administrators, IT leaders and executives.18 It also found that 53% of respondents said the cloud had made software management much more complex.11

The Coalition for Fair Software Licensing, which has long campaigned against what it calls predatory vendor behavior, took up the findings. It described customers as stuck in a loop. Restrictive licensing pushes them into upgrades they did not choose, contract terms are hard to interpret, and that ambiguity leaves them open to audits that keep getting more frequent and more expensive.11 The survey also reported that 78% of respondents had been affected by Microsoft's new AI-powered services, which the coalition offered as an example of legacy vendors adding products and raising costs without giving customers a real choice.11

The study came out in early 2025. More than a year and a half later, the evidence that has followed mostly backs up its main point: audits and licensing costs are climbing together, and customers who rent software on subscription are carrying more of the risk.

The money at stake

The survey put a figure on the financial exposure. Among audited companies, 32% said they paid more than $1 million to resolve audit findings.17 That fits older industry data. Flexera's 2022 asset management report found that 24% of companies had paid more than $1 million in audit-related costs and penalties over three years, and another 10% had paid more than $5 million.13

Benchmarking firms that collect settlement data report larger numbers at the top of the market. VendorBenchmark puts the average Oracle audit settlement among Fortune 500 companies at $4.2 million, against an average opening claim of $8.7 million. It cites $2.8 million for SAP and $890,000 for Microsoft in the same group, and says resolving an Oracle audit usually takes 14 to 22 months.5 Redress Compliance describes the pattern in more pointed terms. It treats the audit as a revenue motion rather than a neutral check, and says opening claims commonly ran two to four times the amount eventually settled.3

One detail in that data stands out. Redress says the penalty is often the smallest part of the final bill. Most of the cost comes from forward purchases of new licenses or subscriptions, back maintenance, and longer commitments or cloud moves signed under time pressure.3 In practice, this means an audit often works less like a fine and more like a forced sales meeting. That is the coalition's central complaint.

Where the counts disagree

Not every measure points to the same level of audit activity. Flexera's 2026 report, based on 512 respondents surveyed in June 2026, found that 48% of organizations had been audited in the past year. Microsoft audited most often, and Oracle's share rose from 24% to 38% in a single year.2 That 48% is well below the Unisphere survey's 62%. Redress, which counts audits over three years rather than one, estimates that 55% to 70% of enterprises face a formal Oracle audit in that window, 45% to 55% face one from IBM, and 40% to 50% from Microsoft.3

The gap probably reflects differences in who was surveyed and how each study defines an audit, not a contradiction about the trend. A sample weighted toward database administrators, which describes the Unisphere respondents, will naturally be closer to Oracle and IBM. Those vendors run the most aggressive compliance programs.183 Every dataset agrees on the direction. Audits are frequent, Oracle activity is rising fastest, and visibility on the customer side is poor. Flexera found that only 36% of organizations have full visibility of their IT estate.2

Readers should also weigh the source of the data. LicenseFortress sells licensing advisory services. Redress and VendorBenchmark sell negotiation support. Rimini Street sells third-party support. Each benefits when customers see vendors as adversaries.1737 Even so, the consistency across firms with different methods suggests the trend is real, even if any single number may be inflated.

Subscriptions raise the stakes

The move from perpetual licenses to subscriptions has made the audit problem worse, and VMware is the clearest example. After Broadcom bought it, the company ended support for perpetual licenses and moved customers onto bundled subscriptions. Reported price increases range from 150% to more than 1,500%, with mandatory three-year terms and a 20% penalty for late renewal.1 Licenseware's tracker gives a range of 150% to 1,200% and notes that the minimum core count for vSphere Standard rose from 16 to 72, which hits smaller customers hardest.6 Redress describes the change plainly: customers now rent what they used to own, and first quotes arrived at two to four times their previous vSphere costs.9

The effects keep spreading. A Rimini Street survey of 300 VMware customers, carried out by Unisphere Research and published this month, found that 90% are exploring alternatives because of higher licensing costs. Another 54% cited the end of support for perpetual licenses.7 The Register reported that 48% of respondents have no current plans to move any workloads to VMware Cloud Foundation, Broadcom's preferred subscription platform.8 Ars Technica, as quoted on Slashdot, pointed out Rimini's commercial interest but said the results line up with other reporting on VMware customers.7

Oracle's Java changes show how a new pricing metric can turn into audit exposure. Oracle now charges per employee rather than per user, and the definition of employee is broad enough to include contractors and part-time staff. A 500-person company can face roughly $90,000 a year.1 Gartner has predicted that one in five Java-using organizations would be audited by Oracle by 2026.6 A Dimensional Research survey reported by The Register found that 73% of Oracle Java users had been audited within three years.2

Microsoft is less adversarial but still more expensive. Its July 2026 price changes raised frontline worker licenses by 25% to 33% and business tiers by 12% to 17%.6 Its Enterprise Agreement volume discounts of up to 12% were removed in November 2025.6 Monthly-billed CSP subscriptions get a 5% uplift from October 1, 2026.2 VendorBenchmark puts the average weighted enterprise software price increase at 8.4% for the 12 months to Q1 2026, with Microsoft at 7.8%.4

The audit you don't notice

The most recent warning from LicenseFortress concerns how audits start, not how often they happen. The firm has started using the term "Ambush Audit" for vendor requests that look informal or advisory. These include a sales conversation, a survey of the customer's architecture, or a request for virtualization details, and they later turn into a compliance claim or a forced purchase.17 Because no formal notice is issued, legal and executive teams may not realize the company is being examined.17 Practitioners have described a similar pattern with smaller vendors. A harmless-looking self-assessment asks whether the customer uses virtualization, and a yes answer turns the exercise into a formal audit.14

This matches allegations that have surfaced in court. Former Oracle employees, quoted in a securities complaint, alleged that sales teams chose audit targets and used the threat of an audit to sell cloud subscriptions.16 HealthEquity's lawsuit against Quest Software alleged that audit counts deliberately included anyone who could reach a server, not just people who actually used the software.20 These are allegations, not findings. Still, they describe the same mechanism the surveys measure: unclear terms used as leverage.

What it means for customers

The most reasonable conclusion is that the 2025 study was early rather than exaggerated. Its main claim was that complex licensing, cloud migration and frequent audits combine to raise costs for customers who have limited room to push back. The 2026 data on VMware renewals, Java enforcement and Microsoft price increases supports that claim.167

The practical advice from customer-side advisers is consistent. Buyers who controlled their own data and set the pace of their response settled for roughly 30% to 50% of the opening claim, while those who cooperated fully and quickly paid much more.3 VMware customers who arrived with an independent core count and a costed alternative reportedly settled 30% to 55% below list price.9 In practice, the best defense against an audit is knowing your own license position in detail before a vendor asks about it.