Executive summary

Software contracts read the same in every boardroom, but the metric that drains your budget changes with your industry, so the position you build and the clauses you fight for have to change with it. A bank overpays on disaster recovery copies and named-user sprawl. A hospital pays twice for clinical devices that run around the clock. A factory is counted at full capacity across a virtual cluster it never isolated. The contract language is shared, the exposure is not, and the buyers who win read their own vertical before they read the vendor quote.

This handbook works through the seven verticals where licensing behaves differently, financial services and insurance, healthcare and life sciences, public sector, manufacturing and energy, retail and hospitality, technology and software companies, and education. Each section names the metric that hurts most, the public pricing model behind it, the audit pattern that follows, and the buyer-side move that contains it.

Our advisors negotiate on the buyer side only. Across more than 500 enterprise engagements, the buyers we advise have negotiated over $2.4 billion in software and cloud contracts at an average saving near 38 percent, and our audit defence work averages a 72 percent reduction against the initial claim. The figures below summarize that record and the public mechanics that frame each industry deal.

1. Why your industry decides where the money leaks

The licensing contract is vendor specific, but the way it bites is industry specific. The same Oracle Database agreement sits quietly in a small professional services firm and detonates inside a virtualised bank, because the bank runs disaster recovery copies, dense hypervisor clusters, and a regulator who insists on architecture the licence metric punishes. Read the industry first, then read the contract, and the overpayment pattern is visible before the quote arrives.

Three industry traits decide the risk shape. The first is regulation, which forces redundancy, retention, and access patterns that licence metrics charge for. The second is how the estate is virtualised, because per-core and per-processor metrics turn a dense cluster into a full-capacity bill. The third is how many non-vendor systems touch the core platform, which is where indirect and digital access charges are born.

The same product, three different bills

Consider one enterprise resource planning suite sold to three buyers. In a manufacturer it is counted against plant-floor data flowing in from machines, so digital access dominates. In a retailer it is counted against seasonal order volume, so the peak sets the bill. In a bank it is counted against named users in a tightly governed access model, so dormant accounts inflate it. One SKU, three risk shapes, three negotiation strategies.

2. Financial services and insurance: redundancy, sprawl, and the audit magnet

Financial services carries the highest concentration of audit exposure of any vertical, because everything the regulator requires is something a licence metric can charge for. High availability means standby copies. Business continuity means a second data centre. Long retention means more storage and more database instances. Each is defensible operationally and expensive contractually, which is why banks and insurers are the first names on a vendor's audit list.

Oracle and IBM exposure dominates here. Disaster recovery and standby databases are a recurring finding, because Oracle's policy on failover and standby is narrow and frequently misread. A cold standby allowed under one reading becomes a licensable deployment under another, and the gap is decided by evidence the bank either has or improvises. The defence is to document the failover architecture and its isolation before any audit letter, not after.

Named-user sprawl and the dormant account

Insurers and banks accumulate named-user entitlements faster than they retire them. Branch staff, contractors, and seasonal claims handlers are provisioned and never deprovisioned, so the named-user count climbs while real usage falls. Reclaiming dormant accounts before a true-up is the single fastest reduction available in this vertical, and it requires nothing from the vendor.

Indirect access through trading and payment systems

Financial institutions connect their core database and resource planning systems to a wide ring of trading, payment, and reporting platforms, and every one of those connections is a potential indirect-access charge. A payment gateway that writes settlement records, a trading system that posts positions, or a reporting tool that reads ledger data can each be treated as a licensable use of the underlying system even though no employee of the bank ever logged into it directly. The exposure is large precisely because the architecture is mature, so the count to prepare is the volume of documents and transactions crossing those boundaries, measured and reconciled before the vendor proposes its own figure.

3. Healthcare and life sciences: clinical uptime and device counting

Healthcare licensing is shaped by a simple fact, the systems never stop. Clinical applications run around the clock, accessed by rotating shifts of staff and by devices that authenticate independently of any human. That pattern collides with named-user and per-device metrics, because the count is not the number of clinicians on shift, it is the total population with access plus every device that touches the system.

Electronic health record platforms, picture archiving systems, and laboratory information systems each carry their own metric, and the device side is where the surprises sit. A radiology modality, an infusion pump management console, or a shared nursing workstation can each be a licensable device, and in a large hospital the device count dwarfs the clinician count. Microsoft and Oracle estates in hospitals frequently carry per-device entitlements that were sized for a clinic and never re-tested against a merged regional network.

Shared workstations and the access multiplier

Healthcare is the classic case for multiplexing and shared-device licensing. A single shared workstation accessed by forty staff across three shifts can be licensed as one device or as forty users, and the cheaper path depends on the product and the metric. Test both before renewal, because the default the vendor proposes is rarely the cheaper one.

4. Public sector and government: frameworks are a ceiling, not a floor

Public-sector buyers carry a structural disadvantage that is entirely self-inflicted, they treat a framework price as a fixed price. Government purchasing vehicles set ceiling rates that an agency negotiates beneath, yet many bodies pay the published framework rate as though it were a law. The framework guarantees you will not pay more, it does not stop you paying less, and the difference on a large estate is substantial.

Procurement rules add a second pattern. Competitive tendering is mandatory above a threshold, which is a buyer-side advantage rarely pressed home. A credible competitive process, run on a real timetable, is the strongest single lever a public body holds, because it converts a sole-source renewal into a contested one. Agencies that pre-announce the incumbent as the winner forfeit the advantage the rules were written to give them.

Audit posture in the public sector

Government estates are audited differently. The vendor knows the budget is public, the timeline is slow, and the political cost of a compliance headline is high, so the audit motion leans on reputational pressure rather than speed. The counter is the same as everywhere else, a current effective license position and a single owner who routes all vendor contact, so the agency answers from its own count rather than the vendor's.

5. Manufacturing and energy: the OT and IT split and per-core ERP

Manufacturers and utilities run two estates that licence metrics struggle to tell apart. The information technology estate is the familiar one of users and servers. The operational technology estate, the plant floor, the grid, the meters, generates machine data that flows into core business systems, and that flow is where the most expensive surprises live. When machine and sensor data lands in an enterprise resource planning system, it can trigger indirect or digital access charges even though no human logged in.

SAP exposure is the headline case. SAP prices much of this through the document-based digital access model, where the charge is driven by documents created in the system rather than by the users or systems that created them. For a manufacturer, sales orders, deliveries, and invoices generated automatically from plant data can run into large volumes, so the count that matters is documents, and the defence is to measure them before SAP does.

Per-core counting on the plant-adjacent estate

Manufacturing virtualised estates are often dense and rarely isolated, which is the exact condition that turns Oracle and IBM per-core metrics into full-capacity bills. A virtual cluster running a handful of licensed instances can be counted against every core in every host unless the architecture is partitioned in a way the vendor recognises and the buyer can evidence. Energy companies running large SCADA-adjacent estates face the same exposure.

6. Retail and hospitality: seasonal peaks and the consumption spike

Retail and hospitality licensing is governed by the calendar. Demand is not flat, it peaks hard around seasonal trading, and any metric tied to capacity or consumption charges for the peak even when the average is modest. A buyer who commits to peak capacity year-round pays for eleven quiet months to cover one busy one, which is the most common structural overpayment in this vertical.

Point-of-sale and store systems add a device-count problem similar to healthcare, every till, kiosk, and handheld can be a licensable endpoint. Hospitality adds property-based and room-based metrics that scale with the estate rather than with usage. The pattern across both is the same, the count grows with physical footprint and seasonal load, so the lever is matching the commitment shape to the demand shape.

Consumption commitments and the burst

Retailers moving to consumption-priced cloud and database platforms face a specific trap, the burst. A trading peak that drives consumption far above the committed baseline is billed at on-demand rates, while the quiet months leave a committed floor unused. The fix is to model the demand curve and shape the commitment around it, with burst headroom priced in advance rather than discovered on the invoice.

7. Technology and software companies: embedded, OEM, and developer tooling

Software and technology companies licence differently because they redistribute. When a vendor product is embedded in a product you sell, the metric is not your internal usage, it is your distribution, and OEM and embedded agreements price on units shipped, end customers served, or revenue. Misreading an internal-use entitlement as a redistribution right is the most expensive mistake in this vertical, because it accrues silently with every unit sold.

Developer tooling is the second pressure. Integrated development environments, database development licences, and component libraries are often priced per seat, and a fast-growing engineering organisation provisions them faster than it tracks them. Microsoft Visual Studio subscriptions, database developer editions, and per-seat tooling all reward a current named-user position and punish the team that counts only at renewal.

Multi-tenant and the hosting question

Technology companies that host software for customers face the question of whether their licences permit multi-tenant or hosted use at all. Many standard agreements do not, and a hosting or service-provider programme is required instead. Confirm the redistribution and hosting rights in writing before architecture decisions lock them in, because retrofitting the right agreement after launch is far more expensive than scoping it first.

Acquisition adds a further layer for technology companies, because licences rarely transfer cleanly. When one software business buys another, the assumption that entitlements move with the assets is frequently wrong, since many agreements restrict assignment or require vendor consent on a change of control. The acquiring company can find itself running production workloads on licences it does not legally hold, which surfaces as an audit finding within the first year. Review the assignment and change-of-control clauses during diligence, not after close, and budget for the re-papering the vendor will ask for.

8. Education: enrolment-based licensing and the FTE definition

Education licensing turns on a single contested number, the definition of who counts. Academic agreements price on full-time-equivalent students, total enrolment, or staff headcount, and each vendor defines the population differently. The same university can be quoted three ways, and the cheapest depends entirely on which definition the agreement adopts, so the definition is the negotiation.

Institution-wide agreements are common in education and carry their own trap, they bundle products the institution does not fully use into a single enrolment-based fee that feels simple but rarely reflects real consumption. The convenience is real, the value is not automatic, and the buyer who tests the all-in fee against itemised usage frequently finds the bundle is sized for a larger or more intensive estate than the one in front of them.

Research computing and the hidden commercial use

Universities run two licensing worlds at once, the teaching estate and the research estate, and they price differently. Academic and teaching use often carries discounted or waived terms, while commercially funded research can fall outside those terms entirely, so a grant-funded project running on a teaching licence can create exposure no one intended. Separate the research workloads from the academic ones in the entitlement record, confirm which licences permit commercial or sponsored use, and price the research estate on its own terms rather than assuming the academic discount travels with it.

9. The cross-industry levers and the negotiation calendar

Whatever the vertical, the levers that move the number rhyme. Build the effective license position before any conversation, reclaim what is dormant or duplicated, re-test every metric against current deployment, and time the close to the vendor's quarter rather than your own deadline. The industry decides which lever matters most, but the order is the same everywhere. The illustrative index below shows where buyer-side preparation changes the outcome. It is an illustrative index with the prepared position set to 100, not a market benchmark.

The renewal is a calendar, not a meeting. The position is built nine to twelve months out, the reclamation and metric tests run in parallel, and the close is timed to land when the account team's flexibility is widest. A buyer-side position that is reconciled and dated beats a renewal worked in the final fortnight, regardless of vertical.

Our recommendation: read your industry before you read the quote, build the effective license position first, reclaim what is dormant or duplicated, re-test every metric against current deployment, and time the close to the vendor's quarter rather than your own deadline. The contract is shared across industries, the exposure is not, and the buyer who counts correctly for their vertical sets the number instead of receiving it.

Sources: vendor public pricing models and use-rights documents, including Oracle, IBM, Microsoft, and SAP published terms, as available at the time of review. Industry risk patterns and outcome ranges are Atonement Licensing advisory figures, indicative and deal-specific, not a quote.

Related reading: SaaS Management hub, Software Licensing Advisory, Effective License Position Handbook, and Audit Defence Handbook.