Real Engagement Outcome
In one engagement, a global technology firm received an Oracle audit claim of $4.1M covering database options they had never knowingly enabled. Redress demonstrated that the options were activated by default during patching — not by the client — and negotiated the settlement to $310,000. The engagement fee was under 3% of the exposure removed.
Why Oracle Audits Find So Much — Without Customers Realising It
Oracle's audit methodology is not a random compliance check. It is a structured revenue recovery process built on the same information asymmetry that drives Oracle's entire commercial model. Oracle knows precisely which features each customer's environment is using. Customers typically do not. When Oracle's License Management Services (LMS) — now operating as GLAS, the Global Licensing and Advisory Services team — issues a formal audit notification, it is rarely doing so speculatively. It already has reason to believe there is a compliance gap worth pursuing. That gap almost always comes from one of the hidden risk categories described in this guide.
The central mechanism is Oracle's Data Collection Script (DCS), also referred to as the LMS or GLAS script. When Oracle requests that customers run this script, it collects a detailed inventory of every Oracle feature, option, and pack that has been accessed in the database environment — often going back years. The script is technically comprehensive and extremely difficult to dispute without independent analysis. Organisations that respond to an Oracle audit without understanding what the script captures and how to interpret its output are at a severe disadvantage. The first step in any Oracle audit defence is engaging independent expertise through services like those at Redress Compliance Oracle Advisory before responding to Oracle.
Independent Oracle Audit Defence
Redress Compliance holds zero commercial relationship with Oracle. When Oracle GLAS issues an audit notification, we act entirely on your behalf — analysing the data collection output, challenging Oracle's claims, and negotiating the settlement position.
Explore Oracle Advisory →Risk 1: Oracle Database Options and Packs Enabled Without Realisation
This is the single most frequent hidden Oracle audit risk, and the most financially dangerous. Oracle Enterprise Edition ships with numerous high-value options and packs disabled by default — but there is no technical lock preventing a DBA from enabling them. The most commonly triggered are the Diagnostics Pack (which includes Automatic Workload Repository, Active Session History, and ADDM) and the Tuning Pack (which includes SQL Tuning Advisor and SQL Access Advisor). Both are enabled the moment a DBA queries the V$ACTIVE_SESSION_HISTORY view, runs AWR reports, or accesses SQL Tuning Advisor in OEM — activities that happen routinely during performance troubleshooting.
Each of these packs carries a separate Oracle licence cost on top of Enterprise Edition. At Oracle's current list pricing, the Diagnostics Pack alone can add 20–25% to the cost of each Enterprise Edition processor licence. For an organisation running 50 processor licences, that represents an annual exposure of $500,000 or more. Oracle's DCS captures every access event, so an inadvertent AWR query from five years ago will appear in Oracle's audit findings. The Oracle audit risk assessment Redress runs for new clients specifically targets this exposure in the first pass.
Other commonly inadvertently enabled options include Partitioning (triggered by range or list partitioning of any table), Advanced Compression (triggered by table compression directives), and Database Vault. In our experience advising on 500+ Oracle engagements, we find unlicensed option usage in the majority of Enterprise Edition environments — it is the rule, not the exception.
Risk 2: Oracle Java SE — The Employee Count Trap
Since January 2023, Oracle has replaced its Java SE per-user and per-processor model with the Java SE Universal Subscription — an employee-based model that requires organisations to licence every employee regardless of whether they use Java. This change is probably the most significant Oracle licensing shift in a decade, and it has created an enormous hidden risk for organisations that have not assessed their position under the new model.
The trap is in Oracle's definition of "employee." Oracle counts full-time employees, part-time employees, temporary workers, and contractors — anyone working on behalf of the organisation. For a company with 8,000 employees in Oracle's 3,000–9,999 tier, the annual Java SE liability at Oracle's published price is approximately $1 million per year at $10.50 per employee per month. Many organisations that previously paid $50,000–$150,000 per year for Java SE under the old named user model now face 5–10x cost increases. Those that have not yet received an Oracle Java SE renewal notice are not safe — Oracle is actively contacting Java customers under the Universal Subscription model, and the exposure accumulates from January 2023 whether or not the subscription has been formally agreed.
Independent advice is essential on Java SE. The employee count, tier classification, and scope of the Universal Subscription can all be negotiated with proper preparation. Organisations that engage Oracle on Java SE renewals without independent benchmarking data consistently overpay. Redress has helped clients reduce Java SE demands by 40–70% against Oracle's opening position. Our Oracle Java audit defence guide explains the methodology in detail.
Oracle Total Cost Optimisation Assessment
Identify your Oracle cost reduction opportunities across database, Java SE, support, and cloud — before your next renewal or audit. Free 15-minute assessment with a detailed action plan.
Start Assessment →Risk 3: Virtualisation — Oracle's Soft Partitioning Exposure
Oracle's partitioning policy is one of the most aggressive in the enterprise software industry and one of the least understood by customers. Oracle distinguishes between hard partitioning (where physical CPU or memory assignment is enforced at a hardware level, preventing Oracle software from accessing resources it is not licensed for) and soft partitioning (where the separation is achieved through software alone, such as VMware ESXi, Microsoft Hyper-V, or KVM). Oracle does not recognise soft partitioning as a valid licensing boundary.
This means that an organisation running Oracle Database on a VMware cluster of, say, 20 physical hosts — even if Oracle is deployed on a single VM configured for 4 vCPUs — must licence Oracle for all 20 hosts under Oracle's policy unless hard partitioning can be demonstrated. For a 20-host cluster running dual-socket servers with modern Intel processors, that represents 40 processor licences rather than the 2 or 4 the customer believes they need. The financial delta is enormous: the difference between 4 licences and 40 licences of Oracle Database Enterprise Edition represents roughly $3 million in licence cost at Oracle's current list price.
This is not merely theoretical. Oracle's GLAS team routinely pursues virtualisation exposure as the primary finding in large-enterprise audits, and it is the area where audit settlement demands reach their highest levels. Full details of the VMware and virtualisation risk framework are covered in our Oracle Knowledge Hub, with specific guidance on which virtualisation technologies Oracle considers compliant and which do not qualify as hard partitioning.
Risk 4: Third-Party Tools and Inadvertent Feature Activation
A less-publicised but increasingly common Oracle audit risk category involves third-party monitoring, backup, and management tools that interact with Oracle databases and inadvertently trigger licensed feature usage. Enterprise monitoring platforms such as SolarWinds DBA xPress, Quest Spotlight, or certain configurations of Oracle Enterprise Manager can invoke Oracle pack functionality as part of their normal operation. If those packs are not licensed, Oracle's DCS will flag the usage — and Oracle holds the customer responsible regardless of whether the customer deliberately activated the feature.
Similarly, backup tools that invoke Oracle RMAN in certain configurations, and data integration tools that use Oracle Advanced Queuing or Streams features, can trigger separate licensing requirements. This risk is particularly acute in large-scale environments where multiple vendor tools interact with Oracle databases across a complex infrastructure landscape. Organisations should conduct a pre-audit technical review of all tools that connect to Oracle Database to identify inadvertent feature activation before Oracle's GLAS team does.
The most effective defence against this category of risk is a proactive Oracle audit risk assessment conducted before any Oracle audit notification arrives. Once Oracle has issued its audit notice, the timeline for remediation compresses significantly, and any remediation that occurs after Oracle's measurement period begins will not affect the findings. Organisations that contact Redress Compliance proactively typically have far better outcomes than those that engage us reactively once Oracle's audit is already underway.
What CIOs and Procurement Teams Should Do Right Now
The four hidden risk categories described in this guide — database options, Java SE employee counts, virtualisation soft partitioning, and third-party tool triggers — collectively account for the vast majority of Oracle audit settlement revenue. None of them require deliberate non-compliance to create exposure. They are structural features of Oracle's licensing model, designed to generate revenue through complexity rather than enforcement of clear rules. Organisations that understand this dynamic and act proactively are in a fundamentally different position from those that wait for Oracle's GLAS notification to arrive.
The practical first step for any organisation with material Oracle deployment is an independent Oracle licensing health check — conducted without Oracle's involvement, using advisors with no commercial relationship with Oracle. The findings from such a review almost always identify remediable exposure that, if addressed before an Oracle audit, eliminates or substantially reduces the financial risk. Redress Compliance provides this service as part of its Oracle advisory practice, and we consistently find that the cost of proactive review is a fraction of the cost of reactive audit defence. For organisations not yet engaged in this process, the question is not whether Oracle will eventually audit — it is whether you will be prepared when it does.
