The metric changed underneath designs that were already built

The exposure in a post acquisition VMware estate is unusual because almost none of it was created by anyone doing anything wrong. Sizing decisions made correctly under a per socket model became expensive under a per core one, non production estates that were effectively free became licensable, and a bundle that raised the contracted floor did so without changing what anybody deployed.

Prepared by Redress Compliance · August 11, 2026 · Broadcom advisory. Based on 30 to 40 Broadcom VMware engagements, 2024 and 2025.

• Build a dated core inventory per host, because accurate dated records settle most disputes in the buyer's favour and cannot be reconstructed once the notice period starts.
• Find the high density hosts first, since the gap concentrates exactly where per socket era consolidation was pursued hardest and runs 20 to 40 percent above the licensed position.
• Inventory disaster recovery and test environments explicitly, as they were unlicensed or under licensed in 6 of 10 reviews and their existence is never in dispute, only their entitlement.
• Compare the contracted floor against measured consumption, because a floor 25 to 50 percent above actual use is a commercial term rather than a compliance gap and needs a different remedy.
• Validate inherited partner arrangements, since prior channel relationships are now read against different programme rules than the ones under which they were established.

It is worth being precise about the moral shape of this exposure, because it changes how the conversation should be run. In most audit situations there is at least an implicit suggestion that something was managed badly: a count drifted, a control lapsed, a deployment outran its entitlement.

Here the dominant gap was produced by the metric changing underneath designs that were correct when they were made.

Consolidating workloads onto fewer, denser hosts was the right answer under a per socket model, where additional cores cost nothing in licensing terms, and every serious infrastructure team pursued it.

The move to per core pricing converted that discipline into a shortfall of 20 to 40 percent on exactly the hosts where the discipline was strongest.

The same logic covers the non production estates: disaster recovery and test environments were treated favourably or tolerated informally under the previous arrangements, so nobody built a tracking habit for them, and in 6 of 10 reviews they turned up unlicensed or under licensed.

None of that is a management failure and framing it as one leads buyers to concede more than the facts require.

The practical consequence is that the self audit is not a confession, it is a measurement, and it removed 30 to 50 percent of exposure in our engagements precisely because most of what it finds is correctable rather than culpable.

Run it before the notice arrives, close what can be closed, document the rest with dates, and separate the countable gaps from the commercial floor so that each is answered with the right instrument.

The tightened notice periods make the timing question sharper than it was: the same work produces a materially better outcome when it is done calmly in advance than when it is compressed into a response window. The wider exposure discipline sits in the multi vendor audit response playbook.

Across roughly 30 to 40 Broadcom VMware engagements run between 2024 and 2025, audit exposure clustered in a few predictable places after the move to subscription, and the pattern is consistent enough to be worth planning against:

Three patterns recurred: core counts on high density hosts running 20 to 40 percent above the licensed position because sizing was inherited from the per socket era, disaster recovery and test estates unlicensed or under licensed in roughly 6 of 10 reviews.

And bundle packaging lifting the contracted floor 25 to 50 percent above actual consumption.

The buyer side move is to self audit first, separate the countable compliance gaps from the commercial floor, and produce dated core inventories before a notice period compresses the work. The wider library sits in the Broadcom practice.

Why did the audit exposure rise after the acquisition?

Because the metric changed underneath estates that were already built. Perpetual licensing was retired so every renewal became a re licensing event, and cores replaced sockets as the unit, which turned correct per socket era sizing decisions into shortfalls without anybody touching the estate.

Where does the core count gap concentrate?

On high density hosts, at 20 to 40 percent above the licensed position. Under a per socket model, packing more cores into fewer sockets cost nothing in licensing, so it was the right engineering answer and it was pursued hardest by the best run estates. The per core metric inverted that.

What about disaster recovery and test environments?

They were unlicensed or under licensed in roughly 6 of 10 reviews. Those environments carried favourable treatment or informal tolerance under the previous arrangements, so no tracking habit was ever built.

Their existence is never disputed in an audit, only their entitlement, which makes them cheap to close in advance.

Is the raised contracted floor a compliance problem?

No, and treating it as one wastes effort. A floor 25 to 50 percent above actual consumption is a commercial term rather than a factual dispute, so no amount of inventory evidence changes it. It needs a renewal negotiation, while the core count gaps need evidence. Separate the two at the start.

How much does a self audit actually save?

Between 30 and 50 percent of exposure in our engagements. Most of what it finds is correctable rather than culpable, and dated core inventories settle the majority of disputes in the buyer's favour.

The saving comes from producing that evidence calmly in advance rather than under a compressed notice period.

Have the notice periods changed?

They have tightened, which raises the value of preparation.

The same self audit work produces a materially better outcome done in advance than compressed into a response window, because inventories have to be dated and historical, and a short notice period does not leave time to reconstruct records that were never kept.

Is this a failure of licence management?

Mostly not, and framing it that way leads buyers to concede more than the facts require. The dominant gaps were created by a metric change applied to designs that were correct when they were made and by environments that were previously treated favourably.

That is a measurement problem to fix, not a governance failure to apologise for.