Oracle Java audit defense tactics. How to challenge the employee count and settle for less.

Oracle Java audits price your employees, not your installs. You cut the claim by testing who counts, scoping the licensed entity, separating free and non Oracle builds, and showing Oracle a costed exit to a third party JDK.

This page covers the tactics. For the wider picture, read it alongside the Java audit guide, our Java audit defense service, the Java audit risk assessment and the Oracle audit response playbook before you reply to Oracle on a Java letter.

How does an Oracle Java audit differ from a database audit?

An Oracle Database audit counts installs, processors and users against the licenses you hold. A Java audit under the 2023 Java SE Universal Subscription counts employees. That single change alters what you argue about, what evidence matters and how the claim can close.

On a database audit, most of the work goes into proving what runs where. On a Java audit, the install data still matters, but mainly to decide which license applies to each install and whether you need Oracle at all. The price itself comes from your headcount.

Where does the Java audit take a different route?

• The metric is per employee. Under the Universal Subscription your headcount sets the price, whatever the number of installs.
• Older contracts still apply. Named User Plus and Processor subscriptions signed before the 2023 change keep their own terms for the life of the order.
• You can leave. Several free OpenJDK builds can replace Oracle Java in production. Oracle Database has no equivalent drop in replacement.
• The first contact is often commercial. Many Java cases open with an email from Oracle's Java sales team about downloads, well before any formal audit notice. Oracle's audit team, long known as LMS, now operates as GLAS, and our note on GLAS and LMS covers what that changed for Java enforcement.

Which Java license applies to which install?

Java licensing has three layers, and the date of each build decides which one applies. Your response has to place every install in the right layer before any headcount conversation starts.

How does the Oracle Java employee metric work, and where can you dispute it?

The Universal Subscription counts every employee in the licensed entity, not only the people who use Java. Oracle's price list defines employees as your full time, part time and temporary staff, plus the same staff at agents, contractors, outsourcers and consultants who support your internal business operations.

That definition is wide, but it has edges. The two places to test it are the entity boundary and the phrase about supporting your internal operations. We cover contractor cases in more detail in how contractors and consultants are counted.

How do you scope the licensed entity?

The legal entity named in the order decides who counts. In a group with separate operating companies, the subscription can sometimes be scoped to one entity, provided the others run no Oracle Java or have already moved to another build.

Read the group legal structure before you agree any employee number. Oracle's opening figure often comes from public headcount data, such as the group annual report, which may not match the entity that signed the contract.

What does entity scoping do to the price? A worked example

Say a group has 5,000 employees, including 600 agency contractors, and all of its Java runs in one operating company of 1,200 staff. The rates below are assumed for illustration. Oracle publishes a starting price of $15 per employee per month and tiers as low as $5.25, so check the current price list for your band.

The smaller count sits in a higher price band, which is why the assumed rate rises. Even so, scoping cuts the annual figure by $457,200 in this example. The contractor dispute alone is worth $75,600 a year, and both numbers repeat for every year of the term.

How should you control Oracle's Java scripts and install data?

Limit what the scripts touch and keep your own copy of everything they produce. Oracle's Java scripts record every install, its version and the download history, and the default reading assumes each install is paid use. Your job is to narrow the scan and then contest how each result is read.

1. Limit the script targets. Start with production servers. Developer laptops are usually scoped out. Agree that in writing before anything runs.
2. Keep the raw output. Store the script logs yourself so your analysis does not depend on Oracle's summary.
3. Find the free use cases. Match installs against the No Fee Terms and Conditions (NFTC) license and older BCL builds.
4. Find the non Oracle builds. Temurin, Corretto, Zulu and other OpenJDK builds carry no Oracle fee, so pull them out of the count before Oracle prices it.
5. Date each install. Builds released before April 2019 may carry the older BCL, which allowed general purpose use at no charge.

Before you quote any number back to Oracle, read the NFTC terms against your install inventory and list the builds that need no subscription. Record the exact update number for each, because the license changes partway through a release.

How do you check which Java you actually run?

Build a first inventory with tools you already have, before Oracle runs anything.

• Version strings. The output of java -version names the vendor. Oracle builds report "Java(TM) SE Runtime Environment", while Temurin, Corretto and Zulu name themselves.
• The release file. Most JDK installs carry a release file in the Java home folder with an IMPLEMENTOR line.
• Package managers. On Linux, rpm -qa and dpkg -l filtered for jdk or java list installed packages. On Windows, installed programs list Oracle Java under the Oracle publisher.
• Container images. Scan your registry for base images that bundle an Oracle JDK.
• Bundled runtimes. Many applications ship their own JRE, which may be covered by the application vendor's license.

Be careful with Oracle's own Java Management Service. It is useful, but it runs on Oracle Cloud Infrastructure, so the inventory it collects is held on Oracle's own platform. Decide what Oracle sees before an audit starts.

Which third party Java distributions can replace Oracle Java?

Eclipse Temurin, Amazon Corretto, Azul Zulu, the Microsoft Build of OpenJDK and Red Hat's OpenJDK are all production grade Java builds. Each ships under the GPL version 2 with the Classpath Exception, which allows free commercial use. Migrating a single application environment typically takes 6 to 12 weeks.

Moving off Oracle Java stops future subscription fees. It does not by itself settle a claim for past use, which is a separate negotiation. Our comparison of Corretto, Temurin and Zulu covers the choice between builds.

How do Oracle Java audits usually settle?

Java audits close in one of three ways: a scoped Universal Subscription, a true up under a legacy metric, or a full exit to a third party JDK. Which one fits depends on how widely you deploy Java, your cloud plans and how much vendor support you still need.

• Scoped Universal Subscription. A smaller entity in scope, a lower employee count and a capped term.
• Legacy metric true up. Available where an older Named User Plus or Processor subscription is still running.
• Third party JDK exit. A full migration off Oracle, with the audit closing on a small back invoice or at zero.

We compare how each structure plays out over a full term in Java settlement structures compared. If a legacy order is in play, read how to renew on the legacy metric first.

Why a costed exit plan matters even if you plan to renew

Build a documented, costed and dated plan to move to a third party JDK, even if you expect to stay with Oracle. Once Oracle's account team sees a plan with a budget and a cutover date, the settlement figure usually falls, the subscription scope narrows and the renewal price is easier to hold.

Oracle prices a Java settlement against your alternatives, so the cheapest renewal usually belongs to the customer who could leave.

Should you sign the Universal Subscription quickly to make the audit go away?

Many teams are advised to accept Oracle's first Universal Subscription quote because signing ends the audit. We disagree. The first quote usually carries the whole group headcount, and the count you accept becomes the base for every renewal. Signing early also removes the exit plan from the table before it has been priced.

Take the time to scope the entity, test the contractor count and cost the exit. Then decide whether to sign, and on what count.

What will Oracle's Java team say, and how should you reply?

The same few lines come up in most Java cases. Each has a factual reply.

• "Our records show Java downloads from your company." Ask for the records, with dates and versions. Downloading a build does not mean you deployed it, and builds released under the BCL or NFTC need no subscription.
• "Your contractors count, so add them to headcount." Ask Oracle to show which contractors support your internal business operations. Agency staff and managed service teams often do not, and your contracts are the evidence.
• "You have to move to the Universal Subscription." Oracle's own FAQ says legacy subscribers may renew to the extent their existing order permits, subject to confirming that usage matches the licensed counts. Point to your order.
• "Sign now and we will waive past use." Ask for the waiver in the order, naming the period and every entity it covers. Then compare the total against the cost of your exit plan.

Which Java subscription clauses should you red line?

Red line any clause that widens future audit scope or fixes the employee count for the whole term. These six carry the most weight.

Six clauses to change before you sign

• Employee definition. Tie the definition to your group HR boundary so the count cannot drift to cover every related company.
• Audit window. Limit future audit scope to the licensed entity, so the next review cannot reach the rest of the group.
• True up frequency. Annual at most. A quarterly true up turns every hiring spike into an immediate bill.
• Termination for convenience. Keep the right to leave at renewal, which is what makes a later exit plan credible.
• Use rights for legacy installs. Preserve the BCL rights on builds released before 2019, so old installs stay free.
• Close letter. Get an explicit close of the named audit period, so the same years cannot be reopened.

What have we seen in recent Java audit settlements?

Most of the Java audits we handle close as a smaller Universal Subscription than Oracle first proposed. The reduction comes from the entity scope, the contractor count and the installs that turn out to be NFTC, BCL or non Oracle builds.

Patterns that repeat across cases

• Mixed builds. Oracle's first findings letter tends to treat every Java install as paid Oracle use, and sorting the inventory by vendor is usually the first place the count drops.
• Missed free use. Most enterprises miss the NFTC use case in the findings letter until someone reads the terms against the inventory.
• Cloud already moved. Workloads in AWS and Azure often run Corretto or the Microsoft Build of OpenJDK already, which shrinks the Oracle footprint once they are mapped.

The customers with a credible exit path reach the lowest commercial outcomes, whether they renew or leave.

How Redress runs a Java audit engagement

We run Java audit defense as a managed engagement from the Oracle notice through to settlement. The work covers script scope, the install inventory, NFTC identification, a third party JDK assessment, the employee count dispute and the close letter wording.

Our white paper, The Oracle Java Audit Defence Playbook, sets out what the Universal Subscription costs in 2026 and how customers push back.

• Ongoing Oracle support. Vendor Shield and the Renewal Program cover the years after the audit closes.
• Price checks. The Benchmark Program and Benchmarking test a Java quote against what comparable customers pay.
• Wider spend review. The Software Spend Assessment looks at Java alongside your other vendors.

If a Java claim sits inside a wider Oracle agreement, the Oracle ULA decision framework covers that side. You can read about us, meet the management team, see our locations or contact us directly.

What to do next

1. Acknowledge the notice in writing. Do it the day it lands, and hold the timing of any script run until scope is agreed.
2. Pull the install inventory. Sort it by environment, by version and by use case.
3. Score the third party JDK fit. Mark which workloads have a production grade replacement.
4. Define the licensed entity. Compare your group HR boundary with the full corporate structure Oracle will assume.
5. Identify the NFTC use cases. List the free Java 17 and 21 LTS builds, with their update numbers.
6. Cost the exit path. Put a timeline and a budget against each environment.
7. Choose the route. Scoped subscription, legacy true up or exit, based on the numbers above.
8. Close the audit period. Get the waiver and the close letter in writing before you pay.

Frequently asked questions