Transparent Data Encryption and Data Redaction both require the separately licensed Advanced Security Option, and Oracle enforces it with no usage threshold. This is where your encryption mandate becomes a six-figure license liability, and where you push back.
Transparent Data Encryption and Data Redaction both require the separately licensed Advanced Security Option, and Oracle enforces it with no usage threshold. This is where your encryption mandate becomes a six-figure license liability, and where you push back.
The Oracle Advanced Security Option (ASO) is a separately licensed add-on to Oracle Database Enterprise Edition. It bundles two data-protection capabilities that most compliance teams assume are baked into the database: Transparent Data Encryption (TDE) and Data Redaction. Neither is available under base Enterprise Edition, and neither ships inside any Oracle support contract or on-premises cloud tier unless you have explicitly bought ASO. That single fact is the root of most exposure we see.
The list price is $15,000 per Processor or $300 per Named User Plus (Oracle Technology Global Price List). On the Japan Yen list the same option carries 4,650,000 per processor and 61,380 per Named User Plus (Oracle price list, June 1, 2026), which confirms the option is priced globally at the top tier alongside partitioning and diagnostics. Add 22% annual support on top, and factor Oracle's typical 8% annual support escalation into any multi-year model. For a broader view of where ASO sits among the paid packs, see the Oracle Database security options licensing guide.
One clarification that matters: from Oracle Database 19c onwards, native network encryption and TLS are free in Enterprise Edition and no longer require ASO. Strong authentication (Kerberos, PKI, RADIUS) is also no longer part of the option. So if a vendor rep or an internal architect tells you that encrypting traffic requires ASO, that is outdated. The bill is now driven entirely by data-at-rest encryption and redaction, not encryption in transit.
Network encryption is free from 19c on. The Advanced Security bill now comes entirely from TDE and Data Redaction, the two things a compliance mandate forces you to turn on.
ASO is required the moment you invoke any of the following. There is no grace for testing, no free tier, and no exemption for regulatory necessity. The features that require the option are:
The subtle traps here are the export and backup paths. Teams license ASO for production TDE but forget that encrypting a Data Pump export or an RMAN backup on an otherwise unlicensed server pulls that server into scope too. If you encrypt backups on a dedicated backup host, that host now needs ASO. For the question of whether Key Vault adds a further line item, read is Oracle Key Vault free or a separate license.
This is where costs escalate beyond what most buyers expect. ASO cannot be licensed independently of the database it protects. Oracle's rule is strict: if your database is licensed per Processor, ASO must be per Processor, and the quantities must match exactly. If your database is per Named User Plus, ASO must be per Named User Plus at the same or greater user count. You cannot license ASO on fewer processors than the database runs on, even if TDE is enabled on a single tablespace on a single instance.
Read that again, because it is the single most expensive clause in the option. Encrypting one column on a 32-core cluster obliges you to buy 16 processor licenses of ASO (assuming an Intel 0.5 core factor), not one. The blast radius of the license follows the database footprint, not the encryption footprint. This is the same logic buyers get caught by with Oracle Advanced Compression, where a single attribute triggers full-processor exposure.
The Named User Plus path is not the escape hatch it looks like. Oracle's standard minimum of 25 NUP per processor still applies to the option. On a 4-core server (2 processors after core factor), you owe at least 2 x 25 = 50 NUP of ASO, and larger cores drive that higher regardless of how many humans actually touch the encrypted data. On a small user base NUP can beat Processor, but run the arithmetic against the minimum before you assume it.
The numbers below are from Oracle's published list and from documented deployment examples. Discounts of 20% to 50% are common at negotiation, but list price is what Oracle uses to size an audit settlement, so it is the number that matters for exposure calculations.
| Environment | ASO perpetual (list) | Annual support (22%) | Notes |
|---|---|---|---|
| 1 processor | $15,000 | $3,300 | Minimum single-processor unit |
| 4 processors (4-core EE server) | $60,000 | $13,200 | Documented compliance-only deployment |
| 20 processors | $300,000 | $66,000 | Mid-size estate lower bound |
| 100+ processors | $1.5M | $330,000 | Large estate upper bound |
Put that in context: a fully-optioned Enterprise Edition stack including Advanced Security lists at $122,000 per processor, and a 16-core Intel server carrying that stack lists at $976,000 with $214,720 per year in support (Atonement Licensing, August 2025). ASO is a meaningful slice of that. The problem is rarely the price of the option in isolation; it is that the metric-matching rule multiplies it across your entire licensed footprint whether or not you use encryption everywhere.
You do not pay for the columns you encrypt. You pay for every processor the database runs on. That is the clause that turns a compliance checkbox into a six-figure liability.
There is no usage threshold for ASO. Oracle does not require that a feature be actively or meaningfully used. One encrypted column, one TDE-enabled tablespace, or one encrypted export is enough to trigger the full license requirement across the matched metric. Marketing shorthand puts it bluntly: one unlicensed column triggers full audit exposure. That is not an exaggeration; it is how the contract reads.
Detection is automated and intent-agnostic. Oracle's audit scripts query the DBA_FEATURE_USAGE_STATISTICS view on every database in scope. That view records first-use date, last-use date, and usage count for every option, including TDE, whether the feature was invoked deliberately, accidentally, historically, or by a default configuration setting. Once recorded, it persists. The output goes to Oracle's LMS team and is cross-referenced against your entitlements. There is no honest-mistake defense inside the tooling. If you turned it on once in 2021 for a proof of concept, the view still knows.
ASO non-compliance appears in roughly 40% of Enterprise Edition environments reviewed in audit, making it the third most common database option gap behind the Diagnostic Pack and Tuning Pack. If you have not proactively checked your own DBA_FEATURE_USAGE_STATISTICS output across every instance, assume you are in that 40% until proven otherwise. For the mechanics of how an option you never bought ends up flagged, see accidentally enabled security options.
Cloud is where ASO exposure is created silently. Oracle Autonomous Database on OCI includes ASO features (TDE, Redaction, Vault, Label Security, Masking) by default, and BYOL customers on Autonomous are entitled to use TDE. That sounds generous, and for OCI it is. But it is an OCI-specific commercial provision, not a change to on-premises licensing policy.
Here is the trap. When you create a database in the Cloud, the ENCRYPT_NEW_TABLESPACE parameter is often set so tablespaces are encrypted automatically. If you later bring that database back on-premises, or clone it into a BYOL environment on AWS EC2, the tablespaces are already encrypted, and you now need an ASO license you may never have intended to buy. Oracle's own admin guide flags this scenario explicitly. On AWS EC2 the rules mirror on-premises: Standard Edition cannot use TDE at all, and Enterprise Edition BYOL can use TDE only if ASO is licensed. AWS provides no managed equivalent to OCI's included-TDE tier. For the full BYOL picture, see Oracle Database on AWS.
The pattern to internalize: TDE enabled by a cloud default is still TDE. DBA_FEATURE_USAGE_STATISTICS records it the same way it records a deliberate ALTER TABLESPACE. Migrations create the exposure, and organizations discover it only when Oracle audits.
If your driver is a regulatory encryption mandate rather than a performance need, the first question is whether you need Enterprise Edition plus ASO at all. Standard Edition 2 does not include TDE, so SE2 alone will not satisfy a data-at-rest requirement using native Oracle encryption. But it may satisfy it through storage-level or volume-level encryption outside the database, which sits entirely outside Oracle's license scope. For what is and is not possible on the cheaper edition, see security options on Standard Edition 2.
Where you are already on Enterprise Edition, the strategic move is to confine TDE to the smallest defensible database footprint so the metric-matching rule multiplies against fewer processors. Consolidating encrypted workloads onto dedicated, smaller-core servers can materially cut the ASO count. This is the same discipline the encryption compliance without overbuying analysis works through, and it belongs in your architecture review before the mandate forces a hurried decision. For the broader estate-wide moves, the CIO playbook for Oracle licensing optimization covers option rationalization and metric switching.
Treat ASO as an active liability, not a dormant option. The concrete steps, in order of urgency:
The leverage point in any ASO negotiation is that Oracle's compliance demand is driven by a rule (metric matching, no threshold) that most buyers never agreed to knowingly. That does not make it unenforceable, but it does mean settlement scope is negotiable, especially where usage was a cloud default rather than a business decision. Establish your own facts first, then negotiate from evidence, not from Oracle's script.
Yes. TDE at column, tablespace, or full-database level requires ASO on Oracle Database Enterprise Edition. It is not included in base Enterprise Edition or in any Oracle support contract. The only exception is OCI Autonomous Database, where ASO features are included as a commercial provision specific to that platform.
It lists at $15,000 per Processor or $300 per Named User Plus, plus 22% annual support. A 4-processor Enterprise Edition server needs $60,000 in ASO licenses and $13,200 per year in support. Large estates of 20 to 100-plus processors reach $300,000 to $1.5M at list before discount.
No. ASO must match the database license metric and quantity exactly. If your database is licensed on 16 processors, ASO must also be 16 processors, even if TDE is enabled on a single tablespace on one instance. This metric-matching rule is what turns a small encryption footprint into a large license bill.
Yes. Both Data Redaction and TDE are bundled into the single Advanced Security Option. Buying ASO covers both features. There is no separate, cheaper redaction-only license, so enabling either one triggers the full option requirement at the matched metric.
No, not since Oracle Database 19c. Native network encryption and TLS are free in all licensed editions, and Kerberos, PKI, and RADIUS authentication are no longer part of ASO. Only data-at-rest encryption (TDE) and Data Redaction still require the option.
Oracle audit scripts query the DBA_FEATURE_USAGE_STATISTICS view, which records first-use date, last-use date, and usage count for TDE on every database. It logs usage regardless of intent, including accidental, historical, or cloud-default activation. The data persists and is cross-referenced against your entitlements during an audit.
Oracle Exadata can lock you into full core licensing across X9M, X10M, and Cloud at Customer. The buyer side strategy to size the platform and cut the bill.
Gated with a work email on the download page. No sales follow up you did not ask for.
Get the White Paper →
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Renewal signals, audit moves, and the levers that work. No vendor spin.
