The Java audit defence, a fixed sequence and one voice
Everything here assumes the contact has already happened. The sequence is fixed, and the only real variable is how much of it you complete before you say anything substantive: buyers who reach week four with evidence are negotiating, and buyers who reach week four with questions are being priced.
Prepared by Redress Compliance · August 7, 2026 · Oracle advisory. Based on 30 to 40 live Java audit and questionnaire responses run 2024 to 2025.
Executive summary
The first month sets the ceiling. Across our live responses, the outcome tracked the discipline of the first month far more closely than the size of the estate: every engagement that leaked a number early spent the rest of the process arguing down from that number rather than up from evidence.
The first reply, sent inside five days, contains process and nothing else: acknowledgment, one named contact, the scope and clause requested in writing, and no numbers, no access, no call.
Evidence built before Oracle sees anything closes faster.
Days 6 to 20 run discovery and the roster review in parallel: every host that can carry a runtime swept, the vendor string and version recorded per host, the dated roster pulled with defended exclusions written down, and new Oracle downloads frozen.
Expect surprises: sweeps routinely found Oracle builds on 15 to 35 percent of hosts the buyer believed ran a free distribution, and never run Oracle supplied discovery before your own, because it answers more than the question asked.
The count is the multiplier, so it gets attacked first. Under employee metric pricing the population is the bill, and contractor and outsourced populations are the largest recoverable dispute in almost every engagement.
The reconciliation gap concentrates in three places, population, classification of Oracle builds versus free distributions, and the retroactive period, and each is named explicitly rather than arguing the total.
The endgame is commercial, and the evidence converts there. Three to six months from notice to signature is normal, the account team leads the close, and the finding is the opening price, not the final one.
A defensible count plus an isolated Oracle footprint removed 30 to 60 percent of the claim, and a costed migration plan moved the final number in about three of four cases, including cases where the buyer never intended to execute it.
The sequence, from notice to signature
Acknowledge, then build
The process only reply inside five days, then discovery and the roster in parallel: vendor strings per host, defended exclusions written down, downloads frozen.
Frame, then reconcile
One short counter position document with sources attached, then the gap worked in writing across its three homes: population, classification, and period.
The commercial close
The account team leads, the finding is the opening price, and the shape, full subscription, narrow subscription, or funded exit, is decided by you first.
You send conclusions, not raw data. A dated discovery export scoped to Java runtimes is evidence; a CMDB dump, an agent console login, or an unbounded roster is a gift.
The counter position document is short and boring by design, scope, method, findings, what is licensable and why, what is not and why, and the number that follows, because leading with what you can prove forces Oracle to react to your frame instead of the reverse.
One voice, and the briefing that protects it
Every message in and out goes through one named owner, because the most expensive sentences in a Java audit are said by people who were never briefed.
Legal speaks to the clause and scope only; procurement enters at the commercial stage without ever naming a budget; HR supplies the dated roster to the owner and speaks to nobody; engineers answer the owner, not Oracle; and the executive who received the letter acknowledges and refers.
The riskiest conversation is not the audit call but the routine account review where a friendly Java question gets a friendly answer, and the cheapest control in the entire response is one paragraph sent to every plausible recipient: if anyone from Oracle raises Java.
Forward it to the owner and reply to nothing.
The trigger patterns that precede the letter are catalogued in the audit triggers analysis, and the enforcement machinery behind it in the GLAS versus LMS review.
The Java audit defence brief
The full response sequence: the reply templates, the evidence pack structure, the population disputes that recover most, and the settlement shapes compared.
Get the white paper →Taking the count apart, where the money recovers
The employee metric makes the population the multiplier, which is why the count is attacked before the rate: contractor and outsourced populations, defended with the reason for each exclusion written down at roster time, are the largest recoverable dispute in almost every engagement.
Classification recovers next, Oracle builds versus free distributions decided by the vendor string per host, not the product name in a spreadsheet, with supplier delivered appliances pushed to the supplier's own terms.
Period closes the set: how far any retroactive element reaches, on what evidence, with the burden of proof never volunteered.
The pricing arithmetic the disputes feed into sits in the Java pricing analysis, the migration alternative in the OpenJDK comparison, and the Java calculator prices your own position in minutes.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Java audit responses, 2024 to 2025
Across roughly 30 to 40 live Oracle Java audit and questionnaire responses Fredrik Filipsson ran or advised in 2024 and 2025, three patterns held:
Engagements that leaked a number early argued down from it for the rest of the process, without exception.
Buyers who sent dated, scoped discovery closed materially faster, because Oracle had less to reinterpret.
The settlement mechanics reward the same preparation: decide the shape first, full subscription, a narrow subscription over an evidenced core, or a funded exit, rather than letting the number on the table choose it.
Attach the close to your renewal calendar, because settling Java inside a larger renewal usually buys more than settling it alone; negotiate the term, the escalator cap, and the right to reduce the count when the workforce falls, worth more than the headline discount.
And refuse any start date you cannot evidence, because a backdated term is a retroactive claim wearing a different hat.
The wider audit doctrine sits in the Oracle audit defence playbook and the Java audit guide.
Your first five moves
- Send the process only reply inside five days: one contact, scope and clause requested in writing, no numbers, no access, no call.
- Run your own discovery before anything of Oracle's, vendor string per host, dated, across everything that can carry a runtime.
- Pull the roster and write down the exclusions now, contractors and outsourced populations defended with reasons, at roster time.
- Brief the whole organization in one paragraph: anything Java from Oracle forwards to the owner, and nobody else replies.
- Cost the migration plan whether or not you will run it, because it moved the final number in three of four cases. The Oracle practice runs the sequence with you.
Frequently asked questions
How should we respond to an Oracle Java audit letter?
Inside five days, with process and nothing else: acknowledge receipt, name a single contact everything routes through, request the scope and the contractual clause in writing, and propose your own schedule.
No numbers, no system access, no call as the primary channel, and nothing attached, because every early concession narrows what the later stages can recover.
How long does an Oracle Java audit take?
Three to six months from first formal contact to signature is normal: the ceiling is set in the first four weeks, the reconciliation runs through roughly day 60, and the commercial close occupies the last eight weeks with the account team leading.
The finding is the opening price in that close, never the final one.
Should we run Oracle's discovery tools?
Never before your own: Oracle supplied discovery answers more than the question asked, and you cannot take the answer back.
Run your own sweep first, recording the vendor string and version per host across servers, desktops, containers, build agents, and appliances, and send dated, scoped conclusions rather than raw access.
How much can a Java audit claim be reduced?
A defensible count plus an isolated Oracle footprint typically removed 30 to 60 percent of the claim in our responses, and a costed migration plan moved the final number in about three of four cases, including where the buyer never intended to execute it.
The recoveries concentrate in the population, the classification, and the retroactive period.
Who should talk to Oracle during a Java audit?
One named owner, in writing, and nobody else: legal on the clause and scope only, procurement at the commercial stage without naming budgets, HR supplying the roster internally, engineers answering the owner.
The most expensive sentences in a Java audit are said by unbriefed people in routine conversations, so the one paragraph briefing to every plausible recipient is the cheapest control.
What is the biggest recoverable dispute in a Java audit?
The population: under the employee metric the count is the multiplier, and contractor and outsourced populations are the largest recoverable dispute in almost every engagement, provided the exclusions are documented with reasons at roster time.
Classification of hosts running free distributions, proven by vendor string, recovers next.
