Label Security and Database Vault solve different problems, carry different metrics, and are enabled by different teams for reasons that have nothing to do with procurement. This subpage separates the two, quantifies the exposure, and tells you where the leverage sits before Oracle's LMS script arrives.
Label Security and Database Vault solve different problems, carry different metrics, and are enabled by different teams for reasons that have nothing to do with procurement. This subpage separates the two, quantifies the exposure, and tells you where the leverage sits before Oracle's LMS script arrives.
Oracle Label Security (OLS) and Oracle Database Vault (DV) get lumped together because both are database security options, both bolt onto Enterprise Edition, and both light up the same red flags in Oracle's audit scripts. That is where the similarity ends. OLS controls access based on data classification labels (think government clearance levels applied to rows). DV controls what privileged users, including DBAs with SYSDBA rights, can do inside the database. They are separate SKUs with separate price lists, and if you run both you pay for both. There is no bundle discount for solving two different problems.
In 25 years of negotiating Oracle database options, the single most expensive mistake we see is not the license price itself. It is the assumption that a security feature a DBA turned on for good compliance reasons is free. Neither OLS nor DV is free, and the way each gets enabled means procurement almost never knows it happened until the audit. This page tells you where each option sits technically, what each one costs, how Oracle detects them, and what to do before the claim lands. For the wider set of security add-ons, start with our Oracle Database security options licensing guide.
OLS controls data access based on the identity and label of the user and the sensitivity and label of the data. It is a row-level mechanism, and its natural home is government, defence, and intelligence deployments where data carries formal classification levels. Two facts matter commercially. First, OLS is not column aware, per Oracle's own 19c documentation, so it does not solve column-level masking problems (that is Advanced Security's Data Redaction, covered in our Advanced Security Option and TDE licensing analysis). Second, Oracle Virtual Private Database (VPD) ships free with Enterprise Edition and covers many of the same row-filtering use cases. If someone enabled OLS to do something VPD could have done, you paid $11,500 per processor for a feature you did not need.
DV operates at the database layer to enforce access controls that prevent even privileged users, including DBAs with SYSDBA rights, from reaching sensitive application data without explicit authorization. It is a preventive control (it blocks access), not a detective one (it does not log activity for later review, which is the job of Audit Vault and Database Firewall, covered in our Audit Vault and Database Firewall licensing page). DV realms, command rules, and factors are the enforcement primitives. Crucially, DV can be integrated with OLS to provide fine-grained control over labeled schemas and roles, which is exactly the combination that produces two option bills instead of one.
OLS filters rows by classification. DV blocks the DBA. Different problems, different SKUs, and no discount for buying the pair.
There is a material pricing discrepancy across public sources on Database Vault, and you must resolve it against the official Oracle Technology Global Price List before you accept any audit claim. Most sources, including Oracle-facing guides, list DV at $11,500 per processor and $230 per Named User Plus, identical to OLS. One source claims DV at $47,500 per processor (the same as Enterprise Edition itself) and asserts DV cannot be licensed on NUP at all. Those two positions cannot both be right. Our own read, and the weight of multiple sources, supports the $11,500 / $230 figure with a NUP option available, but we flag the conflict explicitly: pull the current price list PDF and confirm the SKU and metric before you sign or settle anything.
| Item | List price (per processor) | List price (per NUP) | Annual support (22%) |
|---|---|---|---|
| Oracle Database Enterprise Edition | $47,500 | $950 | ~$10,450 |
| Label Security (OLS) | $11,500 | $230 | ~$2,530 |
| Database Vault (DV) - majority sources | $11,500 | $230 | ~$2,530 |
| Database Vault (DV) - disputed figure | $47,500 (verify) | not offered (disputed) | ~$10,450 |
Two things about that table. First, support runs at 22% of net license fees per year and Oracle typically escalates it 3% to 4% annually, so the perpetual license number is only the down payment. Second, the DV row is deliberately shown twice because the discrepancy is not academic: if Oracle's claim uses the $47,500 figure and the correct number is $11,500, the difference on a modest estate is measured in seven figures. Do not let an auditor anchor you to the higher number without producing the price list line item that supports it. The full commercial treatment lives in our Database Vault complete licensing guide.
Both options follow the metric of the underlying database license. If the database is licensed per processor, the option is licensed per processor. If per NUP, the option is per NUP with the same minimum. This is not optional and it is not negotiable at the technical level, though the deployment footprint that drives it very much is negotiable before you deploy.
You do not license the cores that use the feature. You license every core on the host, twice if you run both options.
Here is the mechanism that turns a good security decision into an audit claim. DV includes a component called Privilege Analysis, which captures which privileges are actually used so DBAs can strip the ones that are not. This is textbook least-privilege hygiene. CIS Benchmarks recommend it. PCI DSS's least-privilege principle demands it. SOX general IT controls expect it. A security-conscious DBA who runs Privilege Analysis is doing exactly what every framework tells them to do.
The problem: Privilege Analysis requires a Database Vault license to operate. A DBA who enables it as a hygiene exercise, without knowing it is a DV feature, exposes the organization to a license claim for the full duration of the capture period, regardless of whether a single DV realm, command rule, or enforcement policy was ever configured. The security team did the right thing. Procurement never signed anything. Oracle bills anyway. This is the same accidental-enablement pattern we document in accidentally enabled security options, and it is the single most common inadvertent DV exposure we encounter.
The scale can be severe. Public reporting cites enterprises receiving DV audit claims exceeding $2M for modest estates after enabling Privilege Analysis without a license. Whether that figure rests on the disputed $47,500 per-processor price or the $11,500 one, the lesson is identical: a feature nobody in procurement approved becomes a seven-figure line item, and the enforcement capability was never even used.
You cannot manage exposure you cannot see, and Oracle sees more than most teams assume. Both options appear in the standard LMS script red-flag lists alongside Partitioning, Advanced Compression, Advanced Security, and RAC. The detection triggers are worth understanding precisely because they are not use-based, they are presence-based.
The detective mechanics matter for defense. If the DVSYS schema exists but no policies were ever created, and you can prove the option was never used for enforcement, you have a materially stronger negotiating position than an enterprise that ran realms in production for three years. Preserve the evidence: capture screenshots and query outputs before you disable anything, because disabling a feature does not erase its usage history and clumsy remediation can look like concealment. For the broader detection and defense playbook across all options, see our Oracle Database options and packs licensing reference.
The leverage for both options is entirely upstream of deployment. Once the schema is installed or the feature is captured, Oracle holds the cards. Before that point, you decide the footprint, the metric, and whether you needed the option at all. Here is the buyer-side action list.
The blunt summary: OLS and DV are two different products for two different problems, and Oracle charges you for each independently. The financial risk is rarely the sticker price on a deliberate purchase. It is the accidental enablement by a compliance-minded engineer who never spoke to procurement, detected by a script that reads presence rather than use, and priced against a figure you should verify before you concede a dollar. Control who can enable these features, confirm the price list, and confine the footprint. Everything after that is damage control.
Label Security controls data access at the row level based on classification labels, mainly for government and defence use cases. Database Vault controls what privileged users, including DBAs with SYSDBA rights, can do inside the database. They solve different problems, are separate SKUs, and if you run both you pay for both with no bundle discount.
Most sources list both at $11,500 per processor and $230 per Named User Plus, with annual support at 22% (roughly $2,530 per processor). One source disputes this and claims Database Vault is $47,500 per processor with no NUP option. Verify against the official Oracle Technology Global Price List before accepting any audit claim, because the difference is material.
Privilege Analysis is a Database Vault component that DBAs use for least-privilege hygiene, exactly as CIS Benchmarks, PCI DSS, and SOX recommend. But it requires a Database Vault license to run. Enabling it without a license exposes you to a claim for the full capture period, even if no enforcement policy was ever configured.
Both appear in Oracle's LMS audit scripts. Database Vault is flagged simply by the presence of the DVSYS schema, which is created at installation regardless of whether any policy exists. Feature-usage tables like DBA_FEATURE_USAGE_STATISTICS also record historical enablement, so disabling a feature does not erase the evidence.
Often, yes. Virtual Private Database (VPD) ships free with Enterprise Edition and covers many row-filtering use cases that OLS is used for. OLS is not column aware, so it does not replace column masking. If a DBA enabled OLS for row filtering that VPD could handle, you are paying $11,500 per processor unnecessarily.
Both follow the metric of the underlying database license and require full-host coverage, meaning every processor on the server must be licensed, not just the cores using the feature. NUP minimums also apply: a 16-core Intel server (8 processors) triggers a 200 NUP minimum per option. Running both options doubles the count.
The separately-licensed options and packs that ship enabled by default, get switched on with a single click, and become the single largest line item in most Oracle audit findings.
Gated with a work email on the download page. No sales follow up you did not ask for.
Get the White Paper →
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Renewal signals, audit moves, and the levers that work. No vendor spin.
