Forrester on Java license management: what the analysts say

For most of Java’s history, software asset management analysts barely mentioned it. Java was background infrastructure — a free runtime that shipped everywhere and cost nothing to think about. That has changed completely. Analyst firms including Forrester now routinely flag Oracle Java SE as one of the highest-risk line items in an enterprise software estate, and the advice they give maps closely onto what disciplined software asset management has always recommended. This guide summarises the recurring analyst position on Java license management, and translates it into something an enterprise can actually act on.

Why analysts talk about Java now

The reason Java moved onto the analyst radar is a sequence of Oracle licensing changes that turned a free runtime into a paid, audited product. The retirement of the old Binary Code License free updates, the introduction of the Oracle Technology Network licence for newer releases, the No-Fee Terms and Conditions licence for current versions, and — most consequentially — the January 2023 shift to an employee-based subscription metric all combined to make Java a commercial risk where it had been a non-event.

Analysts notice when a previously ignored product starts generating audit claims and unbudgeted spend. Java now does both. The analyst commentary — whether it carries a Forrester, Gartner, or other research badge — converges on one observation: enterprises are carrying Java licensing exposure they have not measured, because they are still treating Java the way they treated it a decade ago.

The recurring analyst themes

Strip the branding off the various analyst notes on Java and the same handful of themes appear every time. They are worth stating plainly because they form a usable checklist.

• Java is no longer free by default. Whether a given Java deployment costs money depends on the vendor, the version, the release date, and the use case. Assuming “Java is free” is the single most common and most expensive error.
• Visibility is the first problem. Most enterprises cannot say how many Java installations they run, which vendor each came from, or which licence governs each one. You cannot manage what you have not measured.
• The employee metric changes the maths. Oracle’s subscription is priced on total employee headcount, not on Java usage. That decouples cost from consumption and makes the financial exposure far larger than intuition suggests.
• OpenJDK alternatives are mature. Analysts consistently note that free, production-grade OpenJDK distributions exist and that migration is a legitimate strategy, not a compromise.
• Audit risk is real and rising. Oracle actively reviews Java deployments. Analyst guidance treats audit preparedness as a standing requirement, not a reaction.

Java as a managed asset

The central recommendation that runs through every credible analyst note is deceptively simple: treat Java like any other licensable software asset. That means Java belongs inside your software asset management discipline alongside databases, middleware, and operating systems — not in an unmanaged category labelled “developer tools” or “free runtimes.”

In practice, treating Java as a managed asset has four components. First, a complete inventory — every Java installation across servers, desktops, virtual machines, containers, and cloud instances, with its vendor and version recorded. Second, licence attribution — for each installation, the governing licence (Oracle subscription, OTN, NFTC, or a free OpenJDK build) identified. Third, ongoing governance — a policy that controls how new Java instances are introduced so the inventory does not drift. Fourth, a deliberate sourcing decision — a conscious choice, revisited periodically, about whether each workload should run paid Oracle Java or a free alternative. Analysts present these as the baseline, not the advanced state.

The employee metric and analyst risk warnings

If there is one Oracle Java change that analyst commentary singles out, it is the employee metric. Under the Java SE Universal Subscription introduced in January 2023, Oracle prices the subscription on an organisation’s total employee count — a definition that includes full-time staff, part-time staff, temporary workers, agents, and contractors. The price applies whether 5% or 95% of those people ever touch Java.

Analysts flag this for a specific reason: it breaks the intuitive link between usage and cost. An IT leader who reasons “only a few teams use Java, so our exposure is small” is applying pre-2023 logic to a post-2023 metric. A 5,000-employee organisation faces a list-price subscription in the region of $900,000 a year even if Java runs in a single department. The analyst warning is consistent: model the employee-metric cost explicitly before assuming Java is cheap, because the gap between the assumed cost and the real one is where unbudgeted spend and audit settlements live.

Turning analyst guidance into a programme

Analyst notes describe the destination; they rarely hand you the route. Turning the guidance into action means running a short, structured programme rather than a one-off cleanup. A workable sequence looks like this:

1. Discover. Scan every environment — physical, virtual, container, cloud — and produce a raw list of Java installations.
2. Attribute. For each install, record vendor, version, release date, and the governing licence. Separate Oracle binaries from OpenJDK distributions.
3. Quantify. Model the Oracle employee-metric cost and compare it against the cost of migrating affected workloads to a free distribution.
4. Decide. Choose, workload by workload, whether to license with Oracle or migrate. Document the rationale.
5. Govern. Put a policy in place so new Java instances are introduced under a known licence, and re-scan on a fixed cadence.

This is the same loop analysts recommend for any high-risk software category. The only Java-specific wrinkle is the speed of the licensing changes — which is why the “govern” step and the periodic re-scan matter more for Java than for slower-moving products. Our 20-point Java compliance checklist and continuous compliance guide expand each of these steps.

Tooling, SAM, and discovery

Analysts are realistic about tooling: software asset management platforms help, but none of them solves Java licensing on their own. A SAM tool or discovery scanner can find Java installations and report versions, which addresses the visibility problem. What tooling cannot do reliably is interpret the licence position — deciding whether a given Oracle binary is covered by a paid subscription, falls under OTN or NFTC terms, or sits unlicensed depends on contractual and usage context the tool does not see.

The analyst-aligned approach is to use discovery tooling for what it is good at — comprehensive, repeatable detection — and to bring licensing judgement to the interpretation. Beware in particular of relying on Oracle’s own usage data or scripts to assess your position; that data is collected by the party that benefits from a higher number. An independent, evidenced inventory built from your own tooling is the asset that protects you. Our guide to Java discovery and scanning tools covers the practical options.

Why independent advice still matters

One point analyst research tends to make implicitly that is worth making explicitly: the source of Java licensing advice matters as much as its content. Oracle’s own representatives and Oracle-partnered resellers have a structural interest in a larger Java subscription. Analyst firms are independent of that incentive, which is part of why their guidance is useful — but analyst notes are general, and your situation is specific.

The practical implication is to pair general analyst guidance with specific, independent, buyer-side advice. An adviser with no Oracle partnership has the same independence as the analyst, plus the engagement-level depth to apply it to your contracts, your inventory, and your renewal. That combination — the framework from the analysts and the execution from an independent specialist — is what turns a research note into a lower bill.

Getting independent help

The analyst consensus on Java license management is clear and, by now, well established: Java is a managed, licensable asset; visibility is the first task; the employee metric makes the cost larger than it looks; OpenJDK alternatives are real; and audit risk is permanent. None of that is controversial. The gap, for most enterprises, is between knowing the guidance and operating it.

Closing that gap is what independent, buyer-side Java advisers do. Across 340+ Java engagements, that work — building the inventory, modelling the employee-metric cost, deciding workload by workload, and governing the result — has contributed to more than $180M in client savings and a 68% average reduction on the audit claims that did arise. Our Java Compliance Assessment builds the analyst-recommended inventory and licence position, our Continuous Java Management service runs the ongoing governance loop, and our Audit Defence service, backed by a money-back guarantee, defends a Java audit if one arrives.

Frequently asked questions