The math, on real findings.

An insurer received a Documentum finding built on a named seat count that swept in service accounts, integration users and long dormant logins as if each were an active consumer. Repository sprawl across several business units made the raw headcount look far larger than genuine usage. We reconstructed the effective license position from entitlements, then rebutted the count line by line, separating real consumers from machine and dormant identities. The finding fell from $7.2M to $1.6M, a 78 percent reduction. The detail of this work lives in our ECM and Documentum audit defense.

A technology company faced a Fortify finding that counted everyone with repository access as a licensable developer seat, including reviewers and pipeline service accounts that never submitted a scan. We mapped the population that actually ran static analysis and showed that the licensable seat is defined by scan submission, not repository visibility. The finding fell from $4.5M to $0.9M, an 80 percent reduction. This is the core trap addressed in our Fortify and AppSec audit defense.

A bank received an ArcSight finding priced against peak events per second and a raw connector count. The vendor measured momentary bursts as if they were the sustained throughput the license is sized to. We documented sustained EPS separately from short lived spikes and reconciled the connector inventory against what was actually deployed. The finding fell from $6.0M to $1.8M, a 70 percent reduction. The approach is set out in our ArcSight SIEM security audit defense.