>
Audit Triggers & Prevention
Journal · May 2026 · 7 minute read

Shadow Deployments and Untracked User Growth

Over deployment rarely happens on purpose. It builds up one forgotten test server and one new user group at a time, until the estate IBM can measure is far larger than your records show. Independent, not affiliated with IBM Corporation.

Most over deployment is not deliberate. It accumulates quietly, one development server and one new user group at a time, until the estate IBM can measure is far larger than the estate your software asset records describe. Shadow deployments and untracked user growth are among the most common reasons a buyer walks into an audit already exposed.

How software spreads beyond your records.

IBM middleware is easy to install and easy to forget. A team spins up a Db2 instance for a proof of concept and leaves it running. A WebSphere node is cloned for testing and never decommissioned. Cognos report authors are added without anyone checking the entitlement count. None of this shows up in a procurement system, but all of it shows up in a deployment scan.

Why the gap is invisible until it is expensive.

The danger of shadow deployment is timing. A broken or absent ILMT agent does not just fail to count today's installs, it voids your sub-capacity claim for the entire period it was missing. When the audit lookback runs, IBM can reach back two to five years and charge those shadow instances at full-capacity rates. Untracked growth that felt harmless becomes a multi year back payment.

What this means under audit

If you cannot see an install, you cannot defend it. The buyer side discipline is continuous discovery: scan the estate for every IBM install and every authorized user on your own schedule, reconcile what you find against entitlements, and retire or license the surplus before IBM's data request makes the decision for you. Surprises in an IBM scan are always more expensive than surprises in your own.

Closing the visibility gap.

A defensible posture starts with a complete, current inventory of IBM software and users, not a spreadsheet from last fiscal year. That means ILMT or an approved tool running continuously across the whole estate, deliberate decommissioning of stale test and disaster recovery instances, and a user reconciliation that maps real consumers to real entitlements. The goal is simple: nothing IBM can find that you have not already found and accounted for.

Worried about what a scan would find?
We run the discovery first, reconcile it against entitlements, and build a defensible position before IBM does.
Explore Audit Defense →

The IBM Audit Brief

Audit triggers, ILMT pitfalls, and settlement tactics for IBM software buyers.

IBM Audit

Independent, buyer side IBM software audit defense and negotiation. Not affiliated with IBM Corporation.

Services
Audit DefenseAudit NegotiationILMT RemediationSub-Capacity Defense
Products
WebSphereDb2CognosCloud Pak
Company
AboutContactJournalWhite Papers
Independent. Not affiliated with IBM Corporation.Buyer Side · Est. 2019