WASHINGTON, D.C. – Today, the Coalition for Fair Software Licensing, in partnership with cybersecurity firm Prescient, published new research that found a 498% “cyber tax” per security incident levied on small- and medium-sized enterprise (SMEs) businesses from restrictive licensing. Covered exclusively in Politico’s Weekly Cyber newsletter this morning, the report proves for the first time how restrictive licensing creates added costs by locking customers into insecure environments, increasing both cybersecurity risk and the financial burden of mitigating the impact of these vulnerabilities and exploits.
According to the report, legacy software vendors like Microsoft who engage in anticompetitive licensing practices often lock customers into their ecosystem. When that ecosystem is insecure, a cyber tax consisting of direct breach remediation, security upgrades, legal fees, loss of time, and reputational and IP damages is placed on customers. For SMEs using Office 365 and Azure, this cyber tax can be as high as 498% per incident beyond what they pay for Microsoft Office 365 and Azure annually.
“This report outlines what we increasingly hear from customers: that restrictive licensing and cybersecurity risks go hand in hand. When major cyberattacks occur, the question lawmakers, cybersecurity officials, and regulators should ask is not just ‘what happened’ but ‘what role did restrictive licensing play?’” said Executive Director Ryan Triplette.
“Restrictive software licensing practices limit customers’ ability to utilize their preferred vendors and leaves their IT infrastructure vulnerable to attackers. When this vulnerability is exploited, it’s the customers who bear the brunt of costs.”
Other notable findings from Prescient’s report include:
- Since 2021, 30% of CISA-reported vulnerabilities are attributable to Microsoft—more than the next five providers combined.
- Microsoft’s tiered pricing models limit customers’ ability to select the cyber solution best-suited for their organization(s) and leave them susceptible to cyberattacks.
- Many customers find themselves subject to forced upgrades, locking them into their existing cyber solutions. This dynamic also reduces the opportunity for non-legacy providers to break into the market and introduce newer, and possibly more secure, solutions.
The report was prepared in October and November 2023 by Prescient on behalf of the Coalition for Fair Software Licensing. The full report can be found here; a one page overview of the report can be found here.
About the Coalition for Fair Software Licensing
The Coalition for Fair Software Licensing is a North American-based initiative seeking to unlock greater customer choice, innovation, and security in the cloud by advocating for the Principles of Fair Software Licensing. Our members span a cross-section of key industries, including healthcare companies, financial services businesses, as well as cloud and cybersecurity providers – each one has experienced or been exposed to anticompetitive and abusive software licensing practices in the cloud. Together, we are taking a stand against these predatory practices by advocating for the Principles of Fair Software Licensing to ensure more choice, innovation, and security in the cloud. To learn more about the Coalition for Fair Software Licensing, please visit FairSoftwareLicensing.com.