You've found exposure. Now what?
Finding out where you stand is step one — see the Guide and calculator for that. Here's how to mitigate your risks.
There's rarely one right answer — it depends on your estate.
Move off Oracle JDK entirely
Replace Oracle's build with a free distribution — Eclipse Temurin, Amazon Corretto, Azul Zulu — that carries no Oracle licensing obligation. For most standard applications this is a drop-in replacement with no code changes, since they all implement the same Java SE specification.
Where it's harder: applications that depend on Oracle-specific commercial features (Flight Recorder, Mission Control, WebLogic integration) may need more work, or may be a reason to isolate rather than migrate those specific systems.
Check Oracle Java Schedule A/B usage
See the Oracle Schedule A/B information — if you are using Oracle products and applications you may already have free usage embedded. Our Risk Review will clarify.
Check for free usage with ISV products
Oracle Java is redistributed with many ISV applications (Independent Software Vendors). In our Risk reviews we highlight these ISVs and what you will and will not need to license.
Accept the subscription, negotiate the terms
Sometimes staying on Oracle Java is the right call — genuine dependency on commercial features, or a small enough estate that the subscription cost is manageable. If so, the subscription itself is negotiable: list price is a starting point, not the final number.
Act before an audit, not after
Negotiating leverage is very different before Oracle has raised the question versus after you're already in a formal audit. Getting ahead of it — knowing your position, having a plan, ideally having already migrated what's migratable — puts you in a materially stronger position than responding to an audit letter cold.
We tell you what's actually running. The path from there is yours to choose.
A Risk Review doesn't prescribe migrate-vs-license-vs-isolate for you — it gives you the evidence-based picture of what's actually in your estate, so whichever path you choose is based on fact rather than assumption. What you do with that picture, and any negotiation or migration support beyond it, is a separate conversation.