Got cease and desist from software vendor claiming we over-deployed licenses - what's my exposure?

I'm the IT director at a 200-person company. We use a specialized CAD software (won't name the vendor). We purchased 50 licenses 3 years ago for $3,000 per license ($150K total).

Vendor just contacted us saying they did a "compliance audit" and found we have 78 active installations. They're demanding we either:

Here's the thing - we definitely have 78 installs, but most are on laptops that people barely use. Maybe 50-55 concurrent users max at any given time. Does that matter? What's our legal exposure here?

First, don't panic. Software licensing disputes are very common and usually settle. But you need to act quickly. Key questions:

• What does your license agreement actually say? "Named user" vs. "concurrent user" vs. "device" licensing?
• How did they discover the 78 installations? Did you consent to an audit?
• Do you have documentation of your 50 license purchase and any communications about deployment?
• Did your license agreement include audit rights?

The concurrent vs. installed users distinction MIGHT matter depending on your license terms, but if the agreement says "50 installations" then concurrent usage is irrelevant.

I pulled our license agreement. It says "Customer may install the Software on up to fifty (50) devices." No mention of concurrent vs. named users.

They discovered it because the software "phones home" for updates and they track activation keys. We didn't consent to an audit - they just emailed us the results of what they found via their telemetry.

The agreement does say they can audit us with 30 days notice, and we have to comply or they can terminate the license.

I work for a software audit firm (we do this for multiple vendors). Here's the typical playbook:

1. Discovery: Vendor's telemetry shows over-deployment
2. Initial demand: Massively inflated number to scare you (the $352K "back licensing" they quoted)
3. Negotiation: This is where 90% of cases settle - usually for current license price × excess deployments
4. Settlement: Rarely more than 1-2x the additional licenses needed

The $352K number is an anchor - they're starting high so the $117K looks reasonable. But you can probably negotiate down to $80-100K if you're willing to remediate immediately smh.

They almost never actually sue unless you ignore them or the violation is egregious (like 500 installs on a 10-license agreement).

SoftwareAuditor_Tom is right about the settlement pattern. But let's talk about actual legal exposure if they did sue:

Copyright infringement claims:

• Statutory damages: $750-$30,000 per infringement (could be 28 works × $30K = $840K in theory)
• Willful infringement: Up to $150,000 per work if they prove you knew
• Actual damages: What they lost (probably the license fees you didn't pay)

Contract breach claims:

• Unpaid license fees
• Interest and late fees if specified in agreement
• Attorney fees if your agreement has a fee-shifting provision

Realistically, they'd pursue actual damages (unpaid licenses) not statutory damages, but the threat of statutory damages gives them leverage. Check if your agreement has a fee-shifting clause - that's often the real cost driver.

The agreement does have a fee-shifting clause - "prevailing party in any dispute shall be entitled to reasonable attorney fees."

I did find one thing that might help us - in 2023, our account manager sent an email saying "you can install on as many devices as needed as long as you stay under 50 concurrent users." We definitely have that email.

Does that verbal/email assurance override the written license agreement?

That email is HUGE. It might not override the written agreement (most license agreements have "entire agreement" clauses that prevent oral modifications), but it's strong evidence of:

• Waiver: Vendor's conduct indicated they wouldn't enforce the 50-device limit
• Estoppel: You relied on their representation to your detriment
• Good faith: You weren't willfully infringing - you had reason to believe your deployment was compliant

This completely changes your negotiating position. They can't claim willful infringement if their own rep gave you permission. And it shows you were trying to comply.

Was the account manager authorized to make licensing decisions? If so, this is even stronger.

I've negotiated hundreds of these settlements. With that email, you have significant leverage. Here's what I'd propose:

Your response (via attorney):

1. Acknowledge the over-deployment but dispute any "willful" infringement
2. Present the 2023 email showing you relied on vendor's representation
3. Immediately remediate - uninstall 28 copies to get to 50 devices
4. Offer to purchase licenses for actual concurrent usage (let's say 55 licenses = 5 additional at current price)
5. Request waiver of "back licensing" fees based on their rep's statements

Total cost: 5 licenses × $4,200 = $21,000 instead of their $117K-352K demand.

Most vendors will accept this because:

• You're remediating immediately (removing their urgency)
• You're buying additional licenses (they make money)
• The email undermines their "back fees" claim
• Litigation would cost them $50-100K and take 2 years

This is incredibly helpful. A few follow-ups:

• Should I respond directly to the vendor or hire an attorney first?
• The 10-day deadline is tomorrow - what happens if we miss it?
• Can I uninstall the software now or does that look like we're destroying evidence?

To your questions:

1. Attorney or direct response? Get an attorney. A lawyer's response signals you're serious and know your rights. Also protects you from saying something that hurts your position. Should cost $2-5K for initial response and negotiation, way less than the $100K+ at stake.

2. The 10-day deadline: It's arbitrary. They're trying to create urgency. That said, don't ignore it completely - have your attorney respond within 10 days requesting an extension to "evaluate your position and gather documentation." Vendors always grant extensions. If you completely ghost them, they escalate.

3. Uninstalling now: DON'T uninstall without documenting first. Take screenshots showing current deployment, save logs, export user lists. Then remediate. You want to prove you had 78 installs (not hide it) but that you immediately fixed it when notified. That shows good faith.

UPDATE: Hired an IP attorney who sent a response yesterday. We:

• Acknowledged 78 installs but disputed willful infringement
• Provided the 2023 email from their account manager
• Documented and remediated down to 50 devices
• Offered to purchase 8 additional licenses at current price ($33,600) to cover our actual peak concurrent usage
• Requested waiver of back fees based on their rep's statements

Vendor responded this morning - they're willing to settle for 10 additional licenses ($42,000) with no back fees. Still negotiating but way better than their initial $117K-352K demand.

Attorney fees so far: $3,500. Worth every penny.