The largest enterprise application vendors are using their entrenched positions among customers to end discounting and push high-margin AI products, an analysis by Forrester Research has warned.

A study of recent Q2 2025 earnings announcements by the tech research biz found the message from major enterprise software players was clear: “The era of experimentation is over, and the era of monetisation has begun,” the report states.

Vendors under the microscope in the study include Oracle, SAP, Workday, Microsoft, ServiceNow, and Salesforce. The analysis found that the promise of weaving AI agents into user workflows – a plan common among vendors – would only be fulfilled if organisations are also willing to invest in “the unglamorous work of process redesign.”

“The barrier they create is less about the AI’s intelligence and more about the monumental organisational effort to retrain your workforce on new workflows,” Forrester adds.

But it comes at a cost. Adopting such a strategy “dramatically increases vendor lock-in and the strategic risk of your choice,” the analyst warns. Vendors are attempting to “re-bundle” their products as they encourage customers to view their collection of products as a “platform of platforms.”

For example, SAP told investors that it was shifting from a supplier of on-prem enterprise applications to a suite of SaaS and cloud services. In 2020, then CFO Luka Mucic said the move was “increasing customer lifetime revenue” with the subscription model and not only providing software and support services, but also the IT infrastructure and operational services in many cases. “We are effectively expanding our share of the wallet,” Mucic said.

Forrester has warned tech buyers that the bundling process is standard among enterprise software vendors of SAP’s scale.

“This is a vendor-led campaign to capture the highest percentage of your technology budget,” the report says. “While consolidating to a primary platform can yield efficiencies, it also concentrates risk and neuters your negotiation leverage. Your next major software decision is a bet on a single vendor’s security posture, pricing model, and innovation capacity for the next decade.”

The research found that Oracle’s most recent results showed Big Red was winning with its strategy of pushing both Oracle Cloud Infrastructure (OCI) and its Oracle Cloud Applications business, under the Fusion branding.

“Oracle’s focus is to tighten the integration between OCI and Fusion Apps, enabling customers to run mission-critical workloads and AI services in a secure, high-performance environment. The narrative of a complete, integrated cloud from infrastructure to applications is compelling for CIOs who seek to reduce complexity. However, this ‘one-stop shop’ approach represents a strategic trade-off,” the study adds.

“Before committing to a wall-to-wall Oracle stack, you must perform rigorous due diligence on data portability and multi-cloud integration capabilities; most importantly, you must negotiate contractual protection against future uncompetitive pricing and commercial inflexibility.”

Observers might note that the latter part is easier said than done. Across the board, enterprise software vendors are trying to embed AI agents in their products. But it comes with a commercial trade-off.

For example, last year, while mulling the charging model for AI, Salesforce CEO Marc Benioff answered investor concerns that the number of per-seat licenses might fall as the CRM giant’s customers use AI to cut headcount. As he mooted charging $2 per AI agent conversation, he assured investors it would be “a very high margin opportunity” for Salesforce.

Forrester says it saw a similar trend across enterprise application providers. “Vendors are leveraging their entrenched positions to end discounting and push high-margin AI SKUs,” the report claims. “A best-practice response to this is implementing a rigorous FinOps practice to manage consumption, demand transparent pricing, and build business cases based on tangible outcomes, not vendor promises.”

It’s not just software vendors that see AI as an opportunity to skew commercial arrangements. In February, distributor data from research firm Context showed Microsoft Copilot+ PCs were priced 57 percent higher than the average price of a notebook across Europe in the final three months of 2024. That’s €1,120 ($1,160) versus €712 ($738). The research also noted weak demand for AI-enhanced PCs.

Flexera has launched a new SaaS Management solution that enables organisations to identify their SaaS footprint and AI tool usage across the organisation. Flexera One SaaS Management, the organisation claims will improve visibility for shadow AI and help organisations better manage spend, compliance and security. This is a next-generation solution that combines Flexera and Snow SaaS Management, the company it acquired in February 2024. With increased visibility across their software technology landscape, organisations can mitigate risks and save costs.

Those risks are especially high with the unauthorised use of AI tools. According to a recent report by IBM (Cost of a Data Breach), one in five organisations have suffered a breach because of issues with “Shadow AI”. Each attack costs organisations an estimated $670,000 on average. That cost is higher than those organisations with little or no shadow AI. In total, 13% of organisations reported breaches that involved AI tools, 97% of those organisations “lacked proper AI access controls.”

Flexera argues that it all starts with visibility. If you cannot see what is used, how do you protect against it? Visibility of software in use actually fell last year. According to the Flexera 2025 State of ITAM Report, 43% of respondents believe they have complete visibility across software assets. This is down from 47% the previous year. It demonstrates the need for a more holistic SaaS visibility and management solution. Flexera One SaaS Management aims to be that Solution.

Brian Shannon, Chief Technology Officer at Flexera, said, “The rapid adoption of AI is reshaping the SaaS landscape, introducing new challenges like shadow AI. Enterprises are struggling with SaaS sprawl, the demands for stricter oversight and governance in the age of AI.

“Our unified Flexera One SaaS Management solution addresses these shifting challenges, especially as businesses integrate AI more strategically. With this launch, we’re redefining advanced SaaS optimisation and reinforcing our leadership in the SaaS management market.”

Flexera has integrations into a range of commonly used applications for further insights, including AWS, SAP, monday.com, Oracle, Microsoft, ServiceNow, Adobe Creative Cloud, Salesforce, and many more. Those integrations can ingest license agreements – giving organisations a more holistic view of licensing costs and usage and enabling them to identify redundancies.

The tool will identify emerging AI tools and self-subscribed applications that IT may be unaware of. It will surface information about hidden usage, access points and risks; as well as providing advanced insights into underutilised licenses or features, and downgrades app tiers based on actual usage.

With security and governance, especially around AI, high on the agenda for many firms, Flexera aims to enable IT departments to enforce security policies, better manage user access, and gain better control over the environment and spend.

Clare Tonkin, Head of Software License Management at Thames Water. “Before Flexera, our SaaS management was fragmented and manual, making even routine tasks like audit preparation and license reconciliation extremely time-consuming and resource-intensive.

“Flexera has transformed our approach, providing near real-time visibility and a unified data model. This has eliminated blind spots, accelerated risk mitigation, and replaced guesswork with confidence, allowing us to move from reactive to proactive governance.”

When Indian energy giant Nayara Energy sued Microsoft on Monday for cutting off all paid-for services with no notice, it highlighted a relatively new risk for CIOs to worry about.

This goes beyond a vendor not delivering what it was supposed to, or outages that halt services. It raises the ugly scenario of a major partner deliberately cutting off services to an enterprise for any of a wide range of reasons.

In this instance, the cut-off was sought by the European Union (EU), in an attempt to pressure Russia to back off its assaults on Ukraine. But what if the requester was a government that just didn’t like what an enterprise said or did? What if the vendor itself was upset with the customer?

One extreme defensive move for an enterprise would be to implement full redundancy for anything not hosted on-premises. Redundancy for data protection is relatively straightforward, but having multiple email, supply chain, or e-commerce services is very expensive and disruptive. What are the odds that it would even be needed? Whatever those odds were, they just became much higher.

“[This is going to require] new tabletop exercises where you go through these new scenarios,” said Erik Avakian, technical counsellor at Info-Tech Research Group and former longtime CISO for the Commonwealth of Pennsylvania. “It is now prudent to have this type of disaster recovery resilience.”

Avakian added that many enterprises are already, to varying degrees, dealing with data redundancy, but duplicating apps and other executables is much more challenging. “Duplication of executables conversations are not [yet] happening,” he noted.

In a statement released along with the lawsuit filing in India, Nayara said that the litigation is occurring because Microsoft imposed an “abrupt and unilateral suspension of critical services. Microsoft is currently restricting Nayara Energy’s access to its own data, proprietary tools, and products — despite these being acquired under fully paid-up licenses. This decision, based solely on Microsoft’s unilateral interpretation of recent European Union (EU) sanctions, sets a dangerous precedent for corporate overreach and raises serious concerns regarding its implications on India’s energy ecosystem.”

Microsoft did not wish to comment, but its move was presumably in response to an EU regulation that called for “further restrictive measures.”

Some industry observers and analysts said that moves like this may require new contractual wording, but not everyone agreed.

Cameron Powell, a technology attorney with the law firm Gregor Wynne Arney, said Microsoft might have considered the contract valid, but simply calculated that it would cost them more money to defy the EU. That means that Microsoft might then have to compensate Nayara.

In other words, a good contract may get the enterprise its money back, but not necessarily the needed services.