A vendor invoice that keeps growing
Your EDR vendor's monthly invoice is larger than last month's again. You provide managed detection to a few dozen clients, each with an agreed number of endpoints on their contract. The vendor bills you on agents installed across your whole tenant. Your billing to clients is fixed at the contracted numbers, reviewed at renewal.
When someone finally reconciles it, the answer is familiar. A few clients have added devices and are well past their contracted count. One client decommissioned a batch of laptops, but the agents were never removed from the console, so you are still paying for them. And a test tenant set up months ago still has seats allocated.
The same pattern repeats with email security, vulnerability scanning and backup licences, each from a different vendor with its own console and invoice.
Nobody set out to give services away. The numbers simply moved while everyone was busy with the security work itself.
Why licence counts drift
- Clients add devices without telling you, and your agents are installed as part of their normal build.
- Decommissioned devices leave stale agents in the console.
- Vendors count seats differently: installed, active in a period, or allocated.
- Each vendor has its own console, invoice and counting rules.
- Client billing is reviewed at renewal, not monthly.
What drift costs
| Drift | Cost |
|---|---|
| Client over contracted count | Service delivered without being billed |
| Stale agents on dead devices | Paying the vendor for nothing |
| Forgotten test or trial tenants | Seats allocated and billed to you |
| No monthly view | Problem found at renewal, months later |
| Awkward catch-up conversations | Clients resist backdated increases |
Margins on managed security services are built on the difference between what you pay per seat and what you charge. Drift eats that difference quietly.
The timing makes it worse. A client who has quietly grown past their contracted count for a year is a hard conversation at renewal: they have become used to the service at the old price, and a backdated increase feels like a penalty. The same growth raised in the month it happened is usually a simple, friendly adjustment.
The licence reconciliation we build
- Seat counts per client are read monthly from each vendor's console by API: EDR agents, email security mailboxes, scanner targets, backup seats and so on.
- Contracted quantities and billing quantities per client are read from your PSA or billing system.
- Each client is compared three ways: seats in use, seats billed, seats contracted. Differences are listed per client and per product.
- Stale agents (devices not seen for a period you set) are listed separately, so they can be removed before they cost another month.
- Seats not linked to any client, such as test tenants, are listed for review.
- The vendor invoice total is compared with the seat counts, so vendor billing errors are spotted too.
Whether and when to adjust a client's billing is a commercial decision under your contract terms. The reconciliation gives you the facts each month, so the conversation is about a small change now rather than a large one at renewal.
Month end with the reconciliation
Finance sees one list per month: clients over their count, stale seats to remove, unlinked seats, and any mismatch with the vendor invoice. Engineers clear stale agents. Account leads raise growth with clients while the numbers are small, in line with the contract. Vendor invoices are checked, not just paid.
Clients generally prefer this too. A monthly note that they have added devices, with the contract terms that apply, is far easier than a surprise at renewal.
A typical month runs like this. The reconciliation runs after the vendor invoices arrive. It shows one client has added a new office's laptops and is over their count, another has a batch of devices not seen for weeks, and a trial tenant from a sales demo still holds seats. The engineer confirms the old devices are gone and removes the agents. Sales close the trial tenant. The account lead sends the growing client a short note and a revised schedule under their contract. It takes an afternoon, not a week.
Recognise this?
- Vendor licence invoices grow faster than client billing.
- Client device counts are checked only at renewal.
- Stale agents stay in consoles for months.
- Test or trial tenants still have seats.
- Each vendor's licences are reconciled separately, if at all.