IBM's Software Estate: Scale and Scope
IBM's software portfolio is one of the largest in enterprise computing. The company maintains over 200 products spanning middleware, databases, integration platforms, AI, security tools, and infrastructure software. This breadth is both a strength and a complexity management headache for CIOs and procurement teams.
WebSphere Application Server remains one of the most widely deployed Java app servers globally, with over 100,000 installations. It's the backbone of banking systems, insurance platforms, and e-commerce infrastructure that can't afford downtime. Db2, IBM's flagship relational database, powers over 400,000 databases worldwide—many of them mission-critical, running 24/7 without failover windows. IBM MQ, the messaging middleware that underpins financial trading floors, supply chain systems, and telecommunications networks, is equally embedded in critical infrastructure.
Then there's IBM i (the renamed AS/400 platform), which still runs approximately 3 million mission-critical business applications across finance, retail, manufacturing, and public sector. Many organisations have decades of RPG and COBOL code running on IBM i, making migration prohibitively expensive. IBM Power Systems, which run AIX and IBM i, continue to dominate the financial services sector. IBM z/OS, the mainframe operating system, is used by 70% of Fortune 500 companies for core banking, insurance, and securities operations.
What this means for support costs: organisations running even a mid-sized IBM estate—three to five major products across multiple versions—face annual support bills in the hundreds of thousands or millions of pounds. This isn't accidental. IBM's Passport Advantage model is engineered to extract maximum lifetime value from installed bases.
How Passport Advantage Works (And Why It's Expensive)
IBM's Passport Advantage (PA) programme is a bundled support and subscription model that locks organisations into a specific cost structure based on Net Licence Value (NLV). Here's how it works:
- Annual Fee Structure: PA charges 20% of NLV as an Annual Software Subscription & Support (SWMA) fee. This is among the highest in the enterprise software world. For comparison, Oracle's ULA model runs 13–16%, and many third-party vendors charge 15% or less.
- NLV Calculation: NLV is determined by IBM's pricing at purchase. However, IBM regularly increases list prices, which means any new licence purchases in your infrastructure push the NLV up—and your 20% annual bill follows automatically.
- Token-Based Licensing: Many IBM products use "tokens" to measure usage. One token typically = one processor core. Sub-capacity licensing allows you to license fewer tokens than you have, but IBM's ILMT (IBM License Metric Tool) monitors compliance. Any discrepancy during audit triggers true-up costs.
- True-Up Obligations: If ILMT detects unlicensed usage, you're liable for back charges. IBM sends auditors annually (or on-demand). Organisations have been hit with six-figure true-up bills after underestimating token consumption.
- Automatic Renewal: PA renews annually by default, with IBM typically applying 3–7% price increases tied to inflation or "market adjustments." There's no negotiation at renewal; you either pay or lose support.
Cost Model Example:
| IBM Portfolio Value | Annual PA Cost (20%) | 5-Year Total Cost |
|---|---|---|
| £500,000 NLV | £100,000/yr | £600,000 |
| £1,000,000 NLV | £200,000/yr | £1,200,000 |
| £2,500,000 NLV | £500,000/yr | £3,000,000 |
| £5,000,000 NLV | £1,000,000/yr | £6,000,000 |
These aren't hypothetical numbers. Organisations with enterprise-scale IBM estates regularly spend £500K–£2M annually on Passport Advantage. Over a decade, that's £5–20M in support costs alone—money that could be reinvested in modernisation, cloud migration, or other strategic initiatives.
The Seven IBM Product Families: What's Covered
Passport Advantage covers IBM's seven major product clusters. Each carries its own support requirements, cost drivers, and third-party alternatives. Here's what you need to know:
WebSphere Application Server / Liberty
Java application server for enterprise integration, API management, and microservices.
Key Issue: High support costs for older versions; WebSphere Java editions facing pressure from cloud-native alternatives.
IBM Db2
Relational database for transactional and analytical workloads. Mission-critical for financial services.
Key Issue: Sub-capacity audit risk; token consumption often underestimated.
IBM MQ
Message-oriented middleware for financial systems, supply chains, and telecommunications.
Key Issue: End-of-support for version 7.x forcing upgrade cycles.
IBM i / AS400
Integrated operating system and platform. Runs 3M+ business applications globally, especially in retail and manufacturing.
Key Issue: High switching costs; trapped by BPCS, RPG, legacy COBOL investments.
IBM Power Systems
Hardware platform (AIX/IBM i) for high-availability infrastructure. POWER10 emerging.
Key Issue: Bundled pricing inflates true cost; "power per frame" licensing adds unpredictability.
IBM z/OS
Mainframe OS and subsystems. Dominates Fortune 500 core banking, insurance, and securities operations.
Key Issue: Limited TPS alternatives; vendor lock-in is near-total.
IBM Security
QRadar (SIEM), Guardium (database security), Verify (IAM), AppScan, and other security tools.
Key Issue: Multi-product bundling; hard to exit individual tools.
Analyse Your IBM Passport Advantage Spend
Get a cost breakdown for your specific IBM estate. Our consultants will audit your NLV, forecast true-up risk, and show you third-party savings potential.
Start Free AnalysisIBM Support: What You're Actually Getting
Passport Advantage includes three support tiers: Standard, Enhanced, and Premium. The differences are substantial, but often buried in IBM's documentation. Here's what each tier delivers:
Standard Support covers problem diagnosis and resolution via email and phone. Response times vary: critical issues get a 1-hour target, but in practice, queuing can add hours. The support language defaults to English; regional support is an add-on. Fix Central is IBM's self-service patch portal, where you download patches yourself and apply them (IBM won't push them). This is the bare minimum.
Enhanced Support adds 24/7 coverage, shorter response times (30 minutes for critical), and proactive health checks via SOAR (IBM's remote diagnostics). IBM's CSP (Customer Service Professional) becomes a named point of contact. The quality variance here is enormous—some CSPs are excellent, others are script-followers with limited troubleshooting autonomy.
Premium Support includes dedicated technical account managers, on-site support availability, and priority bug fix queuing. This is the tier enterprise banks and insurance companies buy, and it costs accordingly (often an additional 40–60% on top of PA).
What PA doesn't cover: new feature development (that's a separate purchase), IBM Cloud migration assistance, planned infrastructure changes, or vendor benchmarking. You also don't get source code access, architectural consulting, or capacity planning—despite paying 20% annually.
PTF (Program Temporary Fix) and iFix delivery is slow. Critical patches can take 4–8 weeks from discovery to availability in Fix Central. IBM doesn't proactively deliver fixes; you discover them by checking the portal or waiting for CSP notification. This is a massive operational difference versus third-party support, which often includes patch automation and testing.
The IBM Passport Advantage Traps
Beyond the headline 20% cost, there are four structural traps embedded in PA that organisations need to anticipate:
Automatic Renewal & Price Escalation
PA renews automatically on anniversary dates. IBM applies 3–7% annual increases without prior negotiation. Non-renewal triggers immediate loss of support—no grace period.
All-or-Nothing Bundling
PA bundles products together. You can't drop individual products mid-contract without losing discounts on the whole bundle. This forces you to keep paying for products you no longer use.
Sub-Capacity Audit Risk
If you license fewer tokens than you're using (sub-capacity), ILMT tracks the gap. IBM audits annually. Any variance = immediate true-up invoice, often in six figures.
EOS Pressure & Forced Upgrades
IBM sets end-of-support dates (EOS) for versions, often 5–7 years out. As EOS approaches, IBM withdraws support for older versions and pressures customers to upgrade. Upgrades are full-cost, not incremental.
Third-Party Support for IBM Software: The Coverage Map
Third-party support for IBM products has matured significantly over the past decade. Multiple vendors now offer full-stack coverage for most IBM product lines, with support quality that often exceeds IBM's own.
TPS Coverage by Product:
| IBM Product | TPS Coverage | IBM PA Cost Save | Key Benefit |
|---|---|---|---|
| WebSphere Application Server | Full stack coverage (8.5–10.0) | 50–70% | Liberty migration time; no forced upgrades |
| IBM Db2 | All LTS versions (10.5–11.5) | 50–70% | Sub-capacity audit protection |
| IBM MQ | 7.x through 9.3 | 50–70% | EOS bridge coverage; no migration pressure |
| IBM i (AS/400) | 7.1–7.5 | 50–70% | BPCS/RPG app continuity; no pressure to modernise |
| IBM Power (AIX) | POWER7–POWER10; AIX 7.2–7.3 | 50–70% | Hardware + OS together; no bundle fragmentation |
| IBM Security (QRadar, Guardium) | Partial (QRadar 7.3+; Guardium 11.x+) | 40–60% | Gradual exit from IBM; reduce bundle dependency |
| IBM z/OS | Very Limited | N/A | TPS options emerging; most orgs locked in |
The coverage is genuine, not workaround. TPS vendors employ former IBM engineers who understand the codebase, know the patch history, and can often diagnose problems faster than IBM's own support. Response times are typically 15–30 minutes (vs. IBM's 1-hour standard), and TPS vendors usually include automated patch testing and deployment.
What IBM Third-Party Support Does NOT Cover
Third-party support is comprehensive, but not unlimited. Here's what TPS explicitly does not cover:
- New Feature Development: TPS vendors don't build new features. If you need features only available in newer versions, you'll need to upgrade (and potentially negotiate new licensing).
- IBM Cloud Migration Assistance: TPS doesn't help you move to IBM Cloud. That's IBM's domain, and they don't want competitors facilitating exits from their cloud.
- z/OS Mainframe Support: Third-party coverage for z/OS is extremely limited. Most z/OS shops remain locked into IBM PA, though niche vendors are emerging.
- New Licence Purchases: TPS covers support for existing software, not the acquisition of new licences. Licence purchases still go through IBM.
- Hardware Failures: For IBM Power Systems hardware, TPS typically covers the AIX/IBM i OS and IBM software running on it, but not the physical hardware. Hardware support usually remains with IBM or an OEM partner.
These are not showstoppers. For most organisations, what TPS covers is sufficient to eliminate IBM PA dependency within 1–3 years.
Sub-Capacity & Audit Risk: What TPS Actually Reduces
One of the most overlooked savings drivers for third-party support is audit risk reduction. IBM's sub-capacity licensing model is intentionally complex, and audit exposure is real.
Here's how the model works: If you license 32 cores for WebSphere (for example), but ILMT detects usage across 40 cores due to load balancing or virtual machine sprawl, IBM considers that unlicensed usage. At audit, you face a true-up invoice covering the discrepancy—usually backdated 12 months. For a £1M portfolio underestimating token usage by 20%, that's an unexpected £200K bill.
ILMT runs continuously and reports monthly to IBM. IBM uses these reports as audit ammunition. The process is designed to find discrepancies; IBM's auditors have financial incentive to report violations.
How TPS changes this: Third-party support vendors don't require token-based sub-capacity licensing. They support stable environments as-is. You don't worry about temporary scaling triggering audit exposure. You remove the ILMT requirement entirely, which eliminates one of IBM's primary audit vectors.
This alone is worth 15–20% cost reduction for mid-sized IBM estates. A £500K portfolio avoiding a potential £100K audit exposure is meaningful financial protection.
Get the IBM Software Licensing Guide
A detailed breakdown of IBM's licensing models, token calculations, and audit exposure. Download the white paper: IBM Software Licensing Guide.
Making the Switch: IBM TPS Implementation
Moving from IBM PA to third-party support is straightforward, but requires careful planning. Here's the typical four-step process:
Step 1: Portfolio Audit and TPS Eligibility. Work with your TPS vendor to audit your current IBM estate. What's running, what versions, what's actually used vs. what's legacy cruft. This typically takes 2–4 weeks. Some products have TPS availability restrictions (z/OS, for example), so this step identifies which portions of your portfolio can move and which remain on IBM PA as a holding pattern.
Step 2: Support Assessment and SLA Mapping. Your current IBM support tiers (Standard, Enhanced, Premium) have specific response times and coverage terms. TPS vendors offer equivalent tiers. Work with the vendor to ensure the SLAs you're moving to meet or exceed IBM's commitments. Document this formally.
Step 3: PA Exit Notice and 90-Day Window. Once you've committed to TPS, IBM requires 90 days' notice before PA cancellation. During this window, you're still paying IBM PA costs, but the TPS vendor is already providing support in parallel. Use this period for knowledge transfer, escalation testing, and confidence building. It's the safest transition approach.
Step 4: TPS Onboarding and Knowledge Transfer. The TPS vendor assigns a support team to your account, conducts baseline architecture reviews, and builds playbooks for your specific environment. This step is critical—it's where TPS vendors prove their depth vs. IBM's generic support model.
Total implementation time: 4–6 months from decision to full PA exit. Most organisations execute this with zero downtime.