I think the core of your question is which software can be used for free (that is, using the software does not directly cause a license that costs money to be consumed). To be precise, you can generally assume that all this software is almost certainly only ever able to be used according to some license (unless you are Oracle and actually own the IP of the software), but often that license will not directly cost money.
It is likely that you will find most applications that are classified in the ARL as a "component" do not on their own consume a license that costs money. That isn't to say there won't be exceptions to that rule, but they will be exceptions rather than the rule.
An underlying question behind this may be how to work out where your biggest compliance risks are. Some pragmatic considerations that might be helpful for that are:
- Focus on your biggest vendors (Oracle could well be in that list)
- Focus on software that is expensive
- Focus on software that is widely used
- Focus on where your knowledge of your organization tells you there may be risk and exposure - what does the organizational scuttlebut tell you?
- Use concrete data from the ARL to drive focus areas - look for large installation counts, and applications that are classified as "Commercial"
(Did my reply solve the question? Click "ACCEPT AS SOLUTION" to help others find answers faster. Liked something? Click "KUDO". Anything expressed here is my own view and not necessarily that of my employer, Flexera.)
