What to do in the first 60 days after a Brocade SAN audit notice.

The Brocade SAN audit notice in 2026 arrives at a different shape than the Symantec or Carbon Black audit notices, because the Brocade installed base is structurally different. Brocade SAN is a hardware plus software plus support contract, and the audit is run against the entitlement across all three layers. The audit team is small (the Brocade audit cycle runs at a lower volume than Symantec or Carbon Black) but the audit team is technically deep and works against a port count and feature licence model that has a long history of drift in customer environments. A typical Brocade SAN installed base has been through one or two refresh cycles since the original entitlement was negotiated, and the audit team is reading against the current deployed fabric, not the original entitlement. The exposure ranges we are seeing on Brocade audit notices in 2026 sit between 9 and 31 percent of the residual support contract value at opening position, and settle between 3 and 14 percent at closed position. The sixty day response window is longer than the Symantec equivalent (which sits at thirty days) because the underlying reconciliation is deeper and the audit team is structurally less time pressured.

This is the audit note on what to do in the first sixty days after a Brocade SAN audit notice arrives. Two thirty day phases. The first phase is mapping. The second phase is settlement.

Days one to ten: read the entitlement, not the fabric

Read the original Brocade entitlement before reading the deployed fabric. The entitlement defines the port count, the feature licences (Fabric OS feature codes, ISL trunking, encryption, virtual fabric, advanced performance monitoring), the support tier, and the geographic scope. The deployed fabric defines what the customer is actually running today. The audit notice is about the gap between the two. The buyer who walks into the audit knowing only the deployed fabric is reading the audit team's evidence without a counter reference. The buyer who walks in knowing the original entitlement can read the audit team's evidence as a reconciliation, not a finding.

The entitlement is rarely in one document. It sits across the original purchase agreement, the support contract, the feature licence keys (which carry an embedded entitlement), and the renewal recap. Pulling the four documents together inside the first ten days is the single most useful work a buyer does in a Brocade SAN audit.

Days eleven to twenty: build the port count and feature reconciliation

Build the reconciliation across port count and feature licences in the second week. The port count reconciliation is straightforward in principle and complex in practice. Refresh cycles have typically swapped Brocade directors for higher density platforms, and the entitlement has often not been amended to reflect the swap. The new platforms may carry more ports than the entitlement covers, fewer ports than the entitlement covers, or a different mix of port types (16G, 32G, 64G) than the entitlement was written against. Each of those produces a different exposure or credit.

The feature licence reconciliation is more nuanced. Feature licences are bound to specific switches by serial number. Refresh cycles often leave feature licences stranded against decommissioned switches. The audit team will count the feature licences against the deployed fabric. The buyer should count the feature licences against the entitlement and identify any that have been stranded by decommissioning. A stranded licence is a credit position, not an exposure.

"The Brocade audit is about the gap between the entitlement and the fabric. The fabric is what the buyer sees every day. The entitlement is what the buyer signed. Most teams spend sixty days defending the fabric. The closes happen on the entitlement."Brocade Practice Lead, The Desk

Days twenty one to thirty: file the response framework

File the response framework at the end of the first month, not the response itself. The framework is a written document that proposes the structure of the buyer's response (what data the buyer will supply, what reconciliation the buyer will perform, what timing the buyer requires for each item). The framework is a negotiation move. It sets the buyer's response on the buyer's structure, not on the audit team's structure. The audit team almost always accepts the framework with minor amendments, because the audit team is paid against closure rate and a framework that defines a closure path is structurally welcome.

The framework should also propose a single point of contact on the buyer's side (typically the head of storage infrastructure or the CIO's chief of staff) and a defined cadence for the next sixty days (typically a weekly update with monthly milestones). The framework converts the audit from an open ended enforcement into a managed reconciliation.

Days thirty one to forty five: engage the support renewal in parallel

Engage the support renewal team in parallel with the audit response. The support renewal is the commercial surface that the audit exposure will settle against. The audit exposure can be settled in three ways: as a separate one off payment against the existing paper, as an embedded uplift on the next support renewal, or as a written amendment to the entitlement that captures the deployed state without a back exposure. The third option is rarely offered by the audit team but is regularly available if the buyer engages the support renewal team in parallel.

The support renewal team is paid against the support contract value and has an incentive to roll the audit exposure into the renewal at a discount. The audit team is paid against the back exposure and has an incentive to settle the exposure rather than push it into the renewal at a discount. The two teams have different incentives and the buyer who engages both in parallel can negotiate against the gap.

Days forty six to sixty: close the settlement

Close the settlement in the last fifteen days of the sixty day window. The settlement should define three things. The exposure value (in dollars), the settlement vehicle (separate payment, embedded uplift, or amendment), and the entitlement amendment that captures the deployed state prospectively. The third item is the most important. Without the prospective amendment the same exposure will return at the next refresh cycle. With the prospective amendment the entitlement is current and the audit cycle resets.

The numbers

What we have seen on live deals this quarter

On a recent engagement with a global logistics operator the audit notice arrived against a Brocade SAN installed base that had been through two refresh cycles since the original entitlement. The deployed fabric was running on 32G platforms against an entitlement written for 16G. The audit team's opening exposure was 24 percent on port count and feature licences. We rebuilt the reconciliation against the original entitlement, identified seven stranded feature licences against decommissioned switches (which constituted a credit position of roughly 9 percent), and proposed a prospective amendment that captured the 32G deployed state with a defined refresh allowance. The closed exposure landed at 6 percent net of the credit position, with a prospective amendment that the audit team accepted in writing.

On a separate engagement with a Fortune 500 manufacturer the buyer had responded to the audit notice on day one with a fabric inventory but no entitlement reconciliation. The audit team produced a finding against the fabric without a counter reference. The closed exposure landed at 17 percent. The same engagement with the entitlement reconciliation in place would have closed below 8 percent.

The takeaway

• Read the entitlement before the fabric. The audit is about the gap between the two. The original purchase agreement, the support contract, the feature licence keys, and the renewal recap together form the entitlement. Pulling them into one reference in the first ten days is the single most useful move.
• File a response framework at day thirty, not the response itself. The framework sets the audit on the buyer's structure and almost always closes a sixty day extension. Stranded feature licences against decommissioned switches regularly constitute a 4 to 11 percent credit position against the opening exposure.
• Engage the support renewal in parallel. The audit team and the support renewal team have different incentives. A prospective amendment that captures the deployed state is the best close and is regularly available if both teams are engaged.