The container is the licensing unit nobody priced. The renewal prices it twice.

Cloud Workload Protection and Container Security were sold into infrastructures that did not look like the infrastructures the original contracts assumed. The original paper used a host based unit. The current deployment runs on ephemeral workloads and container counts that move by the minute. The seller's audit team has settled on a way to count that, and the buyer's contract does not always describe it the same way. The gap is the negotiation.

The default renewal quote tends to apply the new unit to a workload count that has not been reconciled against the contract definition. Buyers who arrive without an independent map find themselves agreeing to a number that looks reasonable on the surface and that prices the same workloads on two different unit definitions inside the same contract.

The audit trigger is new. Cloud Workload audits in 2025 and 2026 are arriving on a pattern that did not exist eighteen months earlier. The notice usually asks for a workload reconciliation across a window that predates the buyer's current observability tooling. The defense begins with an independent count, runs against the contract definition, and produces a settlement that closes the audit and resets the renewal in one engagement.

The work begins with a current workload and container map. The map runs against the contract unit definition, against the audit team's working count, and against the deployment as it actually stands. The differences are the line items.