By Yair Knijn · July 17, 2025

The IT director who budgeted per seat, then got billed for every contractor laptop that ever roamed

She did the responsible thing. Took the HR headcount of 420, padded it to 450 to be safe, and signed a per-seat web-filtering deal. Finance loved the clean number. Eighteen months later the renewal landed at almost double, and nobody could explain it, because the line item didn't say "seats." It said active devices, and the count was 760.

The mistake wasn't the padding. It was treating "seat" and "device" as the same unit. They are not, and the gap between them is exactly what endpoint-filtering vendors meter.

Why per-seat and per-device counts diverge fast

A seat is a person. A device is anything that enrolled, checked in, and got a config pushed to it. One employee with a corporate laptop, a personal phone on the network, and a VDI session is one seat and three billable devices. When auditors inventory the estate ahead of a subscription move, they routinely surface more virtual machines than IT believed existed, plus connected endpoints that were never licensed at all.

It compounds because device records are sticky. A laptop reimaged six months after it enrolled can persist as two identities, unless the count definition collapses them.

The roaming, contractor, and reimage multipliers

Three populations blow up the count, and all three are the ones a per-seat budget ignores by design:

• Roaming devices that check in from outside the office still register as active, so the laptop a salesperson opens twice a quarter counts the same as a daily driver.
• Contractors and seasonal staff who churn through projects. Offboarding is supposed to happen the day a contract ends, but the billing record often outlives it.
• Reimaged machines that mint a fresh device ID on every rebuild, so an aggressive refresh cycle or a VDI golden-image rollout inflates the count without adding a single human.

None of these show up on the org chart. All of them show up on the true-up.

Read the true-up and overage clauses before you sign

Find the clause that defines the billable unit and read it like it owes you money. Two questions decide the renewal: what event makes a device "count" (first check-in, last 30-day activity, or ever-seen), and when does the meter reset. A definition built on "any device that has ever checked in" never resets, so churn only ever adds. A 90-day-active definition forgives the contractor who left in March.

Then check the annual escalator. Endpoint subscriptions from the larger vendors commonly carry a fixed percentage uplift baked into multi-year terms, on top of any count growth. Stack that on an ever-seen count and a flat headcount turns into a doubled invoice, no obviously bad decision required.

Right-size policy groups to control billable count

You control the count by controlling what enrolls and what stays enrolled. Put contractor and BYOD devices in their own policy group with a short activity window, then reconcile it against the offboarding feed monthly instead of waiting for the annual audit. Identities you reap in March don't show up in next January's true-up.

The same discipline applies to reimaging. If your tooling can match a rebuilt machine back to its prior identity by hardware fingerprint, the reimage stops minting a phantom device.

Negotiate a count definition you can actually forecast

Price is negotiable, but the count definition is what you live with. Ask for trailing-30-day-active as the billable unit, a cap or banded tier so a seasonal spike doesn't trigger a permanent step-up, and a written reconciliation cadence so de-provisioned devices leave the count on your schedule, not theirs. A number you can model from your own MDM dashboard beats a discount you can't forecast.

ClearScreen counts enforcement against the devices in each policy group, and a tenant can scope a short-lived contractor group separately from a corporate-standard one, so the volatile population stays visible and reapable instead of silently accruing. The full count definition lives on the pricing page, not buried in a renewal addendum.