The exhaustion principle is a legal doctrine stating that once a software copy is lawfully sold, the right to control further distribution of that specific copy may be exhausted, depending on the license and jurisdiction. In practice, it can affect whether an organization may resell used perpetual licenses, transfer entitlements, or challenge restrictions in vendor contracts.
In cyber security and enterprise IT, this matters because software rights are part of asset management and compliance. Security teams, procurement staff, and legal teams may need to prove where a license came from, whether it was transferred correctly, and whether records support a lawful resale or audit response. Attackers rarely exploit the doctrine itself, but disputes over exhaustion often surface in licensing fraud, unauthorized resale marketplaces, and litigation where emails, contracts, and deployment records become evidence. Strong documentation helps defenders verify entitlement and reduce legal and operational risk.