① Product · Broadcom (CA) Top Secret
Broadcom (CA) Top Secret protects every access decision on the systems it guards, which makes it operationally sticky and a reliable target for renewal increases. It is licensed on capacity, and the gap between contracted capacity and the MSU you actually run is where the negotiation lives.
Broadcom (CA) Top Secret is an external security manager (ESM) for z/OS, one of the three that guard the platform alongside CA ACF2 and IBM RACF. It controls authentication and authorization for every protected resource: data sets, transactions, programs, and the access decisions that sit under regulated workloads in banking, insurance, and government. Because it stands in the path of all of that, it is among the least removable products on the mainframe, which shapes everything about how it is priced and renewed.
Top Secret is licensed on the capacity of the environment it protects, not on users or rules. Historically that was a MIPS based entitlement fixed at contract signature. Broadcom has been moving its CA mainframe portfolio onto Mainframe Consumption Licensing (MCL), which meters against MSU consumption rather than a static contracted figure. Both models track the size of the machine, so the controlling question at renewal is whether the capacity you are billed for still matches the estate you actually run, and how a move to MCL would meter your specific environment.
| Attribute | Detail |
|---|---|
| Product type | External security manager (ESM) |
| Metric | Mainframe capacity (MIPS, or MSU under MCL) |
| Legacy model | Contracted MIPS set at signature |
| Current direction | Mainframe Consumption Licensing (MCL), MSU metered |
| Removability | Very low; ESM migration is a security project |
Confirm which model your contract sits under before renewal; MIPS and MCL meter differently and the transition itself is negotiable.
The base driver is contracted capacity. If the entitlement was set when the estate was larger and never adjusted, the bill carries capacity the business no longer uses. The second driver is the renewal uplift itself: since the CA acquisition, Broadcom renewals have commonly carried substantial increases and multi year commitments, and a product as embedded as Top Secret gives the vendor confidence to ask. The third is bundling. Top Secret often renews inside a portfolio agreement covering several CA products, where a single capacity figure and a single uplift can obscure what each component actually costs.
Top Secret exposure is mostly about capacity reconciliation rather than feature sprawl. Common traps we see at pattern level:
Where exposure hides
Top Secret is sticky, so the leverage is built from data and timing rather than the threat of a quick exit. The five that pay:
Buyer side levers
The three external security managers, Top Secret, CA ACF2, and IBM RACF, are functionally interchangeable but not casually swapped. Migrating between them touches every protected resource, every rule set, and every integration, and it is a security program with real risk, measured in quarters not weeks. That said, it is the one genuine alternative, and a serious migration plan can be both a long term cost strategy and a negotiation backdrop. The discipline is to make the alternative real enough to matter: a costed, resourced path carries weight at the table, while a bluff does not.
Sticky does not mean unnegotiable.
Metric explainers: Broadcom Mainframe Consumption Licensing (MCL) and MIPS explained. Sibling products: Easytrieve licensing and CA Dispatch licensing. Hub and commercial: the Broadcom buyer side guide and Broadcom audit defense.
Audit notice or renewal under 18 months out? We mobilize within 48 hours.