AnswerGFI WebMonitor 2013
The users or IPs connecting after the licence count has been exceeded are not protected.
Note: The users or IPs that connected before the maximum number of users has been passed are still fully protected.
Example: You have a 10 user licence. The traffic for 10 users is filtered by WebMonitor normally. Now the 11th user connects through WebMonitor. As your licence only allows 10 users this 11th user won't be protected any more. The initial 10 users however would still be protected in this case.
GFI WebMonitor 2015 and later
When WebMonitor sees more users / IPs than the license key allows: It will filter them all regardless of the fact that license allows less. However, it will issue an alert in the alerting center on the main dashboard informing the admin of the situation. It will also log telemetry on this enabling sales to follow up on “add-on users” opportunities, or IT to disable the keys if the behavior persists for long periods of time.