The Small and Medium Enterprise Migration to Software as a Service

Ten years ago when our team was developing the Firebox appliance at WatchGuard, we included features common to most firewall solutions of the time. One was the so-called demilitarized network, where customers would securely locate their local web servers. Another was an SMTP proxy for email to protect in-house mail servers. And even though the Firebox was an ‘all in one’ appliance, we asked customers to deploy local servers for logging, reporting and management services.

Later at WatchGuard, when we launched one of the first managed security services platforms for small and medium enterprises, one of the challenges our ISP partners faced was the reluctance of customers to outsource security functions. Our partners told us the concept of storing important information offsite was a frequent objection to buying such a service.

When we met with our first Napera customers in 2006, we found a sea change in attitudes, which has been reflected in the wider market. Companies large and small now outsource many non-core IT functions. Software as a Service (SaaS), managed services and related approaches to outsourcing IT functions are especially attractive to the small and medium enterprise, and we heard this message repeatedly from IT managers.

Examples of this trend abound. Google and Microsoft are signing up thousands of companies to their hosted services for mail, calendaring and collaboration. Managing critical customer information in Salesforce.com is considered normal for many companies. Web hosting, VOIP, payment processing and accounting systems are areas where SME customers have shown a desire to outsource non-core IT. Features designed around the traditional approach of local Web and mail servers are not relevant in this new paradigm. Requiring local management servers also seems very antiquated given the trends we’ve seen in the SME.

A number of factors are driving these decisions in the small and medium enterprise. First and foremost, many SME IT departments face budget pressure to reduce the cost of buying and maintaining hardware and software infrastructure. Several IT managers pointed out to us that they simply didn’t have the rackspace, power or cooling to support more servers, regardless of budget. Many SME’s end up saddled with large enterprise solutions that have been sold into the SME, and they see little added value in features designed for larger companies. In contrast, solutions like Windows Live, Google Mail and Salesforce.com offer an approachable way to solve business problems without the cost and complexity of large enterprise software. Finally, browser technology and bandwidth has improved to the point where providers can deliver services remotely in a secure, on demand fashion.

Network security has not seen as much innovation in this space. The main adoption of SaaS in the SME for security purposes is spam filtering and vulnerability analysis. Perimeter eSecurity is one of the few vendors offering ‘security on demand’. However, the traditional model of security software and appliances is largely unchanged, and the SME move to SaaS appears to have had minimal influence.

The time is ripe for change. When we designed the Napera product line, we saw an opportunity to revolutionize the deployment and management of a security product by leveraging an online service. Rather than just use the Internet to supply updates or patches, could you build the service component as an integral part of the product? Customers had told us they did not want to deploy management servers in their local network. Was this an opportunity to drive a stake through the heart of the old model? Because our appliances are operating at the network level, some level of hardware is required, but much of the processing and storage needed for management and reporting functions does not need to be running on the customer network. Could that concept be expanded to it’s logical conclusion with an appliance that pushes all the management requirements into the cloud?

I’ll write more next week on how we approached the SaaS challenge with the MyNapera.com online service.