StillSecure, After All These Years

Monday Potpourri

There are some days where nothing strikes me as interesting enough to blog.  Than there are days like today where there are just too many things that I find compelling enough to comment on.  So rather than do 4 or 5 posts today, let me condense all of this goodness (I hope) into one post:

1. Sophos releases "financial results ahead of analysts expectations". While I applaud the Sophos folks for making public their revenue numbers (at least gross, net and deferred totals it seems), I am not sure what analysts they are talking about.  As a private company, it is not like people are trading their stock and the financial analyst crowd is putting their numbers on the street.  200+m is a lot of revenue, even for an AV company and 40+m to the bottom line is impressive, but until you are public, no one is holding your feet to the fire and analyst coverage is just not the same.

Authors note: Dr. Jan Hruska, co-founder of Sophos wrote me off line and gave me permission to publish this comment: 2. Apple is ready to enter the platform war - Larry Dignan over at ZDNet has some good comments and stats on Apple vying with Microsoft and Linux/open source to be "the platform" of the future. I agree that the iPhone and iPod are Trojan Horses into the enterprise and along with the Mac represent a viable platform that could compete with Microsoft and the Linux/open source crowd.  However, I don't think you can judge how many developers are developing Mac/iPhone apps based on the crowd at the upcoming WWDC (worldwide developer conference).  Steve Jobs is a master showman and I think these conferences have become media events.  Many people are there to to twitter and report and to "be there".

In October last year we prepared for a float on the London Stock Exchange. As a part of the exercise we had analysts from the three sponsor banks produce their projections for revenue etc for the next three years. We did better that their projections for 2007/08.

Larry is right though that Apple has to balance being too iPhone and iPod crazy at the risk of ignoring the "real" platform here the Mac.  His example about PGP developing a Mac version is a great point.  I have heard many other security companies likewise bringing Mac versions to market. This graphic I think shows the point well:

  But my ultimate point on this one is that the ultimate platform will be the web.  What the underlying OS is for future web apps should be somewhat meaningless.  The webtop platform would seem to me to be the platform going forward!

In any event the WWDC should be a lot of fun and I will be watching to see if any new reports come out.

3. Belden buys Trapeze - Another independent WLAN provider gets bought. Doesn't seem like a great multiple, 133m on 2007 revenue of 56m.  There are not many independent WLAN providers out there now.  Meru Networks is probably the biggest of the bunch. You don't hear too many people saying that wireless is not here yet anymore.

4. McAfee still chasing the dragon on security ROI - McAfee announced that using the Forrester Economic Impact Calculator you can now easily find out your ROI from buying a McAfee product. They have a very nice diagram that I have pasted in here. They ask you to plug in a few numbers about type of security you want, desktops, laptops and servers and presto - they give you an ROI.  I didn't call them to get the scoop, but it really underwhelmed me.  Looks like smoke and mirrors to me, just like many of these security ROIs do.

Cloud computing - I want my cake and eat it too

Its easy to dismiss Don Dodge's asking "Do you really want your data in the cloud" as a Microsoft guy defending their turf. Don uses some recent uptime problems at Amazon, Twitter, Disqus and Typepad to show that keeping your information in the cloud and relying on the net to deliver your applications gives you less control, less security, less scalability and less reliability.

Don has a point, even though net access and SaaS services are much more mature than they were in the past, there is always the times when it does not work. For that matter, cell phones, blackberries, and cable TV don't always work either. An indication of how vital something has become is how much we miss it if it is not available. But to the point, I remember when the personal computer first came into being. The idea of your data and the applications being "portable" to your device was revolutionary. The idea of keeping your data on those big floppy discs was so empowering. But even than, problems accessing data on a disk or an application not behaving or security problems could render you just as frustrated on your non-networked device as an Amazon or twitter being down does now.

Ultimately I think these things go in cycles and we are entering a centralized cycle now. However, I think this turn of the cycle could be different. Never before has net access been so ubiquitous. Never before have we seen the depth of optimized applications for the net. The infrastructure is finally in place to recognize the dreams of many of "thin clients" and net terminals. But I think the best model is a hybrid model. I like the Microsoft solution where I can work on stuff online and off line on my computer, than sync up later. Ultimately when it comes cloud versus local computing, I want my cake and eat it too.

Been there, done that and have the T-shirt and scars to prove it

Matt Hines over at InfoWorld has an article up on the inevitability of software as a service becoming more prevalent. I don't want to rain on anyones parade and I do believe we will see more SaaS, but there are a few things in this article that bear correction and comment.  So here are my three biggest lies about SaaS.

1.SaaS is the way to sell "security by subscription. That is the title of Mat's article, "Security by subscription".  The fact is the companies Matt mentions, Symantec, McAfee and Trend have been selling security by subscription for years. They don't need SaaS to do so.  In my definition subscription is when you buy their AV or similar product and if you don't re-up at the end of the license period you stop getting updates.Without the updates the software is useless.  Over the years the entire AV industry moved to this model including Microsoft when they entered the market.  In fact they automatically renew your subscription and it can be a pain to get them to stop.  So though SaaS is one way of selling security by subscription it is not the only way or even the dominant way. It is not novel or a particularly big driver for the SaaS model.

2. SaaS is cheaper with a better ROI.  I say bull crap to this. Another company I helped create was called Interliant and we were one of the top 3 ASPs back in the day.  We did a ton of analysis on this and I can tell you that while SaaS can deliver a high level of coverage, it is not cheaper. In fact SaaS actually winds up being more expensive over an extended period of time.Generally it may be slightly less over time for the service itself, but when you factor in the total costs it most often is not.  So lets not start saying that SaaS is a way to deal with shrinking budgets and downturns in the economy.

3. SaaS is not channel friendly.  The problem is that a channel partner can easily sell the SaaS, but at that point is cut out of the picture. They have nothing to with the delivery or other ways for value add.  Once they don't own the customer and have been cut out of the delivery of the product there opportunity to monetize the customer is diminished and this is bad business for the VAR.  SaaS is a great way to cut out the middleman and the middlemen are smart enough to see this very quickly and reject it.

All of the above not withstanding I do think SaaS and security in the cloud will become more of a factor. The trick is that there is more to SaaS than a Symantec live update service.  That is not SaaS.  As Matt correctly notes, there are certain types of security technologies that lend themselves well to SaaS and there are some that do not. Figuring out which is which is the key. Also outsourcing versus in house is a consistent pendulum that swings first one way and then the other. People will start complaining about not having enough "control" over the process and not enough customization options to do it they way they want. They start complaining about the cost, when they find out it is more money. Just as the trend appears to be swinging towards SaaS now, it will inevitably swing back the other way.