Yes, there I said it. I can see the “Cult of SaaS” snipers congregating on the rooftops. Oh well, it was fun while it lasted.

In all seriousness though, when ServiceNow was quick to achieve success with its “SaaS-delivered IT service management goodness” at the tail end of the noughties, it was all about the SaaS (and customer satisfaction of course). It differentiated them from the ITSM tool vendor pack.

The "SaaS for ITSM" evolution

In a previous life I wrote about the potential for SaaS-delivered ITSM capabilities: SaaS and ITSM – a Marriage Made in Acronym Heaven? Who would have known that Service-now.com, as was, would have done so well, so quickly? I trust that their own projections were somewhat exceeded.

Some on-premise ITSM tool vendors said “unpleasant things” in the early days, but nigh on all of the major and minor ITSM vendors have since followed suit with their own SaaS offerings. In the spirit of the BBC and product endorsement I have to say that “other ITSM tools are available.” Check out some of the newest SaaS ITSM tool additions from Hornbill, LANDesk, and Numara.

Why is SaaS for ITSM a red herring?

Anyway, cutting to the chase … what sells a SaaS ITSM tool (or platform) such as ServiceNow? Many would think it is the fact that it is SaaS. I disagree.

SAP is a paying a substantial premium to acquire SuccessFactors, a leading SaaS performance and talent management vendor. The press release of December 3, 2011 states that the deal price of $40 per share is a 52% premium over the Dec. 2 closing stock price. Even more startling is that SuccessFactors has a revenue run rate of roughly $300 to $330 million for 2011, and the acquisition price of $3.4 billion is more than 10 times revenue! Why then did SAP make this move?

SAP’s cloud strategy has been struggling with time-to-market issues, and its core on-premises HR management software has been at a competitive disadvantage with best-of-breed solutions in areas such as employee performance, succession planning, and learning management. By acquiring SuccessFactors, SAP puts itself into a much stronger competitive position in human resources applications and reaffirms its commitment to software-as-a-service as a key business model.

In my recent research for a soon-to-be-published Forrester Wave™ on human resource management systems (HRMS), I noted that SAP has more than 13,000 customers using its HCM suite. Yet the adoption of SAP’s learning and talent management products is much less (a few thousand, perhaps), which is noted in my colleague Claire Schooley’s “The Forrester Wave™: Talent Management, Q2 2011.” The talent management Forrester Wave also clearly shows that SAP’s embedded talent management offerings lag well behind the best-of-breed specialists in learning and performance management. The bottom line here is that SAP HCM customers predominantly run best-of-breed talent management solutions alongside their SAP core HRMS (i.e., the transactional employee system of record).

What's the Big Deal?

Emerging ARM server Calxeda has been hinting for some time that they had a significant partnership announcement in the works, and while we didn’t necessarily not believe them, we hear a lot of claims from startups telling us to “stay tuned” for something big. Sometimes they pan out, sometimes they simply go away. But this morning Calxeda surpassed our expectations by unveiling just one major systems partner – but it just happens to be Hewlett Packard, which dominates the WW market for x86 servers.

At its core (unintended but not bad pun), the HP Hyperscale business unit Project Moonshot and Calxeda’s server technology are about improving the efficiency of web and cloud workloads, and promises improvements in excess of 90% in power efficiency and similar improvements in physical density compared with current x86 solutions. As I noted in my first post on ARM servers and other documents, even if these estimates turn out to be exaggerated, there is still a generous window within which to do much, much, better than current technologies. And workloads (such as memcache, Hadoop, static web servers) will be selected for their fit to this new platform, so the workloads that run on these new platforms will potentially come close to the cases quoted by HP and Calxeda.

The Program And New HP Business Unit

It’s interesting how many threads there are on the Internet that still debate the difference between these two words: “responsible” and “accountable.” Oddly enough, today I stumbled across two definitions, from seemingly respectable sources, that hold diametrically opposite views! To me, the answer is simple – you can delegate responsibility, but accountability remains fixed.

This is a key point in the extended enterprises in which we now function. Firms are now made up of a myriad of offshore and outsourced services, running on systems that are similarly fragmented and distributed across vendors. This complex tangle of people and data represents a huge challenge to the CISO, who remains accountable for the security, and often the compliance, of his employer yet is no longer responsible for their provision.

With a methodical and comprehensive process and a surfeit of resource (please stop laughing at the back!), the CISO does, however, have the ability to follow the data trails and manage risk down in this regard. Unfortunately, with the advent of cloud, things are taking a turn for the worse. Cloud vendors are reluctant to be scrutinized, and the security and compliance demands of the CISO can often go unanswered. If cloud really is to be a mainstay of computing in the future, something has to give – we need to find a balance where compliance and security assurance requirements are met without fatally undermining the cloud model. This is a key topic for 2012 and something we’ll be following with interest.  

As security professionals, we remain accountable for resolving these issues, no matter how much responsibility has been pushed to third parties and cloud vendors. So, how do you minimize the workload involved in managing the third parties that make up your extended enterprise, and how do you gain assurance around cloud vendors?