Ben, your preemptive strike is a miss.  Supporters of SaaS should not be dismissing those who correctly point out that these examples point out the risks of SaaS.  Instead, we should be the ones who point out that these DO show some of the risks, and then progress to explain what companies can do to mitigate the risks and what sort of due diligence can be done.

Your simplistic statement about doing due diligence - and then stating you have to do it for desktop software too - is not helpful. The due diligence is vastly different for the two approaches. The reality is: with software you install, if the company shuts down, you still have the software running, and your corporate processes can continue.  When a SaaS vendor shuts down, your corporate processes that were tied to that service shut down too.  SaaS supporters need to acknowledge that.  So, lets start talking about the implications of that vs. the implications of on-site software (not "desktop" software, because it can be server software too).

We need a blog (or a wiki) where we can all contribute to documenting the risks for both approaches.  That will 

1. With SaaS software, you need to ask what is the implication of the tool being down for a certain amount of time, with you being able to do nothing other than apply pressure or seek legal action.  What happens if the service is down for 24 hours?  A week?

2. With on-site software, you need to ask what is the implication that you will need to dedicate staff and resources to maintaining and upgrading the software.  What are the implications if you are a few patches behind? Will you be out of compliance with state or federal regulations?

3. With SaaS software, you need to ask what is the implication of upgrades being made at an inopportune time.  What sort of advance notice does the vendor provide before implementing changes?  What is their rollback plan if there are problems?

4. With on-site software, you need to ask what are the implications of the fact that the people administering the tool (your staff) are not the experts on the software?  Sure, they may be extremely knowledgable, but the experts are at the software company.

just a start....

Paul - one day I'll learn not to write off the cuff posts ;-)

As you say - there are a myriad of pros and cons for both on premise and SaaS. I just hate it when people take a case like the recent ones and dismiss an entire industry because of it. 

All I was doing was dismissing their dismissal - not dismissing their own offerings.

Make sense?

b

Paul, We write about the risks involved in SaaS at Cloud Avenue. I have written a few posts on it and there is also an Ongoing SaaS Risk Reduction Series. I agree with Ben in dismissing the dismissals of naysayers. They pick an incident here and an incident there to make claims like SaaS is insecure or risky. They plainly ignore the fact that such risks are there in the traditional hosting world and desktop software world. At Cloud Avenue, we try to highlight the risks associated with SaaS and also debunk the myths promoted by people whose business interests are threatened by SaaS and those who make career loving such businesses.

As the CEO of a Danish SaaS provider this article is probably the worst ever for my company in SEO terms. So let me try to give a more detailed view of this story that fills up all Danish newspapers currently and has all the elements of a good drama (except for the sex, but it's not over yet).

The company IT Factory was until a week ago one of the most lauded Danish software companies. They had revenues in the $250M region, were a prominent IBM partner and event sponsor, and made exorbitant profits. They won all kinds of prices; company of the year, growth comet of the year, etc. All Danish business newspapers celebrated them, even Ernst & Young celebrated them at a big event just one week ago as "Growth Champion 2008".  They had a proven management team with expensive and high profile executives (http://www.linkedin.com/companies/it-factory), and the chairman and main investor was the former CEO and President of CSC Nordic, Asger Jensby (http://www.linkedin.com/pub/0/631/ba5).

Then Monday morning this week all hell broke lose. The CEO of IT Factory, Stein Bagger, disappeared under peculiar circumstances in Dubai. The chairman hosted a press conference declaring the company bankrupt and suspected that 90% of all revenues ever were pure fabrication. Since then a bunch of dramatic details have escaped: That a so far unknown partner in the company had been assaulted last week by hit men. That the missing CEO was protected by Hells Angels. And a complex scheme of foreign companies and dubious business contacts surfaced.

Right now everybody is washing their hands and blaming the missing CEO. That it was a one man job, and he alone deceived everybody. Same time it also seems clear that more or less everybody in the media world, the IT industry and finance industry had no clue what the company did, but was intimidated by the money-smelling lifestyle and extremely expensive habits of the company and its executives.

The real interesting aspect of this story is that it's a freelance journalist and blogger who solely unwrapped and disclosed the entire story. She has been working on the story effortlessly despite being threatened and intimidated by the company with very little support from colleagues or anybody in the industry. Unfortunately Dorte Toft's blog is in Danish, but it's worth a visit: http://bizzen.blogs.business.dk/. Her story is a remarkable story.

A few articles on the story in English:
http://politiken.dk/newsinenglish/article607575.ece
http://politiken.dk/newsinenglish/article606159.ece
http://politiken.dk/newsinenglish/article605506.ece

And yes, the film version is already in the works.

Sincerely,

Mikkel
CEO of Zendesk
An actual Danish SaaS provider :-)

Mikkel - many thanks for this. Having lived in Denmark myself this story doesn't do anything to dampen my enthusiasm for all things Danish!

Keep up the good work