Effective policies and practices of software license and update management have both a business and an operational aspect. As with Janus, the two-faced Roman god of gates and doorways, beginnings and endings, those two aspects of software license and update management look in different directions but combine — and balance — to achieve the same goal. While the business aspect of software license and update management looks outward toward the value component of the relationship between software consumers and vendors, and the operational aspect looks inward toward the relationship between IT and its user community, the focus of both is on maintaining organizational health and operational continuity.
Regarding the value component of a software purchase, it is obvious that software vendors wouldn’t charge license or maintenance fees if they didn’t think their products had value to customers. And customers wouldn’t pay those fees if they didn’t agree that there was value in the software their vendors provide. Without that very basic level of agreement, there would be no business relationship to manage and no operations to worry about. So, the outward-facing aspect of license and update “best practices” concerns itself with finding answers to the two most important questions of any customer/vendor relationship: “What is the value of the product or service you’re selling? How will we measure that value?”
What’s it Worth to You?
Traditionally, the answers to those questions were expressed in terms of the number of CPUs in a machine or in the number of physical machines, but those metrics are less relevant as the underlying technologies change. “You can’t easily answer those questions anymore,” noted David Znidarsic, vice president of technology at Macrovision, a provider of software license management technology. Znidarsic points to multicore, hyper-threaded hardware or virtual machine technologies as disruptive to traditional notions of software licensing.
At a very simplistic level, with multicore, two processors behave as if they are one. With hyper-threading, one processor behaves as if it were two — and so on, as the number of processors grows. With virtual machine technologies, virtualization effectively maps an entire “machine” onto some percentage of the underlying hardware assets. Jane Disbrow, a Gartner Group analyst, observes, “Virtualization makes it very difficult for software vendors who have machine-based pricing.” And Znidarsic adds, “Even if the answer was simple, I would argue that measuring value in terms of machine resources may not be appropriate.”
With software, unfortunately, it turns out that agreeing on value isn’t very easy. When you have software that has hundreds, even thousands of features, not all of which will be used as frequently as the others, clever consumers might try to negotiate for assigning value only to the features they plan on using — disregarding the vendor’s R&D investment in putting them all together. Or they might try to negotiate for assigning value only to a specific set of features and a specific set of users, limiting the return their vendor can promise to its own investors.
There might be some consistent metrics, but Znidarsic points out that each vendor has a different set of issues and answers. “As you move across the industry, you get different value. What’s happening now is not that the discussion is any more or less important now than it was before — but that it’s going to a finer-grained measure of value than before. Enterprises are saying, ‘Just because I installed the software doesn’t mean I’m getting any value.’ ”
The Value of Compliance
Even if customers and vendors can agree on the specific combination of features and functions that are the sources of value in a particular transaction, determining what that value ought to be isn’t easy. There’s a natural tension between vendor and user objectives. Smart vendors want to maximize the value of the relationships they’ve established, not just the value of an individual transaction. They’re very protective of those relationships, but they also want to be sure that they’re being compensated for the value they provide. Customers don’t want to overpay, and they do want some flexibility in how they acquire their software assets.
But after performing the calculations unique to each transaction, after reaching agreement on value, and after formalizing that agreement in a legal contract, customers don’t want to find themselves out of compliance when they’re on the receiving end of a vendor audit. That could be unhealthy too — in both a legal and a financial sense.
Sarbanes-Oxley has pushed compliance issues to the forefront. According to Macrovision’s Znidarsic, license enforcement initiatives were originally driven by vendors who had an anti-piracy motivation. But with Sarbanes-Oxley, customers have to prove they’re in compliance with contracts not only to their vendors but to their own auditors as well. “One way to prove compliance is to put pressure on your software vendor, so some software companies are driven by demands from enterprises. They look for a way to put in methods to enforce or audit the ways their software can be used. If you use enforcement, there’s no compliance requirement, because you can say that that the software itself forces compliance,” Znidarsic explains.
Still, enforcement isn’t appropriate for all types of software. When enterprises deploy mission-critical applications, or have customers that can’t be shut down, vendors don’t want to ever deny use, but an out-of-compliance audit will trigger a billing event — or a lawsuit.
Larger organizations have professionals in place that negotiate software license agreements, says Gartner’s Disbrow: “They understand how important it is to have clear usage rights in the contracts.” But even “clear” usage rights may be difficult to count when there’s an audit. For example, Disbrow points to a situation in which the software license is based on the number of employees in the organization. “The definition of employment can be hard to pin down. There may be seasonal employment, and there are also issues of averages, peak employment levels, employees on leave, and so on. There can be a big variation.”
Disbrow reports that 30% of the attendees at a recent asset management conference claimed they’d had at least one audit in last 12 months. Users expect to be told they’re in or out of compliance following one of these audits, but if the contract terms are unclear, there is often disagreement on the nature of compliance. And when such debates occur, vendors often have the upper hand. Disbrow indicates that negotiations “tend to go on and on and on. Nobody likes to sue, but normally customers end up cutting a check.”
Negotiating the Fine Print
Disbrow believes that enterprises have to do a better job negotiating, but admits they are operating at a disadvantage. “Particularly in a mid-sized business, a CFO may take software licenses to the people in the legal department, but unless they have a background in software, they may not understand usage rights.” Disbrow’s team often looks at software contracts and sees usage rights that are vague — perhaps deliberately so. “We think vendors are leaving it that way so they can come back — and anything that’s vague makes resolution very difficult. A lot of non-clarity works to the benefit of the vendor.”
Of course, there are other questions and other issues in a customer/vendor relationship to consider: how payment terms will be set is one that comes to mind. But, as anybody who’s ever financed a major purchase will realize, by the time you answer the question of how much per month you can afford to pay, you’re already hooked. Reasonable parties will find a way to make this part of a business relationship work if they can find common ground on the two questions of value determination and value measurement.
Changes in software packaging also affect licensing and update management processes. “The solutions provided by software companies are less and less about software bits,” Znidarsic points out. “A modern software solution includes the executables that you install, the licenses necessary to enable the features in that solution and, increasingly, a lot of content.” For example, with a virus protection solution, updated definitions are just as important as the underlying software.
Looking at the combination of all three packaging elements, the operational issues are initial delivery and updates of each element; they can’t be separated. Enterprises have to update executables, content, and their licenses, and that brings up a whole range of operational issues — the other “face” of the license and update management challenge.
The Operational Aspect: Standardization and Virtualization
Rich Bentley, market segment manager at Altiris, a provider of software that addresses a range of licensing and update management issues, points out, “The big thing is the overall complexity of managing software applications for an enterprise. You might have thousands of applications, and thousands of versions, where everything is interdependent. It’s a real challenge to make things work for the end user. When two or more applications conflict and cause problems, resolving those conflicts can be a problem, especially when fixing one thing causes other problems.”
The operational side of the problem is compounded as the scale of the software infrastructure increases. One approach is standardization and virtualization. “Virtualization is changing the landscape of how software is being deployed. It affects licensing delivery and updates,” notes Macrovision’s Znidarsic. “Under the old approach, you assumed a machine had a running OS. You put an application on it and you’d try to make sure it worked. We’re now seeing pre-configuration of virtual machines. That guarantees a perfect configuration of the OS and the application. You’re no longer leaving it to chance.” IT can control the image, so initial delivery and updating have both changed — for the better, it appears.
Altiris’ Bentley notes, “The more you can standardize — reduce the number of platforms, the number of applications — the more effective you can be. Most organizations have too many applications, including multiple versions of the same applications, multiple applications performing the same function, different images, and so on — that’s where complexity becomes overwhelming.”
But standardizing, including standardizing on a systems management process and a structured approach to change, can be intimidating if an organization tries to tackle the problem all at once. It can be even more intimidating when the standardization process is part of an overall asset management initiative. Gartner’s Disbrow recommends starting with about 3-5% of the overall asset base. Altiris’ Bentley agrees, saying, “You can’t flip a switch and just say we’re going to be standardized. We find series of smaller steps is the best way to do it — as long as you’re making the organizational commitment not to stop doing the work.”
Not every organization will find it appropriate to take license management and operations and combine them. For some, dividing the responsibility makes more sense — but the overall objectives of organizational health and operational continuity remain as a common focus. Bill Washburn, systems administrator at California State University at San Marcos and an Altiris customer, seems to be taking that approach. He’s responsible for overseeing 1000 lab computers, used by about 6700 students. The university’s goal is for students to be able to sit anywhere on campus and do their work. Washburn’s organization manages the installation and updates of software that professors request, or that the university has mandated, while another person handles the software licensing aspect of the process.
The University relies on the Sassafras Keyserver product for license management and uses products from Altiris, Shavlik and Microsoft to support installation, updating and patching. Washburn’s licensing counterpart manages requests from the university professors and others for software they need to have installed, and indicates where in the university it needs to be installed.
Previously, under a rapid install program, Washburn reported that it took as much as 10 days to get new applications installed and tested — and that was often just for the instructor’s machine. Using Altiris’ SVS software virtualization system, he now reports that he can “just roll it out.”
But he’s found that virtualization doesn’t work for every application out of the box. Some application installations require customization of the virtualization process. Some have required reversion to previous versions of the application — but Washburn expects those issues will be resolved. “Something will always come up — that’s always going to happen. Finding workarounds won’t ever go away, but they can become less frequent.”
The Future of Licensing
New packaging delivery methods will continue to affect licensing and updating practices — as will customer demands for greater licensing flexibility. “Key Trends in Software Pricing and Licensing,” an October 2005 survey sponsored by Macrovision, SoftSummit, the Software & Information Industry Association (SIIA), and the Centralized Electronic Licensing User Group (CELUG), provides some insight: “For the second year in a row, the data clearly suggests that software vendors are moving aggressively towards subscription-based licensing models and away from the more traditional perpetual-licensing model. The continuing market acceptance and understanding of emerging trends such as hosted software and on-demand and utility computing have shown vendors that these new methods deliver improved value and satisfaction to their customers, while providing greater revenue predictability.”
But is the traditional software license model — perpetual license with a periodic, usually annual, maintenance fee — dead? Mark Murphy, managing director at First Albany Corporation, doesn’t think so, but he qualifies his position: “I don’t think it is dead, but I think it’s sick. There’s an argument that whether it’s a perpetual license plus maintenance or a subscription, the cost of the software is still the net present value of future cash flows.”
From an enterprise point of view, Gerard Halleran, director of research at Gartner Invest, notes, ”There is an over-arching trend in IT applications and even at many levels in infrastructure — which is to acquire software as a service. If you do a conventional ROI analysis and apply those numbers to a project versus a service decision, the project typically becomes more attractive in its fifth year. But if you think about it from a risk-adjusted standpoint, you have to put a much higher hurdle rate on the application than on the service. That argues powerfully for software as a service.”
First Albany’s Murphy adds that there’s another potential benefit to subscriptions: “There’s a perception that when you literally own the software, vendor lock-in goes hand in hand. If you’ve purchased $10 million of Siebel Software, you’re pretty much entrenched.” In a worst-case scenario, a vendor could walk away from a customer or ratchet up the maintenance fees. “With subscription/on-demand, you’re really not roped in like that,” Murphy notes, although he adds that the higher the degree of customization, the more difficult it is to leave one vendor’s solution for another’s.
Larger software vendors, including Computer Associates and Microsoft, have made the transition to a subscription-type model. Salesforce.com never used the perpetual model. “Customers wanted some flexibility in their licensing options, and small- and medium-sized companies didn’t want to absorb the huge capital expense of an up-front license purchase. Clearly, though, we’re going to see large application vendors like Oracle and SAP move to more of a subscription model,” Murphy predicts. That seems a very safe bet.
Damian Rinaldi, a former Wall Street software sector analyst, IT market researcher and trade publication editor, is now an independent writer and consultant. He can be reached at dvrinaldi@yahoo.com.
