Forrester Blogs

The Forrester note† that the article links to is a little more balanced that the NYT article. If you don't have time to read the whole thing, here are some good quotes:

It's naive and dangerous to think that the NSA's actions are unique. Nearly every developed nation on the planet has a similar intelligence arm which isn't as forthcoming about its procedures for requesting and gaining access to service provider (and ultimately corporate) data. As stated in the ITIF report, German intelligence has the G10 act which let's them monitor telecommunications traffic without a court order.

The fact of the matter is that the IT services market is a part of our portfolios because it provides capabilities we value either against IT or business metrics. And it's highly likely these values are worth more to you than the potential risk you think your company faces due to government surveillance. And if your company is a prime target for government surveillance, you are probably being watched from within your own firewalls right now.

... you can take actions yourself to protect your data from prying eyes when using these services. A quick tip: bring your own encryption. If you hold the keys the governments can't get to your data by going through your service provider.

†http://blogs.forrester.com/james_staten/13-08-14-the_cost_of_prism_will_be_larger_than_itif_projects

I still don't know a single SaaS B2B company - at scale - that is actually profiting right now.[0] The general assumption is that the cost of sale will continue to go down (and thus become profitable), but once the market gets saturation (it is in CRM-SaaS for example), then the cost of sales goes right back up.

> The other company has to bust ass for measly 20%/yr maintenance fees.

This is a funny assumption. On-premise maintenance fees for the likes of SAP, Oracle, etc sit on a nice ~80% gross profit margin.[1] This model is obviously broken today, but has been a major source of revenue for traditional software.

Here is what I think I will happen to SaaS models (note - it isn't pretty): http://www.techdisruptive.com/2012/11/28/how-are-we-going-to-make-enterprise-cloud-profitable/

Anyone know a large successful Enterprise SaaS that isn't selling jackets?

[0] - http://finance.yahoo.com/q/ks?s=CRM+Key+Statistics

[1] - http://blogs.forrester.com/duncan_jones/13-02-14-saps_maintenance_price_hike_should_concern_sourcing_professionals_and_their_cios

I think we must be misunderstanding each other. Developers are human. (At least, I think we are.) We respond to the incentives and structure of the environment in which we're developing. A culture of "throw crap over the wall to QA" naturally creates an incentive for quickly writing up features, without balancing that with robustness, because finding the problems "is QA's fault". A culture of "the devs are responsible for the quality of their code" produces better code. The way to treat the devs well is to have the QA folks go off and create or bring in easy-to-use automated testing and CI frameworks, to make it easy for the devs to do the right thing.

This is not a new observation - it's been happening over the last 10 years. see, for example, http://blogs.forrester.com/mike_gualtieri/11-02-17-want_better_quality_fire_your_qa_team
or http://product.hubspot.com/blog/the-classic-qa-team-is-obsolete
and, while it's from 2007, http://googletesting.blogspot.com/2007/03/difference-between-qa-qc-and-test.html

> I want to be in a better career position in 4-5 years...

It's impossible to know what the tech landscape will be like in 5 years. It's also very likely your indivual career aspirations may evolve and change.

But if you're trying to make yourself more marketable in the long run-- build-up needed skills that won't change. Tech leadership desparately needs individuals with good people skills. Study Psychology, Business Management, and take a Dale Carnegie course. The ability to sell ideas is also a skill always in demand. Read up on marketing by Seth Godin.

Relative to what's emerging in tech-- an interesting benchmark to note, this 2012 survey by Forrester>http://blogs.forrester.com/brian_hopkins/13-02-07-forresters_top_15_emerging_technologies_to_watch_now_to_2018

If you are hiring security professionals, it might be helpful for you to keep in mind for your new hire folks and for your customers that there is a new metric underscoring the thesis of Troy Hunt, who is quite experienced in this industry: MTBCA -- mean time before CEO apology: http://blogs.forrester.com/rick_holland/15-05-20-introducing_a_new_incident_response_metric_mean_time_before_ceo_apologizes_mtbca

Is it realistic to expect a health company to have prevented a breach if that breach is a consequence of an Exchange 0-day? The topic of the article is that the breaches have gone on for a significant fraction of a year. If that is the case, that there are intruders waltzing in your network, it is hardly appropriate to say that you take security seriously.

Agreed that it's moving down the value chain, many other open source projects out there doing similar things. There's also Tyk Open Source API Gateway (https://tyk.io) and API Umbrella (http://apiumbrella.io/), and APIAxle, though that's been around for a while now.

Also API market is intended to grow to $660 million in US by 2020 and over a billion worldwide (http://blogs.forrester.com/michael_yamnitsky/15-06-07-the_api_management_solutions_market_will_quadruple_by_2020_as_business_goes_digital). So it's definetely not small.