“Most of the start-up application vendors are selecting SaaS [Software as a Service] as their primary model, and increasingly as their sole model for delivering applica­tions.”

At least that’s what Dave Mitchell, director of software-as-a-service strategy for IBM, told me for a recent article I published in Database Trends & Applications. (The article is summarized here at my DBTA “Eye on the Enterprise” blog.)

SaaS rules. A related survey, which I conducted for Unisphere Research in conjunction with the Oracle Applications Users Group (OAUG), confirms that interest in the SaaS approach is running high among corporate end-users. The survey of 576 companies found that a sizable segment of enterprises are tak­ing advantage of, or are aware of, SaaS or on-demand software. About two out of five respondents, 39 percent, were already using SaaS applications, and another nine percent were considering adoption of SaaS-based solutions with­in a year’s time. Those that already run on-demand or SaaS solutions reported that they were seeing benefits in terms of cost savings and skills availability.

ERP is the most common type of SaaS application, the OAUG survey found. A third of the SaaS users, 33 per­cent, reported that they are leveraging ERP-type applications through a hosted service provider. Ranking in second place were CRM/sales force applica­tions, which tied with human resource applications at 26 percent. Business intelligence applications were the fourth-ranked category with 24 percent, tied with collaboration tools.

Good stuff. Is there a downside? Of course!

While the pay-per-use model of SaaS is very appealing to companies, there are also some potential risk areas. Dilip Wagle, a partner with McKinsey & Company, told me that one of the biggest risks is that end-user compa­nies may have less control over the reli­ability about how their data is managed. ‘Pure ‘in-the-cloud’ services imply that all the customers data are essentially stored off-premise in a data center owned or contracted by the service provider,’ he explained. ‘In the event of data center failure on the part of the service vendor, the customer has no recourse but to hope that data were appropriately backed up and managed in a secure fashion. The problem can be exacerbat­ed if the SaaS vendor in turn, out­sources back-end data center operations to yet another third party. This can com­plicate accountability and liability in the event of failure or security breach­es,’ Wagle said.

Bert Armijo, vice president of marketing and product management for 3Tera, recounted his own negative experience with SaaS, noting that ‘I’ve had vendors go bankrupt, or their co-location provider went bank­rupt, without giving me the ability to remove my data. One app I liked stopped functioning last August and the provider hasn’t been able to bring it back online yet. I’m assured that ‘all the data is still there,’ but as you might imagine that data is no longer of value to me.’

It should be noted that while McKinsey’s Wagle advises caution with handling data, he is a strong believer in the potential of SaaS. In a recent column, he noted that venture capitalists have increased their investments in software-as-a-service companies by 18% between 2002 and 2005, and McKinsey’s own survey of CIOs found that those who planned to use some form of software as a service over the next 12 months grew from 38% in autumn of 2005 to 61% a year later.

Plus, Wagle observes, McKinsey’s index of companies whose main business is software delivered as a service — including Salesforce.com Inc., RightNow Technologies Inc., WebEx Communications Inc., WebSideStory Inc., Concur Technologies Inc., Workstream Inc., Taleo Corp., Digital Insight Corp., Ultimate Software and Digital River Inc. — “outperformed the overall software company index (excluding Microsoft Corp.) by more than 13% from January 2002 through December 2006.”

SaaS is quickly displacing the install-from-the-CD-and-cross-your-fingers approach to software — good riddance to that. But SaaS also makes us even more reliant on third-party firms which may be here today and gone tomorrow. Especially if we’re going to those startups Dave Mitchell was talking about. Remember that creed that IT managers have been living by for decades now — whether its applications, data, or coffemakers — always, always, have a backup.