Today's Budget, Tomorrow's Plan

As anyone who manages a household budget can attest, there are necessities and then there are niceties. Planning ahead, these budget keepers probably know they'll have to spend more on necessities like energy and, thanks to all the hurricanes, homeowners insurance in 2006. Then, perhaps, there will be money left over for niceties like finishing the basement or some landscaping.

So it goes for organizations setting technology priorities, although it's a bit more complicated. For one thing, there are many more "owners," each with different priorities. Then there's the tendency for last year's nicety to become this year's necessity — do you remember when data warehousing was exotic? Finally, much more than pride is at stake in keeping up with the corporate Joneses; today's "speculative" investment might lead to big market gains or improvements in profitability.

To get a sense of our readers' technology priorities, our Intelligent Enterprise Strategic Management Survey explored 2006 spending plans in 28 categories and drilled down on adoption plans for 27 leading-edge technologies. Some of the results surprised us, starting with the fact that security and privacy were at or near the top of both lists. Other priorities were more predictable and fell into the theme of improving information access.

Tighter security and better information access are longstanding IT imperatives (and in some ways work at cross purposes), but cost factors and influences can change dramatically from year to year. Let's look at the technology trends and regulatory and business pressures setting today's agenda, starting with our take on why security now trumps other imperatives.

First, Protect the Data

We were perplexed when we got our first look at the survey results related to 2006 budgets and technology interests (see "Listening Posts" at right and on the following page). More than half the readers we surveyed said they'll spend more on security, privacy and identity management in 2006, and nearly equal interest was expressed in security and privacy technology innovations. It's not that security and privacy issues aren't on our radar, but we hardly expected them to rank first for increased 2006 spending and second in future interest.

A look at the breakdown of respondents helped clear things up, with nearly 60 percent of the sample representing bank, insurance, financial service, health care, government, defense, retail, telecom, education, media/marketing and outsourcing firms. These firms are managing and analyzing sensitive information, and when consumer information is involved, there's usually a regulatory compliance demand on the front burner.

The Healthcare Information Portability and Accountability Act (HIPAA) got teeth last April, with an initial deadline passing for health-care providers, health plans and payment clearinghouses to protect electronic health information. In March, four federal agencies issued new information security rules for U.S. Banks. Citing the Graham-Leach-Bliley Act, the FDIC (Federal Deposit Insurance Corp.), the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Office of Thrift Supervision required banks to inform customers in the event their personal data is exposed due to a security breach. And in July, a Federal Information Security Management Act (FISMA) deadline kicked in requiring all the federal government's 8,623 IT systems to be certified and accredited as secure.

California's Security Breach Information Act (SP 1386) has been the model for legislation on data-breach notification, and together with new bank rules, it forced a series of high-profile revelations about consumer data security breaches — by ChoicePoint, Citigroup, Bank of America, LexisNexis and MasterCard, among others. Nothing generates legislation like scandal, so now a gaggle of federal-level information security and privacy bills are floating around Capitol Hill (see our Dashboard story).

The costs of negative publicity are far steeper than basic improvements in security. First steps include adding more robust network firewalls, application firewalls, intrusion-detection systems and developing more rigorous patch and virus protection routines. Encryption is a next step that makes sense for information such as trade secrets and sensitive data on laptops, but it's expensive and a full-employment program for DBAs when applied more broadly. DBMSs (database management systems) and BI (business intelligence) systems often provide or support encryption methods, but few companies implement them systematically because it's difficult and expensive to rework applications designed to use unencrypted data.

Web services and service-oriented architectures present unique security challenges that demand devices such as XML security gateways. These gateways were once a burgeoning area for specialty companies, but leaders including Sarvega and DataPower have been snatched up by Intel and IBM, respectively.

Our readers aren't often the front-line security watchdogs, but it appears that regulatory compliance demands and, more importantly, the threat of negative publicity have made their mark on budget priorities.

Improve Access

Part of the reason security challenges are getting tougher is that organizations are doing everything they can to make it easier for those they trust to access information and applications. Half of the Intelligent Enterprise readers polled confessed that their organizations make poor decisions because users can't get enough good information. No wonder content and document management, portals, performance scorecards and dashboards and enterprise reporting ranked second, third, fourth and sixth, respectively, among 28 categories for possible increased spending in 2006.

What's behind the demand for content and document management? You've probably heard that 80 percent of information in the enterprise is "unstructured" — meaning documents, reports, e-mail messages, Web pages and other content not typically stored in databases. What you may not have heard is that 80 to 90 percent of that content usually isn't managed.

While data warehouse and BI pros may gripe about data stores that remain untapped, the gaps on the structured side are tiny compared to the canyons of unmanaged content. A statistic from IBM is telling: The acknowledged leader in enterprise content management (with 20 percent of the ECM market by some estimates), IBM reported in 2004 that it had some 11,000 corporate ECM customers compared to about 400,000 DB2 customers.

IDC studies project only modest ECM growth of about 9 percent over the next few years, but industry giants Microsoft and Oracle are counting on a bigger, broader market for a lower-cost, every-seat style of basic document management in the form of Microsoft SharePoint and Oracle Content Services. SharePoint had already racked up some 32 million seats by last summer. Oracle says between Content Services (introduced last summer) and Oracle Files, it has more than 2,600 enterprise customers and "millions" of seats. IBM offers Workplace Documents as a basic document management tool, but at present it seems more focused on its ECM offerings.

Portals, too, will draw more of your dollars this year. The latest enhancements to portals include collaboration and content management features as well as access to reports, KPIs, scorecards and business activity monitoring (BAM). Portals are also interacting with applications, composite applications and processes.

Plumtree was well down the application interaction path when it was acquired by BEA last fall. That deal effectively marked the end of the stand-alone portal era, with the market consolidating to the infrastructure vendors, such as IBM, BEA, Sun, Oracle and Microsoft, and application vendors, including SAP, BEA's Plumtree lineup, and the other Oracle, meaning PeopleSoft and Siebel.

Microsoft dipped its toe in the application camp recently, adding 30 out-of-the-box applications for SharePoint Services, including absence and vacation scheduling, meeting management, marketing campaign management, loan initiation and case work management apps.

Will your portal be part of your infrastructure or your applications? Either way, many organizations have made or will be making leaps to service-oriented architecture to gain even better and more flexible access. And either way, the portal is a given IT asset that requires upgrades and reinvestment.

Give 'em a GUI

In the performance management and BI arena, our "performance scorecards and dashboards" and "enterprise reporting" categories address access and analysis imperatives, but we think the former is what's driving most of the interest.

Scorecards and dashboards should be a sign of deeper performance management initiatives aimed at improving planning and developing clearer strategic goals. To manage toward those goals, top financial and business executives need more detailed and timely information. Scorecards help aggregate and display that information, and dashboards deliver it to the key executives who need to react when business conditions change.

The scorecard was invented for the purpose of measuring and comparing performance against strategic and operational goals, and dashboards were first "executive" dashboards designed to display up-to-the-minute performance. The danger with these terms is that they're fast becoming ubiquitous. So many products now feature "scorecards" and "dashboards," you have to wonder if this phenomenon is really about performance management.

We put the word "performance" up front with a specific market in mind, so we hope the 43 percent of respondents who said they're spending more on scorecards and dashboards know what they're getting. Cross your fingers that the scorecards are grading and the dashboards are dialing into carefully selected variables tied to strategic performance objectives.

Nearly 42 percent the readers we polled said they'll spend more on enterprise reporting, the most visible example of the trend toward "operational BI." Rather than hoarding intelligence at the top, organizations know they must empower employees with information. Enterprise reporting tools are giving a broader community of users self-service access and more control over when and how they receive their reports.

Enterprise reporting figured prominently in nearly all the many BI suite upgrades in 2005, with examples including SAS's Web Report Studio, Hyperion's SQR (picked up in the Brio acquisition), and MicroStrategy's Report Services 8. Enterprise reporting is for everyone, but as the casual user's gateway to BI it must be accessible and easy to use. Thus, Web-based delivery and simple GUIs are musts. For vendors, the trick is hiding enough sophistication and control behind the scenes to please the analysts who drill down and design their own reports.

Whether it's because users are clamoring for information on demand or because BI gurus are tired of responding to special requests, our readers are investing more in enterprise reporting.

What's Next?

Other aspects of your 2006 budget and technology adoption plans seemed surprising at first, although less so upon closer examination. For example, for what many consider a "mature" category there was surprising interest in DBMSs, but then the footprint of the DBMS has been steadily expanding. IBM, Microsoft and Oracle have been blending in content management (as described earlier), BI and even data integration into the DBMS, which may be helping drive upgrades. Certainly Microsoft's recent and long-anticipated SQL Server 2005 release has many anticipating new licenses in 2006.

Looking at your interest in leading-edge technologies (see "Listening Post" at right), we discussed security and privacy, but more than half of the respondents also said they had either deployed or were testing, planning to deploy or closely tracking mobile and wireless solutions. It's a topic that network infrastructure publications have been all over, and with all the alerts tied to key performance metrics, processes and all forms of business activity monitoring, it makes sense that our readers are interested, too. Why go to the trouble and expense of getting to actionable, real-time information if you can only expose it to users at desktops during business hours? Without anytime, anywhere connectivity, all the talk about business responsiveness and agility rings hollow.

Less surprising was the high interest in service-oriented architecture and Web services (and the promise of faster, lower-cost, flexible and responsive IT), data visualization (for deeper, yet clearer analysis and understanding), 64-bit computing (for choke-free performance as the number and complexity of queries mounts), and Radio Frequency Identification and streaming data processing. The last two will go hand in hand, although streaming processing is already used for rapid-fire financial transactions and security incident detection.

How We'll Change

Thanks to the more than 1,131 readers who participated in our survey. We learned a lot and have many more statistics we plan to share. More importantly, we'll respond to your feedback by modifying and adding to our editorial calendar. We've already been in touch with our colleagues at Secure Enterprise to explore ways we could investigate encryption and other data protection technologies and trends.