Behind the Buzz

The rent-vs.-buy argument has been given new life with Softwareas a Service. But despite some noteworthy SaaS successes, insurersstill are slow to demand “on demand.”

Michael P. Voelker

When it comes to its qualities as a buzz term, Software as aService (SaaS) has a lot going for it. Unlike “SOA,” there's onlyone way to pronounce it, and unlike “cloud,” both business and ITgenerally agree on what it is and what it's supposed to do. And totop it off, its acronym is a catchy palindrome.

But what's the reality behind the buzz? The idea of havingsoftware you use living somewhere other than your own data centerisn't new. Having lived through the development of service bureausand application service providers, skeptical IT execs listen tochatter around SaaS and can be excused for asking, “What can it dofor me?”

The answer, according to Joe Cardenas, is “everything.” Cardenasis CIO and founding management member of Employers Direct, aCalifornia-based workers' compensation insurer. “I can't imagineanything SaaS can't do,” he says.

The assessment of Cardenas, former CIO of SaaS pioneersalesforce.com, is among the most optimistic to be found in theinsurance industry. However, he does back up his claim through theIT strategy Employers Direct has pursued since the company wasformed in 2002.

Employers has no on-site data center, meaning all theapplications the company uses are delivered either via SaaS oranother remote hosting model. It's what Cardenas calls a “zerofootprint” IT strategy.

“I have no operational folks on my payroll. I have no DBAs,” hesays. “Instead, I have a staff of 17 in IT that oversees the outputof our vendors and providers.”

Cardenas believes today's market presents better opportunitiesthan ever for insurers to capitalize on a pay-as-you-go ITstrategy. “SaaS is more and more prevalent today. We've been ableto find more and more insurance-specific services now, whereas afew years ago it was zero. Today, our largest owned infrastructureinvestment is in network bandwidth. It's a completely differentphilosophy,” he says.

SaaS shares some features with yesterday's application serviceprovider (ASP) model. However, rather than simply slapping a Webfront end on an existing application, SaaS is built from the groundup to capitalize on the delivery capabilities and integrationstrengths of Web services and SOA.

“Using an ASP generally meant you got the same solution as youwould have if you were using on-premises software. You simply werechoosing to have the solution hosted at a remote location with athird party,” says Kimberly Harris-Ferrante, vice president anddistinguished analyst at Gartner Research. “SaaS is not just abouthosting; it's the delivery and functionality.”

Also, SaaS typically is a multi-tenant solution. “With SaaS,users have less ability to customize and configure solutionfunctionality, since it is a shared model,” she says.

Adding to the buzz around SaaS is all the current commotionabout cloud computing, which often is mentioned in the same contextas SaaS.

The difference is SaaS is limited to the delivery of software ondemand; cloud computing is about delivering any number of ITcapabilities on demand–software, infrastructure, platform, or otherservices. In other words, all SaaS is cloud, but not all cloud isSaaS.

SAAS STRENGTHS

Insurers looking to SaaS are targeting two key benefits: lowercost and faster access to better, more modern technology.

Cardenas believes there are several factors that contribute tothe cost benefit of SaaS. “A lot of the analysis I see focuses onthe run rate of a SaaS product being a little bit lower, comparingthe subscription cost with the amortized purchase price,” he says.“But what that analysis doesn't include is the monstrous cost ofconstant upgrades. The true cost of ownership over time is a hugeexpense,” he maintains.

Furthermore, Cardenas believes making an ownership investmentleads to inertia that prevents companies from making neededchanges. “What people don't realize is as you purchase products,there is a debt and an investment that mount up. Any company with amountain of installed, purchased software is limited in what it iswilling to do. You are going to depreciate that investment out tothe end, no matter what, even if something better comes along,”Cardenas says.

Carriers also look to SaaS as a better business solution,according to Jeff Goldberg, senior analyst at Celent. Carriersstrategize SaaS “will free up resources for us, put us inconnection with more modern technology, and help us do our businessprocesses better. That is a more valuable way of thinking about itthan when carriers simply are looking at it being cheaper thanhosting the software themselves,” he says.

This solution focus has led to interest in SaaS originating fromthe business side. “If I'm a business manager, I may want a newsystem, but I may see IT as a roadblock–it takes too long to get asystem implemented. But maybe I can find a SaaS alternative I canimplement quickly, with limited-to-no IT involvement, particularlyif it's an ancillary system that sits on the periphery,”Harris-Ferrante says.

RISK MANAGEMENT

Benefits of SaaS come with risks to manage. Insurers' largestareas of concern about SaaS remain data security and serviceavailability.

“You want to make sure in choosing the provider you do yourhomework going in and have a very good SLA built into thecontract,” says Vino Valle, senior vice president and operationsand systems officer for Lexington Insurance Company, an AIG membercompany.

Lexington already had been using hosted versions of AMSService's Phoenix policy administration system for specialtyhomeowners and Duck Creek's policy administration platform formiddle-market commercial lines. In early 2007, the insurer beganusing the SaaS-based Aspire platform from Maple Technologies toadminister a specialized “bloodstock” insurance program forracehorses.

When Celina Insurance Group began using iPartners InsuranceScorecard, a SaaS-based business intelligence system, data securitywas a key concern. “They have our data as well as the data of a lotof other insurance companies,” explains Rob Shoenfelt, Celina'sCIO. “We had a lot of discussions with them about security as wellas their business model–to make sure they'd stay in the datawarehousing business and not become a competitor of ours down theroad.”

“Data security in general has gotten better,” Goldberg asserts,“and vendors have done a better job of educating companies aboutsecurity.”

Still, managing security and other risks is a multifacetedendeavor–from negotiating contractual SLAs and requiring SAS 70Type II audits to visiting the vendor's data center to check outthe system controls firsthand.

“Anybody who is looking at a vendor needs to ask for a copy ofthe latest SAS 70 audit,” Cardenas says. “Vendors complain aboutproviding them, but it's like reading a book about their operationsand the foibles of their operations. Particularly if it's a'SOXable' process, you better have a Type II audit.”

For Employers Direct, the more pressing risks of SaaS werenetwork stability and availability. “You are very dependent on yournetwork. Your setup needs to be 'up to code' and have a lot ofredundancy,” Cardenas says.

“If you don't have a multivendor network strategy–if you put ina typical, underinvested network, and then put a lot of SaaSthrough it–you're putting the company at risk,” he adds. “With yourtypical data center, losing connectivity to the outside is not abig event, but it's a different world with SaaS.”

Another concern with SaaS is vendor stability. In a November2008 podcast on “Software as a Service for Life Insurers,” Gartnerprincipal research analyst Juergen Weiss noted among the topreasons carriers are “very reluctant” to work with SaaS offeringswere concerns with the stability and long-term viability of SaaSproviders as well as provider performance.

Instability is something Valle experienced firsthand. “Manyyears ago, we had a situation where we used a company we felt was avery good provider for hosting and supporting a personal linesapplication. However, with short notice, the vendor went out ofbusiness. It was a scramble to find another vendor to pick up theapplication and run with it,” he says.

Also, the more SaaS offerings a carrier uses, the moreintegration that is required. “Interoperability and integration areimportant,” Harris-Ferrante asserts. “You need to assess thearchitecture and integration requirements of how the solution willcoexist with the surrounding applications, including processexecution and data sharing.”

On the upside, Web services and SOA have made it easier to dothe integration, Goldberg says. “Now you can take a system that isfairly central to your operations and leverage SOA in order tointegrate a third-party system that's hosted somewhere else. Therehas been a technology change that has happened across the industryto better enable that,” he remarks.

“There is more integration required, but it's easier tointegrate when you're talking to a true SaaS service,” claimsCardenas. “Those [SaaS] providers 'get it.' They are architected asWeb services, everybody's talking SOAP, and life is good. But ifyou've convinced a [non-SaaS] provider to deliver an application asa service, it gets more complicated.”

Employers Direct uses different techniques for SaaS integrationbut favors the Cast Iron appliance as an integration hub. Forinstance, the company uses Cast Iron to integrate a hosted claimsadministration system with external, Web-based systems that claimsstaff interacts with, such as insurance department filing systemsand court record applications.

SAAS INTEREST

Despite promising benefits of lower cost, better technology, andeasier maintenance, SaaS is hardly the solution of choice for mostinsurers. “The prevalence and use of SaaS among insurers is verylow,” observes Harris-Ferrante.

That stands in contrast to other industries. Research firm IDCprojects 76 percent of all U.S. organizations will use at least oneSaaS-delivered application for business by the end of 2009, andspending on SaaS will increase nationwide by more than 40percent.

There are a few areas in the insurance industry where SaaS hasestablished a tenuous foothold. First, insurers look to SaaS inhorizontal functions–CRM, contact management, sales forceautomation–any area of business operations where, whether you're aninsurer or a widget manufacturer, processes are fundamentally thesame. Conversely, insurers look to SaaS to perform specializedinsurance functions that aren't transaction focused, such asbusiness intelligence.

“Business intelligence and niche areas such as fraud detectionare wonderful examples of how to use SaaS for competitivedifferentiation. In these instances, insurers can use a basicsolution that is offered as a SaaS. The key uniqueness for theseactivities [becomes] the models and analysis done with the tool,the data itself within the tool, and how it is applied within theinsurance operation. Using a SaaS alternative is a viable solutionfor these types of functions,” Harris-Ferrante says.

Prior to deploying the iPartners platform, Celina had built itsown data warehouse and analysis tool. However, after building thewarehouse, the system sat relatively unused.

“It was a great tool, but it essentially was turning over ablank sheet of paper to the users,” Shoenfelt says. “The solutionwas extremely flexible, but users had to build the analyses anddevelop the reports themselves. They wanted something that was'precanned' instead.”

iPartners provided those prebuilt analyses. “They have asolution for insurance companies that allowed users to jump rightin,” Shoenfelt says.

The system, which leveraged the foundation created by the datawarehouse project, took about three months to deploy, most of whichwas related to data scrubbing. The application loads data providedby a weekly extract from Celina's policy and claims systems anddisplays analyses through a Web interface that is used by Celinatop management and product managers.

For Celina, the usage-based model has delivered significantbenefits. First, from an expense standpoint, the business can seewhat using the system costs and be charged that cost, rather thanhave IT absorb the expense in its budget.

“When you have to write a check for a specific item of usage,it's no longer just an IT cost that's 'free,'” Shoenfelt says.“It's also a time issue for us. We have only so much time to buildthings, so [using SaaS] gives us more time.”

From a management standpoint, Celina can look at who'srunning–or not running–analyses. “This has been an eye-opener of anexpense to them,” says Shoenfelt. “They can decide whether it makessense to pay for a user license for someone who's only going to usethe system once a quarter or ask why some managers aren't using thesystem if their colleagues are.”

Celina's strategy for SaaS in general is to use it when it givesthe company an advantage and own the system when it does not.

“You can get to market faster with SaaS and then decide whetherto keep it off site or bring it in-house. With the [iPartners]system, we're going to keep it [off site] unless we get too manyusers or the demand for customization is too high and it makessense to do it ourselves,” Shoenfelt says.

SaaS has been a bridging technology for Celina in the past. Inone case, the company licensed a rating engine to use for its Webportal in order to obtain faster speed to market. But later, withthe portal in place and not wanting to maintain two systems, Celinachose to extend an in-house engine to process data from both theWeb and the internal quote system. Likewise, Celina had used aservice to store electronic documents until the cost of storagedropped to the point where it made economic sense to bring thatservice back in-house, as well.

Another area in insurance where SaaS has seen somewhat strongerdeployment is in support of specialized lines of business orgreenfield operations, such as new lines of business or entirelynew companies.

In those areas, “SaaS is a leveler,” says Andrew Berry,president of management consultancy Newport Risk Services. “Smalleror boutique players can afford more sophisticated technology. Oneof the areas [SaaS] is very appealing is in a startup situation. Itreduces your upfront fixed costs.”

Lexington–one of the largest excess and surplus lines insurersin the U.S.–is neither a small company nor a startup, but it doeshave specialized lines of business for which traditional policyadministration systems simply aren't designed.

“If you insure a 2008 Chevy, throughout the life of the policyit's still a 2008 Chevy. But a racehorse will change inclassification throughout the life of a policy. The racehorsebecomes older. It may become pregnant. There are thousands ofpotential factors that can change the classification of aracehorse. We also need to have the ability to create custompolicies and otherwise deviate from standard products,” Valleexplains.

To customize one of parent company AIG's systems to handleLexington's bloodstock market wasn't a viable option. “It didn'tmake sense to modify a [corporate] system that was built to handlea multibillion-dollar book of business to accommodate amillion-dollar book of business,” Valle says.

A SaaS-delivered admin system was the best option. Additionally,the Maple Technologies platform was flexible enough to handle theunique needs of racehorse insurance. “Maple Technologies simply wasable to handle all the customization we required,” Valle says.

ADVANCING SAAS

Despite low levels of SaaS adoption today, Harris-Ferrante doesexpect to see an increase in interest among insurers, particularlybecause of current economic conditions.

“As the market crisis happened, we've started to see morecompanies look to SaaS as a way to get functionality when theydon't have as much money to spend and need faster implementationcycles. They also perhaps are becoming a bit more risk-adverse whenit comes to buying new technology and are looking at SaaS in 2009as a solution that doesn't require paying upfront cost in softwarelicensing. It's still not a mature trend, but we've seen it beginto develop,” she says.

Insurers will continue to need to gain a level of comfort theyhave managed any risks of SaaS.

“You are ceding some kind of control [with SaaS], even thoughthe risks perceived and actual risks are different,” Goldberg says.“However, if you are considering a well-documented SaaS system anda vendor you trust, it's ultimately not much different having itrun on your or the vendor's server.”

Carriers also have to contend with the human factor. “The biggerchallenge to SaaS is the organization's culture and history. Thereis a hesitation on the part of insurance companies because of thetraditional nature of IT organization and application development,”says Harris-Ferrante.

“For many insurers, it's still a new way of thinking. It'staking the traditional IT model and stepping back; saying, OK, uptill now, I owned this 'kingdom,' but now I need to open up myenvironment,” Cardenas points out. “That's a hard thing for peopleto do.”