Assessing risk before you buy software: Is company risk inversely related to company size

I recently stumbled across this article which got me thinking about the risks organizations take when they buy technology products and what kind of risk assessment process is conducted. Our company sells application security assessment software to people who are experts at managing IT security risk, so I’m curious to hear what others think.

11 Companies On the Edge in 2012
#8 on the list.
Hewlett-Packard. Stock decline: 38 percent.
“HP is on its third CEO in less than two years, with the turnover reflecting strategic confusion that has impaired earnings, enraged shareholders and raised concerns that HP is too unwieldy to be run effectively. With operations in many business and consumer markets, HP has numerous competitors that have been nibbling market share, leading to disappointing results likely to continue into 2012. Some analysts worry that a heavy focus on acquisitions in recent years has left holes in HP’s new-product pipeline. New CEO Meg Whitman may enjoy a bit of a honeymoon, but she’ll need to prove herself by the second half of 2012.”

1. I have nothing against technology conglomerates and believe that they fill an essential role in our economy.
2. At various times in my own company’s history, HP and its subsidiaries have been customers, partners and vendors.
3. I have personally purchased and used many HP products over the years and am a fan of Meg Whitman for her work at eBay.
4. My company directly competes with HP in the application security space as I mentioned.
5. I am co-CEO of a privately held company that has been profitable for over six years.  Now on with the post.

The common wisdom seems to be that when purchasing technology products there is little or no risk with large firms and significant risk with smaller firms.

In my experience, this isn’t really true.

Let’s look at the varying types of risk in purchasing technology (this is not specific to application security technology)

• Technology and Support Team Risk – With any technology, particularly complex technologies, there is a huge risk that the team responsible for creating that technology will change for the worse, and later versions of the product will get worse over time after the customer has spent a significant amount of money for a perpetual license where the product is supposed to last 3-5 years or more.  Customers expect to be able to get ongoing support for the product that they have purchased. This is particularly important with more complex products.

• Bankruptcy Risk – Obviously, if a company goes bankrupt and is dissolved, there will be no further upgrades or support.
• Strategic Risk – Companies can decide that the product purchased by the customer does not meet its overall strategy and end-of-life the product. Upgrades will be limited and support will likely wither during the last years of the product’s life.
• Layoff Risk -When companies effect layoffs, products can suffer, which impacts both the technology on an ongoing basis as well as the support.
• Risk of Sale – When private companies sell to larger companies, there is always the risk that technology and support teams will leave. This can even be the case if their shares vest over time if there are significant cultural or power conflicts or if the incentives are insufficient.

Let’s look at these risk factors by firm size, profitability and recency of technology acquisition:

Unprofitable Private Companies

• Technology and Support Team Risk – Generally this risk is less because the core team has a significant equity stake in the company and will stay so long as the company has funding.
• Bankruptcy Risk – This is the most significant risk. Pre-profitable companies rely on investors to fund losses and investors can be fickle. If funding dries up, the company can be forced to sell (in which case the team may leave) or liquidate.
• Strategic Risk – Smaller companies typically have few products so this is a minimal risk.
• Layoff Risk –  Smaller companies can cut back on growth if they cannot raise funds, harming development and support.
• Risk of Sale – This is a significant risk.

Profitable Private Companies

• Technology and Support Team Risk – Generally low because of equity incentives. Support can suffer with rapid growth.
• Bankruptcy Risk – Less than for unprofitable private companies for obvious reasons.
• Strategic Risk – Again, generally a minimal risk.
• Layoff Risk – This can be a risk, although less than for unprofitable private companies.
• Risk of Sale – This is the most significant risk. Most private companies do not go public and there is always the risk that the founders of a profitable private company of sufficient size will cash in and move to an island, harming the technical and support capabilities behind the product.

Large Company with Newly Acquired Technology

• Technology and Support Team Risk – This is a significant risk.  Technology companies suffer significant attrition in their technical staffs post-acquisition.  Some founders leave because it is more lucrative to be an entrepreneur and some leave because they no longer have to work. For others, the work at large companies is not challenging enough and the entrepreneur in them feels stifled.
• Bankruptcy Risk – Generally minimal.
• Strategic Risk -This is a small risk short term.  See below for the longer term risks.
• Layoff Risk – This is potentially a significant risk depending on the financial profile of the company.
• Risk of Sale – Less of a risk than for smaller companies.

Large Company with Longstanding Technology

• Technology and Support Team Risk – After a while, the creators of the technology leave and are replaced by a team that wants to work at a larger company.  This can be good or bad but is generally somewhat stable.
• Bankruptcy Risk – Generally minimal.
• Strategic Risk – This is a huge risk.  Large companies go through strategic review constantly.  Many products exist as parcels in larger groups controlled by a single executive or executive team.  When turnover occurs, priorities change and centi-million dollar acquisitions can be written off like week old bananas.  We were partnered with a company that wrote off a $150 million acquisition after 3 years because it didn’t make strategic sense.
• Layoff Risk – When large companies are in financial trouble, they tend to cut across the Board which can significantly impact product quality and support both from a pure numbers as well as a morale standpoint.
• Risk of Sale – Less of a risk than for smaller companies.

To sum up, the issue of company risk in technology purchases is far more complex than is ordinarily assumed.  The saying, “no one ever got fired for buying IBM” may not necessarily be true.  Conversely, I’m not arguing that buying from small companies because they are small makes any more sense than buying from large companies because they are large. IT professionals must evaluate the risks of the companies with whom they are doing business on a case by case basis.