The sheer number of cloud players – or companies that claim to be cloud players — is staggering. By some estimates there are more than 2,000 software as a service (SaaS) companies alone. At this early point in the cloud revolution, there are certainly front runners, but the field is wide open.

Public cloud security: Mission impossible?

For example, the marquee SaaS player, Salesforce.com, owned a paltry 8.7% of the total SaaS market, according to a 2010 IDC report that tracked 84 vendors. Other big names –Intuit, Cisco, Microsoft, Google and Symantec – were all below 5% each. That leaves scores of other competitors with tiny market shares today, and no place to go but up.

Slideshow: 10 most powerful cloud companies

Infrastructure-as-a-service (IaaS) has more than 30 major players, both pure-play outfits that provide pay as you go, on-demand compute services, and those rising into the cloud from the traditional managed services realm. And Forrester research is watching at least 40 platform-as-a-service (PaaS) providers who say they can help developers build cloud apps better, stronger, faster.

To further muddy the waters, many vendors are extending their cloud offerings across the neat SaaS, PaaS and IaaS boundaries. (Read SaaS and IaaS: an expert’s guide.)

“It’s true that most of the disruption caused by cloud computing relates to enterprise [operations] and IT. But it’s also been pretty disruptive to the vendor community as well,” says David Mitchell Smith, vice president and fellow at the Gartner Group.

Smith believes that a tremendous shakeout will occur over the next year or two. He predicts that by 2013 a small handful of vendors will emerge as leaders delivering both enterprise systems and cloud services.

So who are those vendors? The two names on Smith’s short list are Microsoft and VMware.

Smith argues that Microsoft made a seismic shift to a SaaS delivery model in 2008 and has since delivered Microsoft Office365, SharePoint Online, and Microsoft Dynamics CRM Online. In the PaaS arena, Microsoft is pushing its Azure platform of AppFabric, SQL Azure and Windows Azure. And, Microsoft’s making headway in pushing Azure down into the IaaS space as well.

VMware’s vSphere hypervisor and management software has long provided trusted virtualization capabilities in the enterprise. VMware is also making a strong IaaS play by building anetwork of vendors who use vCloud to deliver cloud compute services.

And VMware has various PaaS irons in the fire. There’s its own vFabric PaaS platform. Plus, the company launched CloudFoundry, an open PaaS platform housed at www.CloudFoundry.org where developers can contribute to collaborative open source projects. And there’s a hosted PaaS platform operated by VMware at www.CloudFoundry.com.

“There are no guarantees in a market this size, but we see [Microsoft and VMware] as the companies in the best position now,” Smith says.

The SaaS landscape

SaaS is the most mature cloud layer and, in fact, existed well before the term cloud computing gained prevalence, says Robert Mahowald, Research Vice President of SaaS and Cloud Services at IDC.

Mahowald makes these two observations about the state of SaaS today: Most enterprises are looking to SaaS for “net new” applications, not as a replacement for existing apps. And many software vendors are developing their products to be consumed via the cloud first, and for on premise consumption secondarily, if at all.

IDC says the 2010 SaaS market rang in at $16.6 billion, a figure that represents three-quarters of all IT-based public cloud revenue. IDC predicts that by 2015, worldwide SaaS revenues will skyrocket to $53.6 billion annually.

“The SaaS market has solidified because it just makes financial sense for both the provider and the consumer. That combination always drives adoptions,” says Robert K. West, founder and CEO of Echelon One, an IT security and risk management consultancy.

Vendors with an edge today tend to be those that developed their products to run natively in the cloud. They were built to take advantage of the cloud’s elastic nature, to be sold on a usage-based model, have multi-tenancy as a basic tenet so that security is constructed accordingly, and have worldwide reach and a resilient infrastructure underneath the covers.

Companies held in high regard for their SaaS offerings include Salesforce.com (CRM), WorkDay (HR and financial management), Google (desktop productivity), Oracle (business analytics), Concur Technologies (travel and expense management) and NetSuite (ERP).

That’s not to say that the traditional enterprise software giants such as SAP and Oracle are out of the race. But they are playing a bit of catch-up. Some of the tension between those two camps came to the fore in the recent dustup between Salesforce’s Marc Benioff and Oracle’s Larry Ellison.

“The SAPs and Oracles of the world are trying to adapt their existing software to the cloud, which is extremely difficult and time consuming,” says Joe Coyle, CTO of Capgemini North America, a consulting and outsourcing firm that helps enterprises deploy cloud services. He argues that the process of putting these applications in the cloud is not difficult, but getting them to take advantage of the elastic nature of the cloud, is.

“Getting an SAP application to know there is more compute power available when it needs it, is the challenge,” Coyle says. Until those applications are reworked to understand what is dynamically available to them, they will lag behind the SaaS leaders, Coyle says.

On Saturday, SAP made a major cloud move, spending $3.4 billion to buy SuccessFactors, which offers an increasingly popular set of on-demand human resources applications. Analysts say the move by SAP could bring its entire cloud software portfolio into a new focus.

Paul Turner, senior product manager at NetSuite which has 10,000 customers using its SaaS-delivered ERP software, says there are several tell-tale signs of a “false cloud” application. Turner says a native cloud application is completely Web-based, from the user experience through to the administrator experience. “It needs to be as easy to access as Gmail,” argues Turner.

Secondly, the service must offer a customization layer that allows enterprise IT to make the tweaks to suit its needs, and those changes must migrate seamlessly with each upgrade to the service. And finally, Turner argues there must be a high level of transparency about any downtime and security issues.

SaaS begets PaaS

Many of the leading SaaS players — Salesforce.com, Google, NetSuite, and WorkDay — are trying to solidify their positions within their market segments by developing PaaS environments for third-party ISVs.

For example, Salesforce launched Force.com, a PaaS offering built to support its SaaS service; then bought Heroku in order to provide a more open PaaS service. The company claims 200,000 apps built on the Force.com platform.

“We’re adding developers daily,” says Byron Sebastian, executive vice president of platforms at Salesforce. The hot area is mobile applications running in the public cloud, he says.

The hurdle Sebastian encounters when pushing PaaS into the enterprise is inertia. “We get a lot of pushback from folks who are just used to doing business the old way,” Sebastian says.

A second segment of the PaaS market comprises general purpose development platforms that support multiple languages and cloud infrastructures, says Krishnan Subramanian, an independent industry analyst and blogger at www.cloudave.com.

Microsoft’s Azure and Google’s App Engine are leaders in this category, Subramanian says. The hot start-ups are CloudBees and Engine Yard, he adds.

And Subramanian believes VMware’s CloudFoundry shouldn’t be counted out, as the field shakes out over the next 18 to 24 months, because it espouses the open source approach popular with the developer set and cash-strapped start-up software companies.

But it’s still very early in the game.

Forrester analysts John Rymer and Stefan Rein describe the PaaS market as sprawling, fast-changing, and very immature. There’s little agreement on what comprises a PaaS in the first place, most PaaS vendors are small, some of the bigger ones have relatively immature products, and other major vendors like IBM, RedHat and Oracle have only recently entered the market.

Forrester divides the PaaS world into four categories, with some vendors competing in multiple segments.

In the largest group, software developers are allowed to use their current tools of choice locally and then push code out to the cloud. Playing in this segment are ActiveState, Appian, Force.com, Google, LongJump, Magic Software, Microsoft, NetSuit, OutSystems, Servoy, TIBCO, Vaakya, VMware, Wavemaker and WS02.

Then there are cloud development environments where everything happens in the cloud. These PaaS offerings are browser based and developers build applications in a remote data center cloud. The players here are Appian, Cordys, Force.com, Inuit, Trackvia and WOLF Frameworks.

Some companies target business experts, not “coders”. Caspio, Cordys, IS Tools, Mendix, Orange Scape, WorkXpress and Zoho provide tools for creating applications without coding in order to speed up app delivery times.

The last category allows developers to use whatever tool they want to build their cloud applications and the platform tackles the deployment, scaling and management of these apps in the cloud data center. The players here are Amazon, Appistry, Apprenda, CloudBees, Cloudsot, Engine Yard, Gigaspaces, Heroku, IBM, Joyent, Microsoft, Red Hat, Standing Cloud, TechCello and VMware.

Rymer notes that enterprise IT should act cautiously when it comes to PaaS because “start-ups are risky and big vendors move slowly and may use their PaaS offerings simply as calling cards to sell their current products.”

Rymer says the two companies likely to enjoy long-term success in the PaaS market are Microsoft and Salesforce. “Every other vendor is a long-term risk,” he adds.

If enterprise software developers do want to push forward, Rymer offers these tips. Find out how well the vendor supports “the ilities”: security, scalability, availability, reliability and serviceability. Next, determine how each PaaS service jibes with the enterprise’s existing application development talent. Finally, nail down what benefits PaaS is likely to provide. “Cutting costs is a hard one to obtain. Time to market is relatively easy to obtain,” Rymer says.

IaaS free for all

IaaS is currently the smallest market of the three major cloud categories, but is expected to have the fastest growth rate over the next three to five years. Gartner says last year’s total of just over $2 billion will grow by that much for each of the next four years.

The 800-pound gorilla is Amazon. Competitors see EC2 both as an ingenious use of surplus compute power and a nemesis to be defeated by the marketing mantra that says a mass-market retailer simply cannot cater to the complicated needs of enterprise customers.

But this market is evolving to be more complicated than simply Amazon vs. the rest of the IaaS world, says Lydia Leong, research vice president at Gartner.

“If your differentiation is ‘we’re not like Amazon, we’re enterprise-class!’, you’re now competing against dozens of other providers who also thought that would be a clever market differentiation. Not to mention that Amazon already serves the enterprise, and wants to deepen its inroads,” wrote Leong in a recent blog post.

Leong is Gartner’s go-to author when it comes to analyzing the IaaS market. Her report last December on the cloud IaaS and Web hosting provider market (encompassing private, public and hybrid cloud services) identified AT&T, Rackspace, Savvis (purchased by CenturyLink), Terremark (purchased by Verizon) and Verizon as the market leaders. Visionaries were Amazon, CSC, GoGrid, IBM and Joyent.

A new report (which was not yet made public at press time) analyzes a sub-category of IaaS vendors that offer automated, multi-tenant services for scale-out cloud hosting, virtual lab environments, self-managed virtual data centers, and turnkey virtual data center services. Rackspace, AT&T, Savvis, Terremark, Verizon (with its home-grown Computing as a Service), and OpSource are the big names in this market.

“The separation [of these segments] is grounded in the fact that some vendors provide very good infrastructures without any services and others get the managed services right, but don’t have very good clouds,” Leong says.

The traditional, old-school telecom carriers are sometimes seen as dinosaurs, but Coyle says they shouldn’t be discounted. “Just think of who controls all the bandwidth, right? It becomes a no brainer then,” Capgemini’s Coyle says.

The carriers have another advantage over cloud newbies: long-term relationships with enterprise decision makers. “When it comes to the cloud sale into big enterprises, we already have a seat at the planning table as a trusted service provider,” says Steve Caniano, vice president of AT&T’s hosting and cloud services.

AT&T, British Telecom and Verizon lead the pack of carriers in the cloud to some degree, but in terms of building out reliable IaaS-focused data centers, Verizon is the most advanced, Coyle says. He argues that the point of the Terremark purchase was not the extra data center footprint, but the management services that Terremark wraps around its IaaS.

Managed services are where the real money lies for cloud vendors, says Coyle, adding that the Amazon’s of the world are driving prices down so low that the carriers will not be able to compete on raw compute power alone.

“IaaS companies are starting to realize they have to offer these managed services – or at least create APIs so you can have management software plug in and monitor these clouds like you do your internal assets — to get into the enterprise and pull in their next level of business,” Coyle says.

Rackspace was so confident that customers would be willing to pay for these wrap around services like application deployment, deep system monitoring and unified hybrid cloud management, that the company spearheaded the OpenStack project to make basic IaaS platforms interoperable.

As vendors try to hone their competitive edges, customers are finding that they’re not limited to one IaaS provider.

Shelton Shugar, senior vice president for SaaS at CA Technologies, oversees IaaS vendor selection. “You have to factor in each IaaS’s scale, global footprint, quality, price and the flexibility in which they can adapt to your particular project.” The answers to those questions will vary with the scope of each cloud project.

Having multiple (he advises not more than three or management becomes a nightmare) IaaS providers will become common place, says Shugar, who divulged his company uses Rackspace but declined to name the others in CA Technologies’ multi-vendor IaaS strategy. Having multiple IaaS providers gives CA better worldwide coverage and a bit of an edge in negotiating favorable terms.

“It’s good to have a couple of IaaS providers working for you to share the load,” says Doug Harr, CIO for Splunk, a data mining and indexing software developer in San Francisco, which also runs all of its business operations in the cloud via Netsuite’s SaaS offering.

Harr explains that Amazon is the company’s default IaaS provider because its service is so wide and deep. “But every project brings a new evaluation, so the choice is wide open based on the use case,” Harr says.

And that seems to be the prevailing wisdom at this point. Enterprises looking for cloud services should check out the big names, but should also take a good hard look at the many innovative cloud start-ups.

By Christine Burns, Network World
December 05, 2011 12:06 AM ET

Burns is a freelance writer and editor based Carlisle, Pa., who has over 15 years experience covering the networking industry. She can be reached at cburns1227@googlemail.com.

Read more about cloud computing in Network World’s Cloud Computing section.