Vendor Lock-in, Says This CIO, Can Be an Innocent-Looking Snare

By Bill Willis, CIO, State of North Carolina

When I was a kid, I used to read swashbuckling stories in which it seemed as if someone was always getting stuck in quicksand. It was either the hero (who would devise some ingenious method of escape), his paramour (who would have to be saved by the hero), or the villain (whose demise would signal the end of the adventure). No matter who it was, the common denominator of their predicament stayed with me: the more they struggled, the deeper they sank.

Now, as an adult, I spend my days thinking about budgets, processes, architectures, business relationships, and cultures. Recently, after a long meeting with a vendor about changes in licensing policy, I thought of those adventure stories and realized that I had encountered a really big patch of quicksand, otherwise known as vendor lock-in.

There was no way to avoid the encounter. As the provider of the de-facto standard in the market, the vendor could not be ignored. But we could, and should, manage the extent of the relationship—that is, how deeply and how tightly we get involved with it. And we need particularly to manage how much we allow that vendor, or any vendor, to set our technology policy.

The extent to which we were locked into any vendor was far different when I worked for a small startup. Back then, with little cash and relatively short-term exit strategies, it was easy to jump on a vendor's wagon and ride along as we built the company. In that situation, you don't have to optimize over the long run; you just have to get up and running quickly. The risk of being under the thumb of a vendor paled in comparison to the risks of depleting your cash or failing to sustain a customer base.

When a company reaches a certain size, you have a multitude of options. Frequently, your company is purchased and you make the transition to the buyer's technology. Or you can reconsider the kinds of applications you now need and make the transition to applications that are better suited for midsize or enterprise companies.

But in a state government, there is no exit strategy. Processes, once established, are usually in place for the long haul. Our number of users is huge, and small changes in license policy on a per-seat basis can result in millions of dollars in costs or savings. In a company with 50 people, if you drop your per-seat cost by $10, you probably don't save enough to justify the time you spent negotiating the deal. But if I have 50,000 seats and can reduce my licensing fees by $10, that's $500,000. That makes negotiating worthwhile.

Of course, it means you have to be willing to negotiate. Sometimes the quicksand isn't obvious, and it seems simpler or even more prudent to hand over power to the vendor. For instance, most vendors who sell us PCs have also offered to provide the management of assets as a service with their products. It sounds very enticing. But taking that route meant losing the commodity aspect of PCs, and changing vendors would have required significant changes in how we did business.

Vendors, in effect, want to de-commoditize their hardware. They naturally want to differentiate themselves with services and other value-added capabilities in order to capture larger shares of our business. That's good for us because it spurs competition and creates attractive services and capabilities. But when we become dependent on them, we lose the commodity aspect of the market.

We were reminded of this recently when we launched an asset management program that will eventually track and manage hundreds of thousands of hardware and software components. We bought this software through a competitive process and will run it ourselves.

Fortunately, we have already generated enough savings from the bulk purchase of PCs to pay for the asset management system. By controlling our assets with our own process, we can move from vendor contracts as needed without changing what our people do every day. You have to be willing to retain control of what's really yours and not cede it to vendors. Vendors will make giving up control sound attractive because you won't have to choose. But you also don't getto choose.

We have lots of discussions in our business about enterprise architecture, adaptive computing, and planning. How often do you hear a conversation about managing vendor control over our environments, and minimizing the ways in which their products and market goals drive our business operations? Not often.

We should engage in those discussions. If we do not, we'll keep finding ourselves struggling in quicksand.