Honest, I don’t want an email security appliance!

Ever wonder why your vendor or reseller is always pushing you to buy an email security appliance instead of just the software? On the surface they will give you one set of reasons but those are not necessarily the real ones.

Why do vendors/resellers push appliances?

1. Including hardware in the sale brings a higher price and therefore higher revenue overall for the vendor
• The hardware markup applied to the cost is of no value to you
• You could probably get a much better deal on your own in terms of performance for dollar.
2. Including the hardware in the sale makes for easier segmenting and tiering
3. Appliance is the format preferred by large direct market resellers
• This is how they leverage what they are very good at, which is logistics. Logistics are critical when you are moving a large box across the continent, less so if you are just pointing to a download.
• These direct market resellers are the traditional partners of the large vendors who have a very large portfolio of products to sell through them, recognizable brands that tend to need little promotion, and still use MDF (Market Development Funds) to further promote the products
4. Large suppliers can leverage economies of scale on hardware that cannot be achieved by smaller players
• This economy is not necessarily passed on to the customer
• This can be considered a barrier to entry for smaller players, and at the limit even be seen to reduce innovation.
5. Vendors that base their system on open source components (e.g. Linux, SpamAssassin, ClamAV and others) use a loophole in open source licensing to deploy their solution without having to expose the source code
• If they sold as software, then they would have to include the source code, including that for their own components.
• This way, they benefit from open source without providing value back to open source, which is not in the spirit of those licenses.
6. They can take advantage of the perception that an appliance has increased security over a software installation
• In fact, most of the time the extra security is there to keep the customer out.
7. They force you onto their own hardware cycle of obsolescence.
• ‘No, don’t upgrade the software; just buy this new appliance!’
• ‘Need more users? Well, you’re going to need a bigger appliance’
8. If you need standby units, guess what, you’ve got to pay for more hardware
9. Selling a closed system requires a lot less support
• The solution in most cases is to just send another box

Here are some of the benefits they claim you get, but are they real benefits?

1. Simpler to install?
• Only to a certain point. Yes, the application is pre-installed. It still requires some configuration and you do have to physically install the new server.
• If you have a rack of servers available or better, a set of virtual servers, you have to go through the installation, although vendors have significantly simplified installations and will often do it for you.
2. Easier to maintain?
• Not really. Just try to do backups, migrations, or specific h/w upgrades. Increase RAM, or install a new disk? Better get a new appliance.
• For Linux-based systems, you will be hunting for the root password any time you will have to do some serious digging and won’t be too happy every time the manufacturer asks to ssh to your system.
3. More secure?
• More perception than reality
• True in cases where you have no IT admin, or there is real inexperience. Any IT admin worth their salary should be able to secure a separate server running an email security gateway. Companies offer hardening scripts to make sure the OS is protected.
• A virtual appliance will be pre-hardened anyway and, if you receive it as an image, installation is a simple file import.

There definitely is an emotional aspect to choosing an appliance. You receive something tangible that you can pull out of the box, hey, a new toy! You get a fine looking machine, with a great looking bezel and maybe some cool flashing lights on it. You can point to it in your server rack when someone walks by and tell people that it’s the thing that protects them from all the bad stuff that comes in through email. You’ll feel proud. Still, you might ask yourself: if appliances are so secure and so convenient, why don’t all companies that sell server software sell it in an appliance package? (Think of an Exchange appliance from Microsoft or an Oracle DB appliance)

Now you’ll ask me: wait a minute, doesn’t your own company sell appliances? Well, yes we do. One of our major large resellers required an appliance for channel sales a few years back and we complied. We now try to educate our customers on this and always try to meet their needs and requirements. While we are moving away from appliances and see much more software and virtual machine installations, we still want to satisfy those that love our technology and service, but really insist on having a shiny new appliance.

Where do you stand on this? What are your reasons for preferring appliance over software, or software over appliance?