#83, The evolution of SaaS: MD of The Business Software Centre (TBSC), Phil Hames

0:00I did see a speaker talking about the next global world power. And he was saying, it's not going to be China. It's not going to be Russia. It's not going to be the States. It's going to be the IT industry because already the IT industry can affect what's going on.

0:21So aside from the Tech Leaders podcast, some of you may be aware I am a director at Be Digital. We are a software licensing specialist amongst a couple of other things. But I was really keen to get somebody on from the world of software. It's a fascinating world. It's growing exponentially year on year. So Phil Hames meets that description. Phil has worked in the software industry since the late 80s and has witnessed the evolution of the industry from mainframes to cloud through to generative AI and everything in between. Following a successful career working for the likes of Xerox, Phil set up his own software business, took the plunge in 2004 working closely with software juggernaut Microsoft.

1:05We discuss software asset management and licensing, what that is and what is important for technology leadership teams. We discuss shadow IT, the history of software as a service and that model, and how Salesforce played a pivotal role in developing that model. Plus, we talked about the new Microsoft product, Copilot, which is a fascinating product and is going to be a real impactful step forward in how we interact with Microsoft products going forward and much, much more. It was a joy to chat. It's Phil Hames.

1:45Phil Hames, thank you so much for coming on the Tech Leaders Podcast. It's a pleasure to get you on. As software entrepreneur, we've collaborated on a couple of things, not you and I personally, but our company and yours and very inspired by your journey and what you've built at the Business Software Center. Let's start with this one, as we always do. What does good leadership mean to you, Phil? Yes, I think good leadership is really setting some clear goals and targets and then getting everybody to understand where we're aiming to move towards and they know their part in achieving that and they're able to measure their progress in achieving those goals.

2:26It's really about goal setting and achieving the goals. So I think that's probably my overview of it. Yeah, clarity and basically setting what's important and getting on the boat to row there together, I suppose, isn't it? Okay, so for the listeners who are not so familiar with yourself or Business Software Center, could you please give us a bit of an introduction? Yeah, so I'm the director of TBSC and also the founder. We've been going for about 20 years. I started off really in the IT business probably about 40 years ago. So at that time, software was coming in boxes and it was all on the floppy disks and distributed, sold as a packaged product.

3:07So there's been a lot of changes since then. I can remember the days before Windows even came in. So I've seen a lot of changes and it's been an interesting career to have. So in terms of how I got into computer software, my first program that I created was way back when I was at university. I was working for a year in an electronics factory, and I did a program on a PDP-11, which sorted the costs of components for an electronic device. and we then re-engineered that technology and i wrote the program for it and was able to do pareto analysis off the back of that but it's very simple probably the computer was as big as a wardrobe and had less power than your mobile phone but we were able to do some good work with it and re-engineer the the technology i'm keen to talk to you about xerox i understand you were there in the late well you joined there in the late 80s worked for there for quite some time really like legendary american company i understand they invented the mouse didn't they and then microsoft and apple stole it but there's lots and lots of innovation that's come out of xerox what was your time like there what profound lessons did you learn from your time at xerox which you used later in your career you're quite right that xerox invented a lot of uh technologies so they invented something called star and this was in their palo alto labs and it had windows mouse icons as an environment i think steve jobs was working there and saw it and said this is incredible really and xerox didn't know what to do with it they said yeah but how's it gonna help us to sell more photocopiers whereas i think steve jobs saw it and saw the potential of it and then rewrote it all and of course you know then windows came out as well so it was a forerunner so they were very inventive they invented lots and lots of things at xerox so i joined xerox um i mean you're probably aware that their background was photocopiers and i joined xerox as the product manager for uh their software so they'd acquired some software like ventura publisher was probably the most well known and they did quite well with pc-based software and my role was really supporting the channels area uh launching the products for the uk market working with distributors that was my center of competence i then uh moved into other areas uh for instance when the berlin wall came down then xerox was really very active in eastern europe and Russia.

6:00And that was my area looking after Eastern Europe and Russia for printing systems, laser printing systems. So it gave me a great opportunity to travel across Eastern Europe and Russia, India, Africa at a time when everything was changing. It was a time of changing from communism to capitalism in those countries. So very interesting. Probably the greatest lesson I learned from Xerox. The technology of Xerography was invented by a chap called Chester Carlson. So he invented the photocopier and it was the basis for laser printing. I thought the guy who was the really clever guy was the one who thought to put a little meter on the photocopiers.

6:45So it meant they didn't charge people for buying a photocopier or a laser printer. They charged them for the amount of prints i did so it was really the value of recurring revenue streams and they set minimums so you had to have a minimum so it was the recurring revenue streams and that's really why i found very interesting for software because software as you know changed from outright sale to subscription selling with sas so that was the sort of great lesson that xerox taught me wanted to ask you about the history of saturday this is the real embryonic period for for software as a service, isn't it?

7:23And I think SaaS represented a shift from the traditional software deployment methods. But I'm just keen to understand, Phil, how did businesses initially react to this new way of accessing and using software? What were some of the early challenges around widespread adoption of software as a service? Yeah. So my job before setting up the Business Software Center or TBSC was working for Intuit and our primary product was QuickBooks for small businesses and at that time I worked with Barclays Bank and some other banks and what we started to do was make available QuickBooks for small businesses on a rental basis and so it was on a subscription business and obviously at that time it was all loaded onto their own devices and then they could use it as their small business accounting system.

8:20And the problem was always, how do you manage to sort of control or even turn off the software if people stop paying for it? Now, with the advent of cloud and the hosting of it, then it became a lot easier to control the subscriptions. And one of the big problems at the beginning was people trusting having their data in somebody else's environment. and that was the big thing to overcome. And I think that's probably still one of the issues that SaaS organizations have to face with some organizations, particularly with the security issues that are now happening because it's still the customer's data.

9:01Yeah, sure. And the customer has to realize that it's their data. So if they've got it in Azure, Microsoft is not responsible for their data. They're just hosting it. The customer is still responsible for the security of the data. And I think that's always going to be one of the big issues. I completely agree. And I'd like to come back to that, Phil, because I think the security piece is an important piece, especially in light of the products you develop. But I think just going back to the sort of evolution of the SaaS industry and how SaaS has basically evolved across mobile platforms and everything.

9:34But what were the sort of key milestones, do you think, in what products really pushed SaaS from a periphery fringe model? What products pushed it into the mainstream? I think it was really Salesforce. The story goes that there was Larry Ellison, Oracle, with a couple of his senior managers, and they were talking about how things were going to go in the future. And I can't remember the names of the guys. I do have it somewhere. But the two guys were saying about the future and for software as a service and moving towards hosting the software rather than it being on the customer's own devices. And the guy who set up Salesforce was one of those guys.

10:16And he started then with it and set up the business. And the rest is history. Of course, Microsoft saw what was happening and then decided they had to be in on the cloud aspect and then moved towards SaaS. But I think other organizations pioneered it. And I can remember when I was at Intuit and we first did this rental of our software, the senior management said no no we've tried all of this rental software it'll never work it'll never work um and then after the success that we had with barclays bank then they said yeah this is really important this is this is a great success so they then looked at a sas version and i think all all organizations started to do this you know everybody suddenly realized sas was the model where you should go and of course having the platforms like azure yeah has made it a lot easier because like for us we can just develop the technology a lot faster and then put it onto azure and it's very quick to deploy you know we we deploy upgrades every every two weeks and we can add in facilities so those old days of trying to upgrade everybody and keep them on the same version, they're gone.

11:36You just have one platform to look after. So the advantages are there. There are some disadvantages, but the advantages for all software companies were there. And the greatest thing for the commercial model is the recurring revenue streams. Sure, absolutely. What do you think the next evolution is for SaaS then, Phil? Do you see it evolving into something else over the next five to 10 years? Yeah, I think one of the things that, looking at software asset management. When I first was in TBSC, what we first were doing was looking at aspects like software asset management. And the bigger element then was compliance.

12:16And throughout the software industry, it was always compliance. Has somebody got a valid license to be using this? Have they bought 10 licenses, but they're using it on 100 devices? That's largely gone out of the window now, because if you've not got a subscription, you can't use it. The problem for most customers now is the other way around. It's not compliance having enough licenses, it's having too many licenses. Or having a license, let's say that's a pro license, but you're only using the standard facilities. So one of the things for the future is really for customers to understand if they're getting value for money from their investments.

12:55And I think that's something that needs to be tracked on a regular basis. It's not just you can't do it just once when say there's an annual renewal you need to be able to sort of do that on an ongoing basis the other element of course for sas as i've already mentioned is security we concentrate on microsoft 365 and we can see really a dramatic rise particularly september and this month october and just going back into the summer a dramatic rise in the amount of malware and security alerts that are coming into people's tenancies. So this is growing and there's a reason for it to grow because it's highly profitable for the organizations that are doing this.

13:37You know, in many organizations, they've got highly skilled people. They are set up as like a proper business and they're very, you know, they're very professional in what they're doing. I'd looked at one and there'd been some tracking of this organization and through the sort of cryptocurrencies, they'd collected$54 million in the past year. So these organizations are bringing in a lot of money from their ransomware of their threats. So I think for stats, that's going to be the big issue for the coming years, controlling it. And certainly we've seen a lot of growth in security alerts over the past few months.

14:18And that's probably something that customers have sort of said well we've not been attacked yet we've not been compromised yet it's too late when when it happens no that's really interesting so um what what kind of trends are you seeing in relation to cyber security threats phil yeah organizations have been sold security i think on technicalities but there's a lot of common sense things that haven't been done. So one thing that we see is they've got third-party security technologies that are applied to external threats. And then these are applied and in effect, they're sort of going through spam filters and things like that.

15:02But what we see is there are certain IP addresses, certain email addresses and things that for various reasons are excluded from these external filtering. And so it just takes one of those for something to get into the, say, Microsoft 365 tenancy. And then once it's in there, because these third-party technologies apply to external threads, they're not being applied to internal threads. So once it gets onto one device, then it can spread throughout an organization because they've not locked down the internal security and there's things like um you know identity impersonation can happen and then a senior person in the organization can then send out an infected file and it then spreads across the whole organization and that's when it's going to cause an issue and these can be trojans they can be different types of malware it can be ransomware so these infections are in there and then the next thing that people think is a safeguard is they say oh well we've got a backup solution so if we do get compromised or we lose data we can restore all of that data however if they've not cleaned that data then they're just going to reinfect themselves with this infected data so you i think they they fail to look at the holistic aspect of it are there any gaps where people can get through yeah can it spread across your organization and if you have got backup are you cleaning your data and checking that on a regular basis which is something that we try to help organizations to do with our health checks and our services yeah sure what about shadow it phil you're in this term more and more the rise of sort of employees on laptops have their own sas products that they have access to i do it myself outside of the company ecosystem i access for um evernote i know that's just one example but i think there are lots of other examples of it as well what are the hidden threats are out there for companies right now that may not be obvious yeah so you're quite right i mean i did talk to uh i have talked to organizations and they'll say yeah we probably know 50 of what's actually being used you know these are the it people so yeah there are a lot of potential threats there are ways that when we do the security analysis we can check what additional software is being used by users and we can either close them down or allow them and things like that but i think the there are the tools there to do it but the analysis isn't is it being done by most organizations so the tools are already in place and it's then a matter of understanding who's connecting into what environments so you can do this and there is with it certainly i mean we work on microsoft technology so we that's how we know it but you can turn on facilities within the microsoft stack and it'll show all of the in effect the sas applications i think there's something well over 25 000 that are in the service that can easily be identified and you can see who is using which sas services and identify them.

18:20So this is for really cloud app security. So you can do that. But I think that the technology is not being used. Certainly most of the organizations we talk to, they're not being used. There's another issue that is really commonplace, which touches on this, is that many organizations have people come in and go in, maybe contractors, and they sign up for for various services and then they leave, but they've still got access to those services. We did have one case where a salesman left a wealth management company and he still had access and he was able to go back into their services and pull data out about customers and then use it as a way of prospecting and obviously ended up with a difficult situation.

19:06And I do think that organizations have to be really conscious about this because if their data is taken it's not the thief that is really responsible for it it's the customer that's allowed the owner of the data has allowed it to be taken you know so under the gdpr rules you know it's a bit like having your house robbed and it's a person whose house has been robbed who's responsible for for this so i think And this is, again, something that people don't realize. There is a lot of people leaving organizations and they still have access to their SaaS applications. It's a difficult one. It's difficult for businesses to turn the tap off on everything when an employee leaves, doesn't it?

19:47You know what I mean? So I think that's part of the problem. But again, it comes back to having effective asset management, I suppose, doesn't it, across and having provisions in place for all of these type of things. just getting back on to your chronological career journey okay and i want to go back to late 2003 early 2004 pretty important time in your life you obviously see an opportunity and you leave a very stable job at intuit and go to set up your own company talk us about that time in your life phil well how did that come about and how did you get going and what was your initial business plan Yeah, so the time at Intuit, I'd been there for over three years.

20:29The sales had, I think, quadrupled while I was there, and I was the sales director, so I'd had a good time there. The market was changing dramatically. It was changing very much from a sort of retail environment. At that time, PC World, so most of the software, but it was changing. It was a different market. And what I was seeing was a demand for additional small business software. And I started working with another organization from the States called Atlas Business Solutions, who did things like staff management products, HR products, some business planning products. They were complementary to QuickBooks and to other products like Sage.

21:17So I started to anglicize those and distribute those in the UK. So I sold them through places like PC World and Amazon and then added in more products as a sort of portfolio for small businesses. And one of the things that we did very early on was to take this software and allow it to be distributed to small businesses. But we injected a piece of code in it. that meant that the customers could pay for it on a monthly basis or an annual basis but if they stopped paying then we could lock up the software so at that time we couldn't host the software like you do in sass but we did provide a rental system sure and that then became what we called rent soft or rent soft meter and then we could make that available to other organizations so we made it available to other software companies and they were able to distribute their software and they could rent out their software without having it hosted in the cloud and then gradually things started to move to a sort of cloud basis we then had this technology that monitored the usage of software and we were able to meter the usage of software and then report back to organizations if their users were actually using the on-premise software so that's what we called rentsoft meter So it was a bit of an evolution, really.

22:45And then when cloud came along, we were able to put this into a SaaS app. And we worked with Microsoft not to sort of cut the costs necessarily, but customers could do that. But Microsoft said, well, hey, why don't you use it to see if you can get people using the software more productively? And that's what we did. Microsoft gave us some help on that. and we then created smarter sass which really looks at what you're using what you're not using so when did you create that phil we started about four years ago so we took the old technology of rentsoft meter but created it into a cloud technology and we got a government grant to do it and it was just about ready to launch when when covid came in it disrupted things a little bit but we did that about four years ago but you know all the ideas of the rentsoft and redsoft meter were sort of over the past, I would say, 15, 16 years.

23:40But making it cloud and looking at the Microsoft SaaS applications made it a lot quicker and easier for us to develop a sophisticated product. Of course, what's happened is security has become really important. You know, it's not just reducing the cost of or wasted cost of SaaS. It's how can we optimize the security of it? So we've built all those features in. So can you just give us an overview of Smarter SaaS in terms of what it does for customers and also the security product as well and how they fit together? Yeah, so if you think about any tenancy that you've got for Microsoft 365, let's say you've got 1 ,000 users, then the things that you're usually going to check is, are those users using the apps that you've got?

24:25Because if they're not using the apps that you're paying for, then their productivity is not what you expected. So, you know, one of the common things that IT managers say is, I know half my IT isn't being used. I just don't know which half. So we tell them who's using what down to how many calls people do on Teams, how many meetings they attend, how many emails they send, how many they receive. We don't see what they're doing in it. We just give them the quantitative data. We don't tell them we don't know what's inside any of these things. So they can see if people are using it. And then the other thing we spot is that certain people have not used any of their apps for, say, the last three, four, five months.

25:07And then we say, well, could any of these have left? So we can produce that list, and then they can check it against their HR records, and they can recycle the subscriptions. So that's cost management and also security management because they're clearing out people who've still got access. And then the other element is how much data have they got in there? So we're able to say there's so much data, this is what each user's got. And then they're able to put in place backup facilities and look at the security of that data. And our security elements that we've built in are really looking at their defenses.

25:38So their security posture and saying, well, you're at 50 % and the benchmark is 75%. And these are the actions you've got to complete in order to get up there. and then the next is saying to them well we can see over the last six months you've had 350 security alerts and 90 of those are still open and by the way some of them are these particular trojans and this is what they'll be doing so we're able to pinpoint that and say you're wasting money you've got a lot of data in there you're not very well protected and by the way you're already under attack so you should start doing something about this and by the way your backup that you've got isn't really effective because you're backing up infected data.

26:23So we then just introduced some services to say, okay, these are the services we can do, or we can clean it up for you. So just to help them to do it. So either ourselves or our partners will do the services. I don't think customers want to buy another piece of technology. They just want their problems solved. I wanted to ask you about Copilot, Phil. Do you know much about Copilot? And I suppose maybe if we can build this into a broader question about how do you think AI is going to impact Microsoft products and how we access Microsoft products over the next couple of years as Copilot gets more omnipresent?

27:00Yeah, I've been on some calls with some Microsoft partners. And I think at the moment, there's a little bit of confusion, and they're waiting to sort of really see how this is going to develop. So it's a little bit unclear about some of the licensing rules and how they can make full use of it. In general terms, I think AI is really important. I mean, already I know from our marketing, we use like chat GPT to create our marketing materials and it just cuts down the amount of time that you need to be able to develop these materials you know what was taking a half a day is probably 10 minutes now so for the future if we can combine automation and ai then there's a lot that we can do a lot faster and a lot of our work is really around some of the consultancy and by doing automation and also building in some AI then what we can do is enable our consultants to do the work where they're absolutely necessary but all of the analysis we can automate and we can put in there some learnings to make sure that a lot of the consultancy work that takes more time can be eradicated because we're just doing that through AI and automation.

28:36But then all we've got to do is get the customer to approve the changes. So taking out this manual work, I think is going to be a great benefit to us. We should be able to make things a lot better for the customer. Have you had any conversations about responsible AI? I think a very specific concern is if Microsoft 365 co-pilot empowers employees to access information across the organization, how are organizations going to ring-fence sensitive data? Have you looked at that at all and had any conversations about that? I think we're already having conversations about this because certain data within an organization, you can assign security levels to the data.

29:24So like, for instance, in SharePoint, one of the biggest problems that exists at the moment is SharePoint sprawl, where hundreds and even thousands of SharePoint sites have been set up. But they're now maybe not used. They've got data in there, but there's still access. from people who maybe left an organization or from an external user. And really it's about assigning the security levels to the data and then being able to have a way to manage that access on a regular basis. So to get the reports as to who's got access to what data and close it down on a regular basis. At the moment, the manual work that's involved in it tends to put people off.

30:12But we know organizations that have got many thousands of sites that are unused, and they've got millions of files in there. And they're not, in some cases, not even backed up. They don't archive them. So I think what you're saying is quite correct. If you give people more access tools, they're going to access things unless you've sort of assigned various security levels to that data. Yeah, sure. What are you most excited about, Phil, in relation to AI innovation and AI technology? What do you think generative AI could impact most profoundly in a positive way? Well, I think we've already seen it with marketing.

30:53There's a lot more that can be done on marketing. So that's great. Traditional organizations that have spent a lot of time and efforts on traditional marketing. now even one two-man organizations can generate massive amounts of marketing uh over the internet by using some of these ai tools and you know reaching large numbers of people so it's changing the way that marketing works and sales the other aspect around sales is the difficulty for a lot of sales people is just working through all of the issues for customers and then presenting back the information so you know in sales where you go in you're asking the open-ended questions a lot of the times the customers don't have the answers they don't have access to the data what we try to do is is really give our health checks um to our partners and to the customers so that they've got the data to make a decision the right decision on the type of product and service for them so if you can do that for an organization and you can build in the ai that then gives the the sort of the good advice and the choices for a customer it makes the whole transaction system a lot better and then on implementation of services if you can put that knowledge and that learning into the implementation, you mean that it means you're going to give a better service, you're going to be able to make it more cost effective, and you're going to speed up the whole process of resolving issues for customers.

32:34So I think these are the key things. Again, on product design as well, about getting the data and analyzing it, then you can see ways to improve your products for customers. I mean, there's so many things it could impact. what's your general outlook on ai in terms of the replacement of jobs and things like that phil are you are you concerned or are you more optimistic about ai technology innovation have you got any thoughts on that and what roles do you think are potentially at risk i think it's going to be a gradual change we've seen you know since i've been in industry the industry that i'm a massive amount of change.

33:16At one time, if you went into any large organization, there was a typing pool and you had maybe quite a number of typists who were just typing letters, sending letters out and things like that. So that's gone. You don't have that in organizations now. You don't have a typing pool. You don't have people sending letters. You don't have post rooms in most organizations maybe in some of the bigger ones but these were part of every organization and jobs have changed so i can only say that this is going to happen over the future jobs are going to change you know you're going to you might have differences so some sales jobs might not exist some marketing jobs may not exist some consultant jobs may not exist but there'll be new jobs that coming in that people start to do but i don't see it as being anything radical beyond what's already happened because a lot of people had skills that are no longer needed when i first was working in that project i told you about when i was in the the electronics company a big part of my job was filling in stock record cards and then going and counting stock record now nobody fills in stock record cards.

34:31It's all computerized. You know, so this whole aspect has changed. But this is just going to be a continuation of it. Yeah, I interviewed somebody from OpenAI and his name's Roger Verkhoeven. His LinkedIn profile, I think, says it all. His headline on his profile is, you will not be replaced by AI. You will be replaced by somebody using AI, which I think sums it up. I always think of that. I always repeat that line because I think it's so true. I think, you know, the people who are going to be utilizing artificial intelligence technology and tools have got such an enormous advantage over everyone else because not everyone is embracing it.

35:12You know, they just sort of see it as a gimmick. Yeah. Look at some of the organizations that were big in their days. You know, I mean, Kodak. What's happened to Kodak? You know, when I was just... The story about them is unbelievable, isn't it? Yeah. I mean, Kodak were enormous. And now, you know, they're no longer there. Wasn't it Kodak who invented the digital camera technology and then didn't see it as having market potential? Or maybe it was a bit of protectionism around their film business. So they shelved it and then everyone else picked it up. And then they went out of business. Unbelievable irony.

35:47Well, all of these things happen. I mean, working for Xerox, you know, at one time the photocopier was the big thing in an office. Now, maybe you've got laser printers, but Xerox had to change their business model into printing systems. So, yeah, these changes are all going to happen. What you are going to have is jobs will be replaced by people who are using AI to do those jobs. So I wanted to ask you a couple of things then before we wrap up, Phil. I just wanted to ask you about your career. Looking back at your career now, if you were to be able to speak to your 21-year-old self, perhaps when you worked in Software Limited back in the late 80s.