Cool Vendors in Cloud Management, 2010

Many innovative products offer the potential to simplify the complexities of cloud-computing management. However, users should temper their enthusiasm for innovative new technology by considering the risks associated with investing strategically in small vendors.

• Gartner's 2010 CIO survey identified cloud computing as the No. 2 strategic technology investment for CIOs globally.
• Established vendors in IT operations management have yet to deliver innovation in the cloud-computing management area.
• Enterprises' interest in building private clouds and using the public cloud for overdraft is increasing.
• Intermediation of public Web-oriented architecture (WOA) application programming interfaces (APIs) is a natural fit for cloud computing. Companies serving this market tend to use management approaches rooted in the cloud.

• Enterprises investing in private clouds and/or using the public cloud for overdraft or to build virtual private clouds must invest in management technology to manage service quality and availability.
• Although cloud-computing management technology from startup vendors is beginning to emerge, it is not mature enough to enable enterprises to move their mission-critical applications to cloud-computing architectures.
• Enterprises should continue to experiment with the cloud and to identify opportunities for implementation.
• Develop and maintain contingency plans to guard against the potential volatility associated with these vendors.
• Enterprises considering a public API initiative should explore the potential of cloud-based management and intermediation solutions.

This research does not constitute an exhaustive list of vendors in any given technology area, but rather is designed to highlight interesting, new and innovative vendors, products and services. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Infrastructure and operations professionals' interest in building private clouds or using the public cloud for overdraft or virtual private clouds is growing. However, investment in management technology is necessary to deliver service quality, security and availability. This research reviews six vendors with innovative IT solutions for use in cloud-computing management scenarios, addressing the challenges of deploying and managing distributed applications.

Sunnyvale, California, U.S. (www.3scale.com)

Analysis by Eric Knipp

Why Cool: 3scale provides API management delivered as a cloud service. The company was bootstrapped without VC support in 2007. It launched its beta version in 2008 at the TechCrunch 50 event, and launched its live offering in early 2009. 3scale's chief differentiation is its emphasis on a proxyless architecture that avoids intermediation to achieve lower latency and bandwidth costs than intermediation-based approaches. Instead of placing a cloud-homed proxy between the provider API and the service consumer, 3scale offers a library that API programmers use to gain low-level control over the authentication, throttling and handling of API requests. The library interacts with 3scale's cloud-based management services to authenticate developer keys and control access to the underlying Web services, which are hosted by the customer. 3scale's management infrastructure is deployed within Amazon EC2.

3scale's value proposition is similar to that of API intermediation firms Mashery and Sonoa, enabling the rapid deployment of API initiatives coupled with instrumentation, billing and developer community administration tools. Unlike its better-known competitors, 3scale offers a self-service API provisioning and management module for smaller customers. Most of 3scale's customers have their roots in the Web, and, thus far, the company has not attracted large enterprises. 3scale prices its services from $129 to $650 per month for basic plans, with custom pricing for larger enterprise agreements.

Challenges: Because 3scale does not offer API intermediation via cloud services, customers must deploy their own infrastructures to expose the API and manage the associated traffic. Although this results in a lower cost of service from 3scale, it also forces the customer to become an expert at deploying and managing API infrastructure. Most of 3scale's customers are "Web companies" comfortable with this challenge. Enterprises looking for a more-turnkey approach may not appreciate the additional flexibility and control that 3scale's model grants the API programmer.

The API space is gaining significant momentum, and, although this tide will lift all the players in the API management and intermediation space, Mashery has, for now, captured leading mind share with large enterprises as "the API developer ecosystem company," a capability that is difficult to imitate. At the same time, API intermediation and management is not a novel concept, and it will be difficult for players in the market to differentiate themselves purely on technology. 3scale must position itself on attributes broader than technological prowess to rise to prominence.

Who Should Care: Marketing leaders looking to enter emerging Internet communication and distribution channels and IT leaders who desire greater reusability from internal services should explore 3scale's API management and intermediation services.

Related Research

"Open WOA APIs: From the Edge of the Web to the Mainstream Enterprise"

"2009 Data Center Poll Results for Cloud-Computing Management"

Burlington, Massachusetts, U.S. (www.cloudswitch.com)

Analysis by Milind Govekar, Cameron Haight and David Mitchell Smith

Why Cool: The company was founded in 2008 by Ellen Rubin (vice president of products) and John Considine (CTO), with John McEleney joining in 2009 as CEO. CloudSwitch enables enterprise IT organizations to migrate applications to (and from) the public cloud in a secure manner without requiring application or infrastructure changes. The application in the cloud appears as a part of the enterprise's network, enabling continued use of established management technology. To date, CloudSwitch has received more than $15 million in funding from Matrix Partners, Atlas Venture, Commonwealth Capital Ventures and others. The company does not have paid, in-production clients, although several have paid for beta testing.

CloudSwitch's product is delivered as a virtual machine (VM) appliance, which is downloaded and deployed into a hypervisor. This appliance contains the management components for discovering applications, transforming virtualization formats, orchestrating cloud deployments and managing cloud utilization. Using patent-pending "cloud isolation technology," the appliance creates a secure data path between the data center and the chosen cloud provider. CloudSwitch delivers its secure communication and storage services by automatically provisioning a local control end point within each cloud deployment. Information is secured via dynamic encryption during transit to the cloud, as well as for stored objects in the cloud provider's environment. A function (called CloudFit) ensures that cloud deployments operate with sufficient performance and reliability by automatically selecting the appropriate combination of processor, memory and storage.

CloudSwitch intends to offer two versions of its product. A free version called Explorer is available that supports up to five VMs within VMware and Amazon.com infrastructures. General Availability for an enterprise product is planned for mid-2010. This product will support up to 20 VMs, with prices starting at $25,000 annually, and it will include multicloud support (targeting a VMware-based cloud).

Challenges: CloudSwitch only supports Amazon EC2 and VMware environments. It does not integrate with any of the primary provisioning technology in the marketplace (e.g., BMC/Bladelogic or HP/Opsware) and, although it provides management transparency, this same transparency may make it hard to know that a resource's performance problems are a result of its running in a public cloud. Gartner expects significant competition in the cloud marketplace, with some vendors already appearing to gain "mind share" among end users. For example, although not as robust, Amazon.com offers a virtual private cloud offering that, at first glance, is similar to the CloudSwitch solution.

Who Should Care: Application development and IT operations staff and, in particular, application support or application administrators and operational security administrators who are experimenting with or have built solutions leveraging private and public cloud environments should be interested.

Related Research

"2009 Data Center Poll Results for Cloud-Computing Management"

Stamford, Connecticut, U.S. (www.kaavo.com)

Analysis by Milind Govekar and Cameron Haight

Why Cool: Kaavo was founded by Jamal Mazhar, CEO, in 2007 as a self-funded company. It has a team of people in the U.S. and in Kolkata, India. In January 2009, Kaavo launched its Infrastructure and Middleware on Demand (IMOD) product, which provides n-tier, application-centric management of resources for public and private cloud environments. The technology can start a complex system that consists of multiple tiers (i.e., a database tier, an application tier and a Web tier), as well as the firewalls that may exist between each tier without requiring the use of scripts. Kaavo has several midrange as well as enterprise-class customers.

Two key components form the heart of the IMOD technology — an orchestration engine that executes workflows and a state machine with event-to-action mappings for each application tier. A complete n-tier system is defined in an XML file, called the "system definition file" (which lists system artifacts, configuration tasks, etc.). It is then deployed into Kaavo's IMOD application, which orchestrates the deployment and subsequent runtime execution of the overall system in response to specific events. For example, an event can initiate a scale up or down workflow. Users can define custom events and map them to predefined workflows to automate runtime tasks that a system administrator might typically perform.

Although the IMOD platform is hosted at Amazon.com, Kaavo also has plans to support multiple cloud providers. Furthermore, it has beta customers that are evaluating the technology in their private cloud environments. Using a Web browser, users connect to the IMOD user interface wizard to perform configuration tasks. Then, IMOD is directed to interface with remote infrastructure as a service (IaaS) providers and provision the requested resources. It then does a Secure Shell login to configure the initiated virtual servers. IMOD is written in Java EE (leveraging the Velocity Template Language for dynamic workflow creation, etc.) and is configured to support events from the included open-source monitoring tools, such as Nagios and Zabbix. It can also accept alarms from other management agents.

IMOD supports Amazon and Rackspace public cloud environments, as well as Eucalyptus for private cloud environments. Kaavo's go-to-market strategy is based on an online self-serve model for end users or startups and leveraging system integrators (SIs) to enter the enterprise market. IMOD's starting experimental price is approximately $100 per month, which is in addition to the costs of your IaaS provider services. Pricing for their enterprise option is still in-process, as Kaavo plans to enter this segment through service providers, such as NIIT Technologies and TechnoDyne — both midsize SIs.

Challenges: The cloud-computing market is still an emerging environment. Few enterprises use the public cloud for mission-critical applications, while private cloud infrastructures are only now beginning to see demands for their construction. In addition, competitors are beginning to arise from multiple directions, with some early favorites starting to emerge among Gartner clients. To ease the configuration process for less-experienced users, Kaavo needs to provide a wizard to customize the system definition file for the runtime and automation environment. Kaavo has no sales team of its own, so it will need to work with SIs to build additional vertical industry or application-specific solutions for its customer base.

Who Should Care: Developers or IT operations staff, in particular application support or application administrators who are experimenting with or have built solutions involving public or private cloud environments will find Kaavo's life cycle management capabilities useful.

Related Research

"2009 Data Center Poll Results for Cloud-Computing Management"

Redwood City, California, U.S. (www.makara.com)

Analysis by Milind Govekar and Cameron Haight

Why Cool: Makara, formerly webappVM, was founded in 2008 to help deploy and manage PHP and Java-based applications in a cloud-computing environment. Prior to their current venture, CTO Isaac Roth and CEO Tobias Kunze Briseno worked at Wily Technology and Lycos Europe, respectively. They are backed by Shasta Ventures, Sierra Ventures and others. Their cloud application platform leverages virtual infrastructures by encapsulating the application with its middleware stack, along with embedded instrumentation and existing configuration files, enabling migration or portability to many private and public cloud environments. The company is trying to address the shortcomings of established application management solutions that may not have been designed for cloud-based infrastructures, including the ability to enable automatic scaling based on resource requirements via interfaces to these underlying infrastructures. The solution also benefits application developers by enabling developer self-service through automation based on overall policy.

Makara's technology provides portability for applications across different hypervisors (VMware ESX, VMware Workstation, VirtualBox and Xen) and public cloud environments (Amazon EC2, Rackspace and Terremark). It provides "drag and drop" capabilities to move Web applications into virtual environments by automatically copying code and configuration files into its "application capsule" or environment. It then offers a menu of common application infrastructure component options. It's able to track changes to the configuration and code and correlate them with the application performance data. It can also roll back earlier versions and provide visibility across development, test and production environments. Makara offers a free limited developer version, as well as a version without restrictions, which is available on-demand at $0.40 per node per hour. Enterprise versions start at $15,000 for a five-node annual subscription that includes support and maintenance.

Challenges: Enterprise adoption of public cloud-computing environments for mission-critical applications is still limited by concerns related to security, compliance and service-level agreements. Perhaps because of this, at Gartner's 2009 Data Center Summit, customers seemed to lean toward their virtual infrastructure and enterprise management vendors to provide the necessary management solutions for cloud platforms. Startup vendors will have to work hard at gaining trust from enterprises deploying applications across these environments. Finally, Makara only supports PHP and Java applications, which limits its solution opportunities; however, this is not an architectural limitation.

Who Should Care: Architects, developers or IT operations staff, in particular, application support or application administrators who are experimenting with or have built solutions around public or private cloud environments will find Makara's monitoring and management capabilities useful.

Related Research

"2009 Data Center Poll Results for Cloud-Computing Management"

San Francisco, California, U.S. (www.mashery.com)

Analysis by Eric Knipp

Why Cool: Nontechnology companies can use APIs to expand to social media, mobile and other emerging marketing communication channels, but they often need help planning, deploying and managing their API initiatives. Mashery is one of a handful of companies, including 3scale and Sonoa Systems, specializing in API management and intermediation via cloud services. Mashery differentiates itself from these competitors by promoting its consulting and advisory services, which guide enterprise efforts to build developer interest and a community ecosystem around their APIs. Mashery's Amazon EC2 and Internap-hosted API intermediation technology is offered as usage-metered software as a service (SaaS).

In addition to intermediating API requests — so that enterprise-owned infrastructure need not be burdened with the full weight of traffic — Mashery's offering provides analytics, authorization, request caching and throttling, and developer community management tools. Although Mashery sees each customer as unique, pricing typically starts at approximately $4,000 per month and scales with volume, infrastructure and complexity.

Mashery's high-profile customer list includes media (The New York Times, USA Today and Netflix), retail (Best Buy) and a range of business services (Hoovers, Trulia and LinkedIn). On 24 February 2009, Mashery announced that it had closed series C of venture capital (VC) financing, with Cisco as the lead investor. Cisco joins VC firms First Round Capital, Formative Ventures, 406 Ventures and The Accelerator Group, which have also taken equity stakes. This investment speaks well of Mashery, but, more importantly, provides evidence that Cisco sees WOA APIs as a critical element of the glue that binds the next-generation Web together and is putting resources behind that vision. Finally, the growing maturity of enterprise service-oriented architecture (SOA) — and associated WOA — initiatives makes public API projects more likely.

Challenges: Growing interest in APIs, combined with the reduced cost of entry into SaaS businesses — made possible by cloud application infrastructure and cloud system infrastructure — will intensify competition for Mashery's customers, even as the market for API services expands. In particular, formidable competition from IaaS providers, which have built reputations and competency in services-based interoperability, is likely to emerge rapidly.

Who Should Care: Marketing leaders who seek to enter emerging Internet communication and distribution channels and IT leaders who desire greater reusability from internal services should explore Mashery's cloud-based API management and intermediation services.

Related Research

"Open WOA APIs: From the Edge of the Web to the Mainstream Enterprise"

Santa Clara, California, U.S. (www.sonoasystems.com)

Analysis by Gene Phifer and Daryl Plummer

Why Cool: Known as a provider of SOA governance technologies and outbound cloud services, Sonoa Systems is also a provider of API management services. For many enterprises, key information that could be critical for external consumption is buried inside internal systems and databases. Many enterprises are exposing this information via open APIs to a wide variety of external consumers, primarily to be combined (mashed up) with additional content and delivered via the Web. Best Buy's exposure of its product catalog (via open, RESTful APIs) is a great example of this approach, which is being replicated by companies across all industries.

Sonoa provides a set of services that is critical for effective API management, including policy enforcement, metering/throttling, mediation/transformation, analytics, developer onboarding and management, and performance management. In addition, it provides capabilities tailored to mobile application access of APIs, including caching and pagination of results for mobile device consumption. Via its apigee.com website, Sonoa provides a free sandbox for developers to use and for companies to learn from. One of the most interesting aspects of this company is that cloud-computing APIs are increasingly being exposed, but not managed or tracked. Sonoa's technology provides a way to track and manage these APIs as part of cloud service offerings. This is a cloud service brokerage function and opens up a new market opportunity for Sonoa to advance.

Sonoa Systems is backed by the following VCs:

• Norwest Venture Partners
• Bay Partners
• Third Point Ventures
• SAP Ventures.

Sonoa Systems offers on-premises and on-demand deployment. On-premises solutions start at $30,000 per hardware or software appliance, while on-demand pricing starts at $3,000/month.

Challenges: Sonoa is a small, privately held company, with revenue of less than $5 million. However, it has made a name for itself in the SOA governance market, and has a lot of momentum. Many enterprises will eventually take the API plunge, but it may take a while for some companies to realize the need and the value of API management. In addition, Sonoa must maintain a position as a unique provider of API management for services, not just for programmatic interfaces. This would enable it to enter the cloud-computing space with a "running start" relative to brokerage of cloud services.

Who Should Care: Companies that want to expose important information (e.g., product catalogs) to external consumers for delivery via mashups and websites should be interested, as well as:

• Developers that want to gain broader exposure of their mashable services.
• Developers that service a large mobile audience via APIs.
• Cloud services consumers that need to track and manage cloud service interactions.
• Cloud services providers that want to offer stronger management of their service APIs.
• Cloud brokerage providers that need technology for brokering performance, policy or security among services.

Related Research

"Case Study: Best Buy Extends Its Reach With a Public WOA API"