CIC Vendor Profile: Box Inc.

Transcription

1 CIC Vendor Profile: Box Inc. Simple, secure, sharing from anywhere A Creative Intellect Consulting Vendor Profile Report Box Inc. is a US software company that owns its own cloud based storage and content platform. The company tagline is "A powerful platform for the Enterprise" and from its enterprise client base it looks to have succeeded in building a solution that stands up to its tagline. There are currently over 750 third party applications running on the Box platform. Box has a broad customer base, spanning consumer packaged goods, manufacturing, healthcare, engineering, construction, communications, media and entertainment and finance. Ian Murphy, Principal Analyst, Creative Intellect Consulting Bola Rotibi, Research Director, Creative Intellect Consulting September 2013 Creative Intellect Consulting is an analyst research, advisory and consulting firm focused on software development, delivery and lifecycle management across the Software and IT spectrum along with their impact on, and alignment with, business. Read more about our services and reports at Creative Intellect Consulting Ltd 2013 Page 1

2 Profile overview Vendor name: Headquarter locations / key offices: Product / portfolio focus: Target audience / role: Client industry spread: Company size: Stock market listing: Summary financials: Box Inc, Los Altos, California San Francisco, California London, England Box.com and Box Mobile Box OneCloud Box Platform Enterprise End-Users Solution Developers Solution Architects System Integrators Architecture, Engineering & Construction Communications Consumer Packaged Goods Education Government Finance Healthcare Manufacturing Media & Entertainment Non-Profit Professional Services Retail Technology 900+ staff Total 70+ staff London Privately owned Last equity funding in June 2012 raised US$125m, valuing Box Inc. at around US$1.2bn Creative analysis Box is one of a growing number of companies focused on providing enterprise content collaboration to satisfy the need for employee productivity anytime, anywhere, on any device. With cloud storage and content collaboration markets getting very crowded, Box has set its sights on businesses rather than consumers. To achieve a reasonable return, Box offers five different options for its customers - Personal, Starter, Business, Enterprise and Elite. Each targets a very different customer base, with some price points being public and some PoA (Price on Application). This is a common approach in any high value enterprise market. The feature sets build on each other as a customer upgrades through the Box product range, with add-on features and enterprise integrations. We believe this is a sensible move by Box, as it will attract the volume business of departmental and Line of Business entries into the cloud and also provide a clear upgrade path to the Enterprise Edition for security, management, audit trails, unlimited out-of-the-box enterprise integrations and the ability to build custom apps on Box. A key differentiator for Box is the platform it is not just a simple storage or file sync and share solution. With over 750 third-party applications, 30,000 developers, and four billion application programming interface (API) calls per month, many enterprises are already leveraging the Box platform to transform their businesses. Creative Intellect Consulting Ltd 2013 Page 2

3 More importantly for its corporate customers, it has gained public support from high profile partners, such as Salesforce and SAP, and has seen large-scale enterprise deployments, including over 50,000 users in production at Schneider Electric and over 20,000 employees collaborating around the world at Procter & Gamble. Box has an aggressive acquisition strategy and has been on a mission to acquire and integrate more features to make itself the platform of choice for customers looking for a cloud content solution. As with any acquisition strategy, there is a risk of buying technologies that do not fit well with the underlying platform. There is certainly an overlap within recent acquisitions, but so far we do not see evidence of Box overreaching or buying non-core enhancements. It is also worth noting that Box has bought in several companies, which can only help to strengthen its position within those countries. Provided the focus stays on benefit to the platform, any potential risk should be minimal. One challenge for Box over the last year has been to invest in its infrastructure and data center operations to scale, to meet increasingly complex requirements of large scale (in the tens of thousands of users), globally distributed, highly concurrent users. Some reviews reflected such growing-pains with Box. However, Box s management team has committed to a number of innovations in 2013 that should solve these large scale use cases. Despite this, we are extremely positive about Box both as an enterprise solution and on its impact on the content collaboration market. The breadth of features, intuitive user interface, rich API set, and the robust content platform that they offer go beyond any competitor currently in the market. Strengths Strong security throughout its service: Secure transmission and encrypted content storage platform. Full list of industry certifications achieved, including SSAE16 Type II, ISO certified, HIPAA & HITECH compliant (including the Omnibus rule) Platform agnostic ubiquitous access through native sync applications for laptops and mobile devices (e.g. Apple ios, Google Android, Windows 7 and 8, and Blackberry and Mac/PC) Built-in external collaboration support for users and teams Box OneCloud robust community of mobile productivity tools built by third parties Enterprise integrations with SharePoint, Microsoft Word, Outlook, Salesforce, NetSuite, Jive, Okta, and all the MDM solutions Robust content platform for customers, ISVs, system integrators and other partners to build and deploy custom and commercial applications Weaknesses Customers cannot mix and match users of different editions in one purchase For simple sync and share use cases to enable multi-device access to corporate content, Box s pricing was high before introducing the Starter Edition in July Therefore, Box is still perceived by the market as a premium priced service provider for basic sync and share capabilities. Recently entered the European market and is in the process of growing its regional presence Financial viability As a private company, with over 900 employees worldwide, Box does not make its accounts public, but its hypergrowth from a start-up in 2005 to an enterprise solution provider is well-documented in the press. The ease with which it has been able to acquire investment in multiple rounds of funding, show that its business fundamentals are solid. The last round of funding that Box received was for US$125m in June This valued Box at over US$1.2billion at that time and the company has had significant customer growth and expansion since. Creative Intellect Consulting Ltd 2013 Page 3

4 Box has a customer base that includes over 180,000 businesses and 20m end users. It has been extremely successful in penetrating the top echelon of businesses, with over 97% of the Fortune 500 companies listed as customers. Some of its public customer references include Procter & Gamble, Schneider Electric, Red Bull, The Gap, Electronic Arts, Pandora, BAA, McAfee, Netflix, Metlife, Siemens, Amazon, and Pabst Blue Ribbon. At present, Box is aggressively expanding its operations outside of the US and opening offices in Europe and the Far East. In Europe, while the headquarters is in London, Box is in the process of opening offices in Paris and Munich. Product strategy Box has two elements to its product strategy: The Box Platform The Box application Box Platform The Box platform is what makes Box more than just a file sync and share provider. Employees currently manage, access and collaborate on content, which is stored in many applications across the organization, from off-the-shelf cloud apps, to mobile apps, to on-premise legacy systems. Rather than let this content remain in silos, the Box platform provides the universal content layer that glues all these applications together and enables individuals to collaborate on that content. Companies are using Box to integrate their new and existing systems, and even building custom purpose built applications to support content-driven processes for mobile workers, or to deliver specific use cases for an increasingly cloud, social and mobile-enabled workplace. Collaboration, content management, security, synchronization, multi-device support, unlimited storage capacity, fully-indexed search, auto account provisioning and a range of enterprise management components all sit at the core of the Box platform. With Box Enterprise companies can easily build applications on top of the Box Platform, leveraging these core services without having to build from scratch. Businesses of all sizes are building mobile, vertical-specific, and collaboration apps on top of Box whether customer-facing apps, such as a product catalog, or facilities management apps or internal apps for employees and partners, such as a sales portal app to improve process efficiencies and information worker productivity. A leading manufacturer of energy drinks used the Box platform as the back end repository for a suite of mobile sales applications. The 14 custom ios applications support all of a sales person s activities from sales training, closing deals with prospects and the handoff to the customer service team for account management. The apps pull workbooks, contracts, videos and other content from Box and are optimized to present personalized content, specific to the role and interests of the particular customer. Another example of a Box Platform customer is a construction company that was a big SharePoint shop. They have, for the most part, replaced SharePoint with Box and now use Box as their primary collaboration platform. They have integrated Box with all of their core systems in use, including Active Directory for identity management, DocuSign for e- signatures, Google Apps for productivity and Ping Identity for enterprise Single-Sign-On. Additionally, they are using the Box API to build a custom integration with Splunk to enable reporting dashboard for key performance indicators. There are multiple components that comprise the Box Platform, ranging from simple off the shelf tools like Box Embed ; a simple HTML5 widget used to embed Box in any site or web app, to the Box Content API; a powerful, fully RESTful API that exposes over 90% of Box s functionality for developers to harness. The full list of components can be found below: Creative Intellect Consulting Ltd 2013 Page 4

5 Box Embed Box Embed makes it easy for customers to embed Box into their existing applications. It is an HTML5 widget that enables users to embed the entire Box experience into an application, portal or web interface. Box Embed takes control of all the data functions, allowing users to interact with content in the Box environment without developers or administrators having to worry about configuration or connections. Box has over 20 Embed integration partners, some of which include DocuSign, Eloqua, Jive, NetSuite, and Salesforce.com. Employees have access to all of Box s collaboration and workflow features (like uploads, previews, search, inviting users, and commenting) within that application. By partnering with the leading applications in which employees work, Box is becoming the central location for all their business content, enabling them to have the full content storage and content collaboration experience of Box. Box OneCloud Box OneCloud is an ecosystem of third party mobile applications that work seamlessly with Box, enabling users to be more productive wherever they are, while ensuring that their content is securely managed by Box. More and more enterprises are providing their employees with the ability to bring in their own device, empowering them to be more efficient and effective in their work environment. Users can choose from a number of applications from the OneCloud app marketplace applications that range from annotating PDFs, to taking notes, to printing documents. OneCloud even has applications which are specific to certain industries; for example, in the healthcare industry, physicians may utilize drchrono on their ipads to access their patient s electronic health records, they can text message each other through TigerText (providing a secure, HIPAA compliant texting solution), or utilize ipaxera to view DICOM images; all applications which integrate seamlessly with Box through OneCloud. Through the integration with the Box platform, it is assured that their data is safe in Box, since the content is saved back to Box rather than the device or within the third party application itself. CloudOn is an example of a Box OneCloud application that provides virtualized access to Microsoft Word, Excel and PowerPoint for ios and Android devices. The user connects to the CloudOn application and then works with their content which is kept in Box. Through CloudOn, users can , share, and review changes to their content. Box SDKs Box makes it easy for mobile application developers to use either native code, to get the best performance, or HTML5 to gain the widest reach. Software Development Kits (SDKs) for ios, Android, Windows and Java are already available. The Box developer community contributed the C# and Ruby Box SDKs. [Source: Box SDK Developer page: The Box SDKs are a set of libraries on the Box API, built by Box and its developer community. The SDKs enable developers to quickly and easily build powerful, native mobile applications, as well as desktop or web applications connected to content in Box. Currently these libraries include ios, Android (Java), Windows (C# / XAML), Java, C#, and Ruby. All security settings in the Box API are inherited to the Box SDKs. They also handle complex enterprise identity with built-in SSO support, and allow developers to integrate Box through the use of pre-built file pickers and buttons. Box customers are taking the Box SDKs and creating unique mobile applications specific to their business. Among the example applications we have seen are e-commerce/product catalog apps, branded customer experience apps, KPI dashboard apps, secure boardroom and mashup apps that combine Box content management with any combination of OneCloud productivity apps, such as PDF annotations, e-signatures or content creation and editing. Creative Intellect Consulting Ltd 2013 Page 5

6 The Box Content API Box has made a strong investment in revamping its API from the ground up back in Known as the Box Content API, the new API is fully RESTful and gives developers access to content management and other features from the Box service. Many Box customers use the Content API to integrate with existing systems, where no out of the box connector is currently available, to automate content-based workflows, as well as a content platform to build custom applications. ISVs use the Content API to power the content management and collaboration component of their commercial applications, spanning web applications as well as mobile. Addressing Security While other cloud service providers are just adding encryption, Box provides a fully encrypted environment. Box uses 256-bit SSL for all connections to ensure data in transit is highly protected and 256-bit AES for all data on servers. To prevent encryption keys from being stolen or compromised, Box stores the keys separate from the data and ensures that they are changed frequently. Support for more than 8 single sign-on vendors and integration with Active Directory (AD) makes it easy to integrate user accounts with enterprise log-ons. Box customers can now enforce their internal password policies on their users accessing content on the Box Platform. Box has also extended its security to deal with complex distributed environments in a way that shames a number of major mainstream cloud providers. Active Directory and LDAP integration ensures that enterprise administrators can secure and audit data access. Support for SAML 2.0 provides a foundation for federated access security. On top of this, Box has native multifactor authentication support, which is only just being added by organizations, such as Facebook, Twitter and some banks. Box has achieved a range of internationally recognized certifications, such as Healthcare Insurance Portability and Accountancy Act (HIPAA) certification, and will sign Business Associate Agreements (BAAs). This has enabled Box to attract a wide number of application partners in the healthcare space and make this a key vertical market, with providers such as Henry Ford Health System, HealthTrust Europe and Wake Forest Baptist Health all as customers. Another accreditation that Box has achieved is Statement on Standards for Attestation Engagements 16 (SSAE16); a must have for cloud providers. The SSAE16 SOC 2 third party audit report is an independent report on the controls in place for ensuring the security, availability, and confidentiality of customer data by the cloud solution provider. In May 2013 Box achieved the important ISO Information Security Management Systems standard. This is a critical standard in terms of enterprise validity and gives Box a boost over its competitors. What it means for customers is the assurance that the underlying platform can be trusted. A Platform for Building Applications Box has been extremely successful in attracting developers and major partners to its platform. One of the dangers of any platform is a failure to build enough high value applications to sustain customer interest. Box has not only avoided that, but has succeeded where other cloud platforms have struggled. Enterprise customers often find it difficult to integrate with external platforms. With a wide range of SDKs and APIs, Box has made it easy for enterprise developers, ISVs and VARs to target the Box platform. It has also added a number of application integrations, some written by itself and some by partners. There are also mobile specific Box clients available for Android, Android Tablet, BlackBerry, ipad, TouchPad, Windows Phone, Windows 8, iphone, Mac and Windows. Some are application-specific, such as Box for Chatter, Outlook and Office. All of these are easily downloadable to devices and as official applications are free to download and use. All you need is a Box account to start using them. Creative Intellect Consulting Ltd 2013 Page 6

7 The third-party developer market is critical to Box. This has enabled Box to offer a range of paid for and premium applications on the Box platform, from partners such as Salesforce, NetSuite, Google Apps, AudioBox, Box for Oracle Fusion CRM, Documents Pro and many others. The range of applications available covers pretty much the entire business space, from vertically integrated applications to general purpose office suites. Box has even introduced Box $rev, a program incentivizing developers to build highly relevant, richer applications on top of the Box platform. How developers are compensated is based on increasing customer engagement with their application, which in turn will make Box much more sticky for users and enterprises. Over the years, Box has demonstrated its commitment to its partner ecosystem and this model continues to show the value of building on top of their platform: improving the user experience, increasing Box stickiness, while also providing a revenue stream for developers. Support for Developers Attracting developers to a platform is not easy. There is a lot of competition in the market for third party application developers as vendors look to leverage their platforms and build developer ecosystems. For Box, this is where it has focused its efforts. Over the last year it has doubled the number of APIs and SDKs that developers can use and developed a highly active developer community site. Box has taken note of what Apple and Microsoft have done and imposed its own quality control approach. Applications need to be submitted for Box approval and testing. The advantage of having a validation stage, is that applications meet a consistent quality threshold that enterprise customers can rely on. This is important as it helps to stabilize the platform and convince enterprise customers that there is limited risk from rogue applications. Crucial for Box is to ensure that this is a smooth process and not something that begins to inhibit development and innovation on the platform. That said, Box also realizes that not every enterprise customer developing on their platform will want to submit their applications for review. As a result, customers can write their own applications and deploy them to their own users. These applications are not featured in the Box store. Standards and openness Box has chosen to write its APIs as RESTful Web Services. This makes it possible for developers to use their preferred language for their application, as long as they can make a standard RESTful call. Where developers are writing applications that need to do authentication, Box has chosen to implement OAuth2. This is an open protocol to make it easy to create a secure session from any platform. Box also supports the Security Assertion Markup Language (SAML), which is an extensible Markup Language (XML) based, open standard data format used to handle single sign-on (SSO) with nearly any LDAP system. Roadmap directions Box has positioned itself as an enterprise content platform player. To achieve this, it has added many extra features to the Box Platform over recent months. It has also announced a further set of features to be added, which are listed below: New Synchronization Engine: A completely reengineered version of Box Sync to be released in New View API: Integrating the Crocodoc acquisition, the preview HTML rendering engine will power the new preview experience across the Box service and it will also be available in beta as the View API. Developers can leverage the API to embed and display files directly in any websites and applications. New Mobile UI: ios, Android and Windows 8 mobile applications are to get a new UI in Creative Intellect Consulting Ltd 2013 Page 7

8 New Policies and Automation Administration Tools: Enabling event-based automation of any operation in Box. This technology will give Enterprises the ability to set up content security policies to scan for specific data, like credit card information, and if detected, set the file aside and notify the admin. In addition, it will allow Enterprises to automate processes within Box, such as routing a file to a series of people to review and then moving it to an approved folder (e.g. think IFTT). New Metadata service: Box announced at its customer conference, BoxWorks, that they are working on a new service to store structured data information into its database, allowing developers to easily pair and assign custom data fields to files and folders, for example, as well as store that data independently, in separate custom objects. Types of data can range from things like file metadata (e.g. take a picture from your camera phone and surface all the information pertinent to it, i.e. timestamp, location coordinates, shutter speed, device, etc) to key value pairs that allow developers to further automate specific workflows, or complete a transaction from Box into core systems. It will be available in beta in early Market and partner strategy The Box market and partner strategy is well defined and has been delivered. A stable platform, extensible through APIs and SDKs, enabling third party and enterprise developers to deploy Box as an alternative to their own storage and on-premise legacy apps. Salesforce.com, Oracle, HP, Brother, Google, Rackspace Hosting, Autodesk, CollabNet, Tibco, Heroku and SnapLogic are just a few of the strategic partners that Box has signed up in the last year. With these partners using and integrating into the Box platform, it is easier for enterprise customers to adopt Box for their enterprise content collaboration needs, as well as a cloud platform used to integrate their existing (and new) applications and build their own unique applications upon. The Box reseller programme has three levels: Member Partners who are focused on the SMB market and commit to selling a minimum of100 licenses per year. Choice Partners commit to a minimum 1,000 licenses per year and focus on the small to midenterprise market. They are mid-sized organizations that focus on selling overall solutions to customers and include Box in their suite of collaboration products. Premier Partners commit to a minimum of 3,000 licenses per year and are focused on the mid-large enterprise market. These partners are typically large solution providers who offer cloud products to customers as part of an overall solution. Box is considered the leading Saas offering in their cloud suite. Across the cloud market, there is a move by several vendors to encourage partners to build industry specific clouds. The structure of the Box partner programme lends itself to this approach, although it has not, as yet, announced any plans in this space. Industry and market value proposition In the last three years, the amount of data held by enterprises has doubled and shows no sign of slowing. With budgets still tight, IT departments want a solution that is cost-effective and easier to maintain than the onpremise file sharing infrastructure, which can become brittle over time. Developers are also looking for platforms that not only allow them to build new applications, but where the data can be held close to the application. Cloud providers are trying to deliver both, but few have the infrastructure and tools to meet the challenge. Although the market has been slow to take off, it is beginning to accelerate. Creative Intellect Consulting Ltd 2013 Page 8

9 From a storage perspective, enterprise storage teams have been slow to adopt cloud for a number of reasons: 1. Enterprise IT is concerned about security around cloud storage. Federated security and the ability to audit storage has been hard to do on many cloud storage platforms. 2. Encryption of data, both in transit and at rest, is not a standard cloud storage feature. 3. Service level agreements (SLAs) and backup/restore of data stored in cloud systems is not perceived as being enterprise standard. 4. Storage needs to be integrated with applications, not just another location where files are held. Examples of this are replications, mirroring, Backup as a Service (BUaaS) and Disaster Recovery as a Service (DRaaS). It also needs to be the default save option, so that data is not lost when a device is stolen. Box is one of just a handful of cloud service providers who are addressing these corporate concerns through its own development and acquisition strategy. The creation of a platform around its content collaboration strategy allows Box to appeal to cautious enterprise customers, who want more than just file synchronization and sharing. We see this as not just a smart move, but an essential one for anyone who wants to grow their business beyond storing their content in the cloud. Competitive edge / differentiation With an active developer platform and an impressive set of strategic alliances, Box has shown that it is possible to build a cloud solution that is flexible and appeals to a wide spectrum of customers, from the SMBs to the largest of enterprises. While the SMB is a large market, the key market for Box will be the large enterprise. This is a market that is on the cusp of moving to the cloud en masse, but has been waiting for a real business case to help justify the move. Box, with its application platform and secure content collaboration, can certainly help support much of that justification. As an established incumbent in this market, Box has built a customer and developer base that new entrants will struggle to compete with. It is aggressive in acquiring companies to fill out any gaps in its service. While too much acquisition can introduce a level of complexity, Box is showing no signs of overreaching itself and continues to deliver value from each acquisition, including Folders and Crocodoc. Box has the potential to break out of the Sync and Share market and into the wider business applications market. Its API and SDK strategies show it can move from being a Software as a Service (SaaS) vendor to a Platform vendor. It is not yet a full PaaS stack, but it has enough advanced application frameworks and tools to attract developers and enterprise customers with developer resources. This could put it in a position to challenge some of the more established cloud vendors, such as IBM and Microsoft. Should Box achieve this, its biggest challenge may well be in maintaining its independence. There is a lot of consolidation in the cloud market at the moment and a successful, independent company is likely to attract a lot of potential suitors. Box differentiates itself from its competitors by its partner programme and platform approach. Managed well, Box could compete with Amazon as being the platform on which vendors build their cloud services. Box OneCloud suggests Box has already succeeded in doing just that, because the applications there enable mobile application access and secure data management. Not everything is perfect for Box, however. There will be a lot of attention paid to how it fixes existing problems, such as scaling has already seen a raft of new features, with more still to come. It has to deliver on promises to its user base, because other Cloud Service Providers are beginning to realize that they need to build an applications platform, not just store data. Over the next year we expect to see very large sums spent by industry incumbents as they play catch-up. Creative Intellect Consulting Ltd 2013 Page 9

10 Benefits to end users Box s Application Platform strategy, with its publically available APIs, plays very much to where the company believes the biggest pain point is for enterprise customers: containing user generated and corporate business data, integrating their new and existing mission-critical business applications, and the ability for organizations to easily build custom applications. Extensible platforms are all about simplicity and Box has succeeded in five essential use cases: 1. Simplicity: for the user who needs to know nothing about what is happening under the covers, just that the data is there and being synchronized when they are online. 2. Simple content management: is part of the core Box platform that supports collaborative working through a simple user interface. 3. Simple access to applications and data anytime, anywhere: allowing users to work locally or via cloud based applications. This means that the user only needs some form of access to a desktop or mobile device to be able to work. 4. Simplicity for the developer: who can assume that the platform is just present. Developers also need clear APIs, SDKs, code samples and documentation that make it possible to write and deploy applications reliably, consistently and quickly. 5. Simplicity for the administration and operations team: that do not have the time to learn or integrate new tools. Encryption of data in transit and at rest, the ability to extend internal user security to the Box platform through enterprise directory services, support for single sign-on and a built-in mobile device management (MDM) are essential. The Box customer list is impressive, not least because each of its large customers represents hundreds, thousands and even tens of thousands of seats. Customers, such as Red Bull, not only use Box in-house, but have developed custom ios applications on the Box platform. In March 2013, Schneider Electric announced that it was to deploy Box to 50,000 employees across more than 100 countries, and by June 2013 they were live in production with more than 25,000 users on Box. The reason for such a large commitment was that Schneider Electric required an enterprise collaboration platform with enterprise grade security and a content system that would easily integrate with its social platform, tibbr from Tibco. Schneider Electric chose Box over alternatives such as Microsoft Skydrive Pro or offerings from other strategic vendors in their IT portfolio. Access to content on the Schneider Electric deployment will not be limited to its own staff. Schneider is looking to provide a single content distribution and collaboration network for staff, customers and engineers. Sales and marketing materials will sit alongside engineering manuals and will be accessible on a range of devices. This is where Box is beginning to resonate with that enterprise market - a secure, extensible, application rich and content platform. As the Box Platform and the OneCloud ecosystem continue to mature, there is every expectation that there will be increasing features and capabilities, to support even the biggest of enterprise customers. Creative Intellect Consulting Ltd 2013 Page 10