Enterprise Mobility Management: A review of Total Cost of Ownership

Transcription

1 Enterprise Mobility Management: A review of Total Cost of Ownership Mobile Workforce Strategies Service Andrew Brown, abrown@strategyanalytics.com Martin Bradley, mbradley@strategyanalytics.com Gina Luk, gluk@strategyanalytics.com Viewpoint Snapshot This whitepaper provides an analysis of the Total Cost of Ownership (TCO) for solutions from 6 major Enterprise Mobility Management (EMM) vendors: AirWatch (VMware), BlackBerry, Citrix, Fiberlink (IBM), Good Technology, and MobileIron, for both commercial and regulated levels of security, supported by industry interviews with IT Decision makers actively using EMM solutions. The significance of hardware, licensing and support cost drivers is explored through a variety of scenarios, which cater for different forms of implementation. Intangible factors are also highlighted which can impact an enterprise s internal costs, such as the scalability of a solution and ease of implementation. We conclude that BlackBerry provides the lowest quantitative TCO over 5 years, and there is currently no vendor which dominates the intangible factors. May 2014

2 1 Executive Summary In recent years, the market for Mobile Device Management (MDM), Mobile Application Management (MAM) and mobile security has broadened into 3 layers of capability which is generally now referred to as Enterprise Mobility Management (EMM): Basic mobility management, typically for small businesses using for example ActiveSync for Enterprise mobility management often used by commercial organizations for managing corporate and personal device use Regulated-level enterprise mobility management preferred or required by corporate and government organizations with the highest expectations of security and control This report explores the landscape for EMM from a TCO perspective, primarily with reference to a bespoke TCO scenario model of EMM vendors. This enables the cost drivers to be identified by feature set, implementation method, and payment method, as well as identifying the differences between the commercial EMM and regulated EMM environments. A number of standard scenarios were selected for assessment; alternative scenarios could potentially reveal other findings. The vendors assessed are AirWatch, a VMware company (hereafter referred to as AirWatch ), BlackBerry, Citrix, Fiberlink, an IBM company (hereafter referred to as Fiberlink ), Good Technology and MobileIron. Page 2 of 54, Strategy Analytics 2014

3 Figure 1: Scope of Enterprise Mobility Management by Vendor Scope of Enterprise Mobility Management Regulated Enterprise Mobility Management Enterprise Mobility Management Basic Mobile Device Management Regulated-level EMM: EMM + compliance, control and advanced security (e.g. up to 100% lockdown) for government, defense agencies, financial services, healthcare, and other high security and regulated industries Enterprise Mobility Management: Basic + Advanced MDM and mobile application and content management, geofencing, versioning, rollback, containerization Basic Mobility Management : Device restrictions, require passcode, VPN, remote wipe, remote lock Source: Strategy Analytics The above vendor assessment of capabilities is reflected in our competitive analysis, which highlights how the players differ in terms of capability across each layer of enterprise mobility needs. The analysis for each Harvey Ball is explained within each of the sections of this report. The report also reveals that BlackBerry offers an implementation and service package which is substantially cheaper than any of its competitors for the commercial grade EMM package. This is not due to specific deal promotions, but rather the way in which a very broad service package is incorporated for a single fee, for both subscription and perpetual tariffing methods. Although BES10 is calculated to be more expensive than BES5, the increment is relatively small. Other providers have similar bundling approaches, but the all inclusive nature of the BlackBerry offer provides a tangible cost advantage which is then sustained throughout the TCO period. For the regulated environment, the landscape is less crowded, and we believe that the primary players are BlackBerry, Good and MobileIron. The incremental charges for licensing (and capex where appropriate) are included, and our model indicates that BlackBerry is the lowest cost Page 3 of 54, Strategy Analytics 2014

4 option based on a 5 year TCO, followed by Good and MobileIron. The report does not claim complete equivalence in terms of security performance, and our technical commentary explains how BlackBerry s architecture provides a robust security solution. This finding was reinforced by industry interviews conducted by Strategy Analytics for this report, which highlighted that the market still regards BlackBerry as representing the gold standard of mobile security solutions. Strategy Analytics industry interviews were also used to capture market opinion regarding intangible cost factors which IT departments take into account when deciding about which EMM vendor solution to choose. We found that factors such as ease of implementation and usability have a direct bearing on IT management internal costs, and these are being taken into account in the overall assessment in a qualitative way. BlackBerry again scores well on many of these, and there are other vendors which have done well on individual attributes. However, it is striking that there is no strong leadership across all categories by any one vendor, and this suggests that there is still a lot for EMM vendors to play for in seeking to carve their best space in this rapidly evolving market. Overall, Strategy Analytics findings suggest that BlackBerry is a strong choice for companies seeking lowest cost of ownership, particularly when there is also a need for a high level of trusted security. On intangible cost factors, no single player can claim to have achieved leadership across all areas. Page 4 of 54, Strategy Analytics 2014

5 Contents 1 EXECUTIVE SUMMARY 2 2 INTRODUCTION SCOPE OF ENTERPRISE MOBILITY MANAGEMENT EMM COMPANIES COMPARED APPROACH USED IN THIS REPORT 9 3 ASSESSING TOTAL COST OF OWNERSHIP WHY DOES TCO MATTER? TCO APPROACH AND CHOICE FACTORS NUMBER OF DEVICES PREFERRED FEATURE SET SECURITY AND REGULATED LEVEL NEEDS OPERATING SYSTEMS SUPPORTED CHOICE OF IMPLEMENTATION EMM PAYMENT METHOD MIGRATION FROM BES5 OR NEW DEPLOYMENT CALCULATED COST FACTORS 14 4 TCO ANALYSIS FOR ENTERPRISE MOBILITY SCENARIOS INTRODUCTION TO TCO SCENARIO ANALYSIS BASELINE SCENARIOS BES5 TO BES10 SCENARIO BES5 TO AIRWATCH IMPACT OF PERPETUAL PRICING COMPARISON OF CLOUD OFFERINGS 24 5 TCO FOR REGULATED SECURITY STANDARDS REGULATED ENVIRONMENT REQUIREMENTS UNDERSTANDING REGULATED NETWORK ARCHITECTURES VENDOR SECURITY RANKINGS BLACKBERRY IN REGULATED ENVIRONMENTS BLACKBERRY ARCHITECTURE BLACKBERRY REGULATED ENVIRONMENT TCO 34 Page 5 of 54, Strategy Analytics 2014

6 5.5 GOOD TECHNOLOGY IN REGULATED ENVIRONMENTS GOOD TECHNOLOGY ARCHITECTURE GOOD TECHNOLOGY REGULATED ENVIRONMENT TCO MOBILEIRON IN REGULATED ENVIRONMENTS MOBILEIRON ARCHITECTURE MOBILEIRON REGULATED ENVIRONMENT TCO REGULATED TCO ANALYSIS SUMMARY 40 6 INTANGIBLE FACTORS IMPACTING TRUE TCO OF EMM DEPLOYMENTS EMM FRONT END USABILITY EASE OF IMPLEMENTATION EASE OF SCALABILITY AND BYOD INTEGRATION USER SATISFACTION WITH DEVICES CUSTOMER RESPONSIVENESS FLEXIBILITY AND SCOPE OF REMOTE MANAGEMENT 50 7 SUMMARY AND CONCLUSIONS 52 8 CONTACT INFORMATION 54 9 COMPANY INFORMATION CONTACT THE AUTHOR OF THIS REPORT: 54 Figure 1: Scope of Enterprise Mobility Management by Vendor 3 Figure 2: Level of Enterprise Mobility Management Policy 8 Figure 3: Strategy Analytics EMM TCO Model IT Decision Maker Inputs 11 Figure 4: Cost analysis for migrating from BES5 to BES10 (Subscription, On Premise) 18 Figure 5: Cost analysis migrating from BES5 to AirWatch (Subscription, On Premise) 20 Figure 6: TCO comparison over 5 years for Migration from BES5 to an Alternative (Subscription, On Premise) 21 Figure 7: BES5 to AirWatch Migration (Perpetual CALs, On Premise) 22 Figure 8: TCO comparison over 5 years for Migration from BES5 to an Alternative (Perpetual License, On Premise) 23 Figure 9: BES5 to Citrix Migration Subscription CALs, Cloud hosting 25 Figure 10: BES5 to Cloud Based EMM Migration Subscription CALs 26 Figure 11: Regulated represents the most advanced form of EMM 27 Figure 12: Comparing Requirements from SMB to Regulated Environments 29 Figure 13: Walled Garden v BlackBerry Architecture 30 Figure 14: Customer Ranking of Security Performance of Different Solutions 31 Figure 15: BES10 Architecture 33 Figure 16: Regulated EMM Cost Structure for BES5 to BES10 Migration 34 Page 6 of 54, Strategy Analytics 2014

7 Figure 17: Good Architecture Recommended Regulated Set-up 36 Figure 18: Regulated EMM Cost Structure for BES5 to Good Technology Migration (Subscription, On Premise) 37 Figure 19: MobileIron Regulated Security Architecture 38 Figure 20: Regulated EMM Cost Structure for BES5 to MobileIron Migration 39 Figure 21: Regulated EMM 5-year TCO (Subscription, On Premise) 40 Figure 22: Vendor Rankings of Intangible TCO Factors 43 Figure 23: EMM Front-End Usability 44 Figure 24: Ease of Implementation 46 Figure 25: Ease of Scalability and BYOD Integration 47 Figure 26: User Satisfaction with Devices 49 Figure 27: Customer responsiveness 50 Figure 28: Flexibility and Scope of Remote Management 51 Page 7 of 54, Strategy Analytics 2014

8 2 Introduction 2.1 Scope of Enterprise Mobility Management The scope of enterprise mobility management requirements is broad. It varies from basic mobility management needs, such as remote lock and wipe capabilities or password enforcement, through to the complex integration requirements stipulated by regulated companies and government agencies that must adhere to the highest levels of compliance. The range of these needs is highlighted in Figure 2 below: Figure 2: Level of Enterprise Mobility Management Policy Regulated-level Enterprise Mobility Management Level of Enterprise Mobility Management policy Open policy, low management needs Managed devices for some end-users and laissez-faire for others Regular Mobile policy for everyone Segmented Mobile Policy Mix of lockdown and managed devices 100% lockdown Gold level Advanced Enterprise Mobility Management Legal & Professional Services, Oil & Gas, Financial Services Government, Central Agencies, Regulated Industries Silver level Enterprise Mobility Management Basic Management Soho, small to Medium Business with no company policy Small & Medium size business Media & other nonsecurity sensitive industries Large & Medium Enterprise security sensitive Large Enterprise with multiple different levels of device management & security Large Enterprise high security Source: BlackBerry 2.2 EMM Companies Compared Our TCO analysis compares 6 leading players, and examines the cost drivers for a variety of different scenarios, including feature sets, method of implementation, method of payment, and selected migration factors. Page 8 of 54, Strategy Analytics 2014

9 Airwatch (a VMware company) BlackBerry Citrix Fiberlink (an IBM company) Good Technology MobileIron We have found that there are architectural and cost factors associated with the provision of security, and therefore dedicate a section of the Whitepaper to the way in which the regulated security standard impacts the TCO, and have included relevant scenario analysis and charts. Intangible factors also impact the assessment of vendor TCOs by IT decision makers, which includes the costs incurred internally within the enterprise. As part of this study, Strategy Analytics analyzed the results of a series of qualitative interviews undertaken with CIOs and IT decision makers across a range of industries to understand their perceptions and how this impacts the TCO. 2.3 Approach used in this report The report explores the subject of TCO in 3 ways which are of relevance to EMM providers and enterprise buyers: The Total Cost of Ownership for Enterprise Mobility Management A deeper dive on TCO analysis for the Regulated Environment Commentary on factors which affect the TCO assessment an intangible way service attributes which affect the total costs incurred by an organisation Essentially, our research shows that IT decision makers are looking to minimize the TCO and maximize security whilst seeking efficiencies on a range of service attributes from platform flexibility through to customer responsiveness. Page 9 of 54, Strategy Analytics 2014

10 3 Assessing Total Cost of Ownership 3.1 Why Does TCO Matter? The EMM environment is rapidly evolving, in terms of devices, operating systems, and applications and content, which has seen EMM capabilities develop in order to manage challenging boundaries between business and personal information. This is reflected in the incorporation of enterprise app stores, app wrapping and evolved MDM feature sets. Consequently there is an increased reliance on support and maintenance from EMM vendors and a focus on their ability to manage the full scope of business needs from basic MDM to fully regulated environments. It is vital for IT to plan ahead and work with partners who understand and can support these needs. Strategy Analytics has sought to assess the Total Cost of Ownership (TCO) analysis of the EMM offerings from the 6 main vendors covered in this report. The analytical framework addresses the position of an IT decision maker seeking to understand the TCOs of EMM vendors based on his or her company needs, and with no specific provider in mind. These requirements invoke the service capabilities in each EMM vendor s offering, layering on each vendor s appropriate cost driver to provide the closest cost estimate for comparison purposes. The analysis for each competitor uses the same requirement inputs, but the pricing aspects of each provider s service (such as software licensing, hardware needs and maintenance fees) can create significant differences in the total cost of ownership. A company s needs and requirements may change over time, so it is important to assess how each vendor will be able to address future potential requirements such as the level of regulation or the extent of operating system support. Clearly the service offering by each player is not identical, and where operating system differences exist for example, we also wanted to track these factors. 3.2 TCO Approach and Choice Factors Our TCO approach relies on selecting service attributes, implementation methods and payment types in order to be able to compare the players on an equivalent basis. The diagram in Figure 3 represents the inputs which need to be applied in order to obtain the calculation for the TCO over 5 years. Page 10 of 54, Strategy Analytics 2014

11 Figure 3: Strategy Analytics EMM TCO Model IT Decision Maker Inputs How many devices to be supported? Your preferred feature set? Your security and control level needs? Number of users Expected number of devices per user - requirement from Mobile Device Management Mobile Management Mobile Application Management Mobile Secure Workspace (Container Solution) Mobile Content Management Enterprise grade Fully regulated Operating systems which need to be supported? Choice of ios, OSX, Android, BlackBerry OS BlackBerry 10, Windows Phone, Windows (incl. RT) Your choice of implementation On Premise Cloud EMM payment method Subscription Perpetual Migrating from previous EMM provider? From BES5 incl. no. of years over which migration to new platform takes place None YOUR 5 YEAR TCO FOR EACH EMM PROVIDER Results tables and charts Source: Strategy Analytics Page 11 of 54, Strategy Analytics 2014

12 3.2.1 Number of Devices In common with many TCO analyses, the number of devices is one of the primary drivers of cost, since this can impact hardware requirements, the scale of software licensing, support and maintenance. The model requires assumptions about how the user base is expected to grow, and also the number of devices per user. Although the number of devices is the foundation of the most common tariffing methods, the method in the model also caters for EMM providers who price their services based on the number of users Preferred Feature Set The Enterprise Mobility Management term is much broader than Mobile Device Management often associated with the basic management of mobile devices such as remote lock and wipe. The importance of management, enterprise applications and access to secure enterprise content are examples of how the breadth of functionality has grown and represents important aspects of meeting enterprise user expectations. The following feature categories have been used in the TCO: Mobile Device Management o Managing corporate & BYOD devices, configuring settings, enforcing security policies, and remotely locking and wiping devices Mobile Management o Controlling devices accessing corporate , preventing data loss, encrypting sensitive data and enforcing compliance Mobile Application Management o Distributing, tracking, updating and securing applications over-the-air, including via enterprise app stores Mobile Secure Workspace (Container solution) o Separating personal and corporate data to manage personas, apps and content Mobile Content Management o Securing distribution and mobile access to enterprise content / content locker Page 12 of 54, Strategy Analytics 2014

13 3.2.3 Security and Regulated Level Needs The provision of higher security enterprise mobility management for large enterprises, regulated industries and government agencies is addressed as a separate capability in our scenario model. BlackBerry calls this level of EMM Corporate Owned, Business Only (COBO) adding another acronym to the hierarchy, above BYOD and COPE. Our separation is done for 2 reasons: The architecture needed to deliver a level of security and control which meets the standards of government agencies and regulated corporates is different to regular enterprise mobility management features. The pricing of the delivery of this level of security is typically higher than that of other EMM feature capabilities and the TCO is often increased when the regulated level of security is provided Operating Systems Supported The ability of an EMM solution to support multiple OS platforms has grown in importance in recent years due to the explosion in BYOD, and the TCO model seeks to check whether the IT decision maker preferences for platform capabilities can be supported based on our rollout expectations by vendor. Where a desired platform is not supported by a particular vendor, this is highlighted in the model s automated notes Choice of Implementation The TCO model enables IT decision makers to choose whether to select an On Premise or Cloud based implementation. With On Premise, the hardware costs are calculated based on the dimensioning of EMM servers, routers and additional gateways, and these are dependent on the number of users and the number of devices per user. With the Cloud based solution, the hosting fee for the required number of devices is used EMM Payment Method Many (though not all) providers offer services on a perpetual or subscription basis. Often, perpetual fees are driven by the number of incremental devices added each year, and subscription fees apply to the number of devices actively being managed each year. Typically, perpetual becomes cheaper than subscription after about 3 years, but vendors do differ on this aspect Migration from BES5 or New Deployment Traditionally BlackBerry has dominated enterprise mobility management deployments and our analysis has been geared towards looking at a typical market position where many EMM customers have historically had corporate-owned BlackBerry devices only with BES5, and are Page 13 of 54, Strategy Analytics 2014

14 now looking to evaluate their options of whether to upgrade to BES10 for multi-platform EMM and to manage corporate and personal devices, or move to another multi-platform provider. This reflects the situation we observed in our industry interviews, where many EMM customers still retained some legacy BES5 infrastructure, with a proportion of their workforce using BlackBerry OS7 devices. Most EMM customers will therefore incur costs in migrating from BES5 to a preferred alternative. In addition, in our TCO scenario analysis we also wanted to cater for those businesses looking to obtain a multi-platform EMM solution from scratch Calculated Cost Factors The methodology used in the TCO calculates the total costs over 5 years, and includes the following factors: Capital costs, such as servers, routers and gateways Hosting costs for cloud services Software Licensing costs Installation and set up costs Training costs Support and update costs Maintenance fees Capital costs are based on estimates for hardware such as routers and gateways and driven according to the capacity of each server element. An EMM provider which does not offer an On Premise solution such as Citrix does not create capital costs in the calculations, but the hosting costs for cloud services are included. Where a provider offers both such as AirWatch the appropriate costs are included for the desired option selected. Many of the other cost factors are also driven by the capacity required. Although some costs such as training and support costs can be annual flat fees, most providers scale these according to the number of devices to be supported which is the approach SA has adopted in this analysis. Page 14 of 54, Strategy Analytics 2014

15 4 TCO Analysis for Enterprise Mobility Scenarios 4.1 Introduction to TCO Scenario Analysis Our scenarios take account of the breadth of the above TCO drivers, showing the forecasted effect over 5 years, based on Strategy Analytics expectations for the service development trends offered by each vendor. 4.2 Baseline Scenarios In order to understand TCO, Strategy Analytics has examined several scenarios which could be representative of a typical IT decision maker seeking to develop its EMM solution over the next 5 years, anticipating that its business is expanding and there will be a need to support a growing number of devices, operating systems and different ownership models. These cases assume that BES5 is already serving all users, and the decision to start migrating them to a new platform is made immediately, in order to see the effect over the next 5 years, through to The TCOs reflect the current pricing of service elements and support which we have been able to source freely for the 6 vendors considered in this report. However, we are conscious that the pricing of specific components by specific vendors can change quickly, and also be subject to commercial deals and discount promotions which may or may not be sustained. For example, we have found that the prices mentioned in some industry discussions by customers can be substantially lower than the list pricing provided by the EMM vendor. This highlights the level of competition in the market, as each of the 6 vendors seek to sustain or grow their market share. The above discount pricing affects the 2014 starting point, but the pricing trends applied in our modelling are common across all vendors for example we expect the headline price per device of basic MDM functionality to fall quite rapidly at a rate of 15% per year, being a relatively commoditized service offering, whereas the pricing of mobile application management declines only at 5% per year. However, we expect maintenance and support costs to increase slowly year on year a service necessity we expect vendors to use to retain revenues and margins from their EMM offering. These assumptions have been applied consistently between vendors in our analysis unless mentioned otherwise. Table 1 refers to the main assumptions used in our baseline scenarios. Page 15 of 54, Strategy Analytics 2014

16 Table 1: Key Assumptions and Parameters for Base Scenarios Parameter Assumption User base growth From 1000 users in 2014 to 1500 users in 2018 Number of devices per user Feature options desired Support options desired Choice of implementation Preferred payment method BES5 migration 2.0 (constant) MDM, , Application Management, Container solution, Content Management Training, support and maintenance On Premise Subscription Migration to any new platform choice over 2 years These parameters reflect the case of the BES5 user base being migrated to each of the 6 alternatives. 4.3 BES5 to BES10 Scenario The current estimated costs of BES5 are included to show the effect of the transition from In 2014, when the decision is made to migrate, enterprises can expect to see a brief surge in investment, required for managing 2 platforms for a period of time, before the costs return to a normalized trend. The example below is for BES10, which shows how new capital costs are incurred with the new BES10 server, although the longer term capex trend is quite modest for this level of users. The main effect of the migration is that the software licensing costs (CALs) are higher in BES10 than BES5, but when paying by subscription, the support and update costs are included in BES10. BlackBerry has smoothed the transition from BES5 to BES10 by providing the BES10 server software at no cost and by offering its Enterprise Server License Trade-up program, called EZ Pass. This allows a company to upgrade its BES5 and earlier perpetual licenses for managing BlackBerry devices to BES10 perpetual licenses that can be used to manage BlackBerry, ios and Android devices. The EZ Pass program also offers free licenses on a one-for-one basis on proof Page 16 of 54, Strategy Analytics 2014

17 that the applicant has licenses from another MDM vendor, and includes free technical support through to January The inclusion of BlackBerry Software Assurance across its paid technical support categories is intended to minimize the impact of future software upgrades beyond 2015, and help IT avoid unpredictable future outgoings, with a flat fee for support and maintenance package costs. While training and set up costs are at a peak in the initial 2 years of rollout, they also fall back subsequently as IT become familiar with and certified administrators for BES10. These are predictable costs associated with the introduction of any new middleware with a significantly expanded feature-set, with which IT needs to become familiar. Maintenance costs and subscription CALs become the dominant long term cost factors, based on our research of BlackBerry s pricing structure. Page 17 of 54, Strategy Analytics 2014

18 Annual costs ($K) Managed devices Figure 4: Cost analysis for migrating from BES5 to BES10 (Subscription, On Premise) Itemised Maintenance fees ($K) Support and update costs ($K) Training costs ($K) Installation and set up costs ($K) Software Licensing costs ($K) Hosting costs for cloud services ($K) Capital costs ($K) 0 0 Total managed devices (Right axis) Source: Strategy Analytics estimates BlackBerry has tiered its new support structure into three distinct levels to provide options that align to the level of expertise, assistance and resolution time required by a company, and in order to move away from a flat support structure to more efficiently support varied customer requirements. Advantage: Software Assurance, 24x7x365 Telephone and electronic Support (90 second target pick up time, 4 hour response time for electronic submission), 5 named callers, Open Session training discounts, productivity and diagnostic tools. Priority: Software Assurance, 24x7x365 Telephone and electronic Support (90 second target pick up time, 2 hour response time for electronic submission), 10 named callers, Open Session training discounts, productivity and diagnostic tools. Premium: Software Assurance, 24x7x365 Telephone and electronic Support (90 second target pick up time, 1 hour response time for electronic submission), Support Account Page 18 of 54, Strategy Analytics 2014

19 Manager, Tier 3 Direct Advanced Response Team (DART) access, Onsite instructor-led training, 25 named callers, Planning and preventative services and on-side service options available. This tiered support structure is vital in supporting a range of needs and requirements from basic MDM through to regulated environments. 4.4 BES5 to Airwatch The example below is a comparison with the pricing for AirWatch. The differences in the pricing structure are very noticeable, with software licensing costs dominating, and support and update costs being the next most significant. AirWatch includes all the maintenance fees within the basic software licensing cost components. Ongoing installation and maintenance costs are due to the continuing growth in the number of users and devices assumed as an input requirement. Overall the costs are calculated to be higher than BlackBerry in this scenario. The training costs associated with becoming familiar with new EMM middleware are not insignificant. Moreover, the additional features required to replicate the secure features in BES5 such as Software installation and configuration, system configuration assistance, initial support of pilot device deployments, advanced certificates integration as part of a deployment and advanced high availability disaster recovery configuration are all significant additional cost elements. Airwatch offers a three-tiered management suite which bundles its various feature-sets: Green Management Suite: Mobile Device Management, Workspace Container, App Catalogue Orange Management Suite: Mobile Device Management, Workspace Container, App Catalogue, Management Blue Management Suite: Mobile Device Management, Workspace Container, App Catalogue, Management, App Reputation Scanning, Secure Content Locker, Secure Browser. This allows for flexibility and bundling as many components are individually priced, but some of the components are included by default in BES5, such as secure browsing and secure . Therefore, the combined premises-based deployment and management suite costs can scale upwards significantly. It is possible that the chart below does not represent the most competitive deal that AirWatch would offer some customers in practice. Page 19 of 54, Strategy Analytics 2014

20 Annual costs ($K) Managed devices Figure 5: Cost analysis migrating from BES5 to AirWatch (Subscription, On Premise) Itemised Maintenance fees ($K) Support and update costs ($K) Training costs ($K) Installation and set up costs ($K) Software Licensing costs ($K) Hosting costs for cloud services ($K) Capital costs ($K) 0 0 Total managed devices (Right axis) Source: Strategy Analytics estimates AirWatch is not the only EMM provider to structure its pricing in this way and Fiberlink even includes support and update costs in the software licensing package, but breaks out itemized maintenance. MobileIron offers a similar cost component distribution, but itemized maintenance is also identified separately. The cost profile most similar to BES10 is Good Technology, although the latter breaks out itemized maintenance. When all the results are compared, it appears that customers will experience somewhat greater annual costs than BES5, albeit for a different type of EMM service one that does not necessarily provide the same level of uniform security, but supports a wider range of BYOD devices which BES5 did not. Page 20 of 54, Strategy Analytics 2014

21 5 year TCO ($K) 1500 Figure 6: TCO comparison over 5 years for Migration from BES5 to an Alternative (Subscription, On Premise) BES 5 alone Migrate from BES 5 to BES 10 Migrate from BES 5 to AirWatch Migrate from BES 5 to Mobile Iron Migrate from BES 5 to Good Source: Strategy Analytics estimates The pricing offered by BES10 appears to have been chosen to create the least-cost migration path from a TCO perspective. We attribute this to the Enterprise Server License Trade-up program, the impact of BlackBerry Software Assurance across its Advanced and Premium support categories, and new tiered support categories that move away from a flat model of maintenance pricing. Naturally, BlackBerry will also aggressively bundle its MDM, MAM and other management features, as it seeks to build momentum behind sluggish BlackBerry 10 device sales. Competitors have often priced features separately, whereas BlackBerry charges a relatively low fee for the broad feature set listed in Figure 3. BlackBerry had been relatively late to market in delivering a multi-platform solution for ios and Android in particular, causing many IT decision makers to consider other options, and we would regard this pricing as a way to build new momentum. For BES this includes free license migration through their EZ Pass program, free upgrades via software assurance and includes single-price cost elements such as Secure Work Space for ios & Android, BlackBerry s secure containerization solution for Android and ios operating systems. Page 21 of 54, Strategy Analytics 2014

22 Annual costs ($K) Managed devices 4.5 Impact of Perpetual Pricing In this scenario, we envisage the customer wishing to consider the implications of paying software licenses by subscription, or committing to a perpetual license. As an example, the results for AirWatch are shown below: Figure 7: BES5 to AirWatch Migration (Perpetual CALs, On Premise) Itemised Maintenance fees ($K) Support and update costs ($K) Training costs ($K) Installation and set up costs ($K) Software Licensing costs ($K) Hosting costs for cloud services ($K) Capital costs ($K) 0 0 Total managed devices (Right axis) Source: Strategy Analytics estimates The total cost of ownership in this case for AirWatch is $1.205m, some 10% cheaper than the subscription based approach over this period. The profile of the costs is also skewed towards the initial years in which the BES5 user base would be migrated the costs are associated with the incremental customers transferred to AirWatch. In the outer years of the TCO, itemized maintenance becomes the dominant cost driver. Page 22 of 54, Strategy Analytics 2014

23 5 year TCO ($K) In the main, the motivation for a company to opt for perpetual licenses ensures lower TCO costs over a longer period, as each new CAL is not included in ongoing costs, but rather paid for in the first year. This typically entices a company into a 3 year relationship cycle or more (on average) with one EMM provider, based on Strategy Analytics research conducted for this paper. Although subscription CALs are typically lower initially, they represent a recurring cost item for every year after implementation. However, with subscription CALs, there is a higher propensity to churn out providers as the relationship will often be more transactional or short term in nature. Even so, subscription may be preferred by IT decision makers, particularly those feeling their way in an uncertain and rapidly changing EMM market environment. Very competitive subscription fees appear to have been prioritized by BlackBerry in particular. A comparison of the TCO results for the perpetual EMM vendor scenarios is shown below: 1500 Figure 8: TCO comparison over 5 years for Migration from BES5 to an Alternative (Perpetual License, On Premise) BES 5 alone Migrate from BES 5 to BES 10 Migrate from BES 5 to AirWatch Migrate from BES 5 to Mobile Iron Migrate from BES 5 to Good Source: Strategy Analytics estimates For customers seeking a perpetual licence, the cost of migration from BES5 to BES10 comes out favorably for BlackBerry, as BES10 creates the least-cost migration path from a TCO perspective. We attribute this to the EZ Pass program, the impact of BlackBerry Software Assurance across its paid technical support categories, and these new tiered support categories that move away from a flat model of maintenance pricing. Page 23 of 54, Strategy Analytics 2014

24 In order to safeguard its installed base of customers, BlackBerry introduced EZ Pass in early 2014, which offers perpetual BES10 Silver-level licenses in return for proof of both existing BlackBerry MDM licenses and other vendors mobile device management (MDM) licenses on a 1 for 1 basis. BlackBerry is also offering its BlackBerry Advantage Level Technical Support (as highlighted earlier) free until January 31, 2015 on all BES10 licenses received and activated through the EZ Pass program. 4.6 Comparison of Cloud Offerings For organizations choosing cloud-based EMM services, hosting costs replace the capital costs associated with building the infrastructure needed to manage an On Premise solution. Installation and setup costs are minimized, but hosting fees can become a significant cost item as highlighted by Citrix in Figure 9. Citrix often presents a cloud-first product, although XenMobile MDM is offered both as cloud-hosted and on-premises. BlackBerry does not currently offer a commercial cloud MDM product, but since December 2013 has given customers free use of its cloud-based version of BES10 under a pre-launch Market Preview program, allowing up to 250 users per tenant and promising free use through to March 2015, the service is scheduled to launch commercially in the first half of However, hosted cloud offerings can potentially be a double-edged sword. While, EMM software updates do not require local configuration and patch management, there may be a challenge with IT s ability to control and adapt the EMM offering for its users, and in the case of outages, IT is dependent on the vendor to repair the fault and reliant on the vendor s support infrastructure. Page 24 of 54, Strategy Analytics 2014

25 Annual costs ($K) Managed devices Figure 9: BES5 to Citrix Migration Subscription CALs, Cloud hosting Itemised Maintenance fees ($K) Support and update costs ($K) Training costs ($K) Installation and set up costs ($K) Software Licensing costs ($K) Hosting costs for cloud services ($K) Capital costs ($K) 0 0 Total managed devices (Right axis) Source: Strategy Analytics estimates Strategy Analytics estimates that the cloud solution does not change substantially the TCO for AirWatch but it does appear to increase the cost more significantly for MobileIron. Page 25 of 54, Strategy Analytics 2014

26 5 year TCO ($K) Figure 10: BES5 to Cloud Based EMM Migration Subscription CALs Migrate from BES 5 to AirWatch Migrate from BES 5 to Mobile Iron Migrate from BES 5 to Fiberlink Migrate from BES 5 to Citrix Source: Strategy Analytics estimates In a hosted cloud-based scenario for EMM providers, the lowest 5 year TCO appears to be offered by Fiberlink. Fiberlink MaaS360 offers the cheapest TCO for those prepared to invest in a perpetual license and would be content with a commercial EMM security standard. Fiberlink MaaS360 is delivered entirely through the cloud, at present (although there are firm plans to offer an on premises version in 2014) and is one of the quickest enterprise mobility offerings to install. BlackBerry and Good have been later to market with their cloud offerings due to their focus on regulated environments which has been associated with On Premise deployments. Both companies have announced an intention to launch their cloud offerings, and as previously mentioned BlackBerry already offers a free preview program on its cloud service, but we do not yet have definitive pricing to enable them to be added to the TCO analysis above. Page 26 of 54, Strategy Analytics 2014

27 5 TCO for Regulated Security Standards 5.1 Regulated Environment Requirements Regulated environments require a carefully considered view of the complete end-to-end enterprise mobility solution: the network architecture, connectivity between the core network and device endpoint, as well as the device and operating system itself. Figure 11: Regulated represents the most advanced form of EMM Regulated-level Enterprise Mobility Management Level of Enterprise Mobility Management policy Open policy, low management needs Managed devices for some end-users and laissez-faire for others Regular Mobile policy for everyone Segmented Mobile Policy Mix of lockdown and managed devices 100% lockdown Gold level Advanced Enterprise Mobility Management Legal & Professional Services, Oil & Gas, Financial Services Government, Central Agencies, Regulated Industries Silver level Enterprise Mobility Management Basic Management Soho, small to Medium Business with no company policy Small & Medium size business Media & other nonsecurity sensitive industries Large & Medium Enterprise security sensitive Large Enterprise with multiple different levels of device management & security Large Enterprise high security Source: BlackBerry, Strategy Analytics Based on the premise that a chain is only as strong as its weakest link, the optimal solution encompasses a layered security approach. A solution should incorporate: High level cryptographic standards such as AES 256 and/or Triple DES that can secure data in transit and data at rest an architecture that encrypts information end-to-end as far as possible to prevent man-in-the-middle (MITM) attacks. Page 27 of 54, Strategy Analytics 2014

28 Device Operating Systems must be secured using comprehensive enterprise mobility management tools, encompassing a broad range granular IT polices that can be enforced through a central, administrative console. Some controls will be very specific, such as specifying the number of minutes after a secure work space locks that the device turns on advanced data at rest protection for the work space. Devices themselves will need a high number of technical controls that do not require user intervention and can be administratively controlled; a reliance on procedural or manual controls opens the way for a high degree of residual risk. Regulated environments are more challenging for EMM providers. While security is a critical factor as examined above, in regulated environments there is a need for other granular hardware and software elements that are core components of compliance as highlighted in Figure 12: Hardware Controls: The ability to completely manage and isolate hardware elements such as disabling ports on a device to prevent data removal and access that goes beyond encryption. In these environments an OEM that does not allow these hardware elements to be controlled or even disabled is not a suitable choice. Software Controls: The ability to not only manage and disable wireless controls, but also the ability to manage all correspondence. While some vendors such as Good Technology can manage logging as mandated by NYSE & NASD SEC 17-A, Joint Guidance require brokerage firms to capture broker/dealer communications with customers. For example, others such as BlackBerry offer comprehensive and multiple logging options that extend to voice (Phone Log wireless Synchronization), Video Chat (Video Chat Log wireless Synchronization), SMS and MMS logging and even CCL (Context Collection Library) for data collection across all apps. Page 28 of 54, Strategy Analytics 2014

29 Figure 12: Comparing Requirements from SMB to Regulated Environments Managed for Some EMM Service Level Requirement Managed for All Segmented Locked Down & Managed Mix 100% Locked Down Type of Enterprise Small and Medium Business that do not require Lockeddown devices Large and Medium Enterprises that do not require locked down devices Large Enterprises with Different Levels of Device Management Large Enterprises that are Security Sensitive Government and Regulated Industries Full Mobility Management All Vendors All Vendors All Vendors All Vendors Regulated Level Mobility Management BlackBerry Good Technology Mobile Iron BlackBerry Good Technology BlackBerry Source: Strategy Analytics 5.2 Understanding Regulated Network Architectures In terms of enterprise mobility management, it is important to identify the different types of architecture employed to support regulated environments. These are outlined in Figure 13. As we have explored, regulated environments are more stringent in their requirements than basic EMM functions, and the cost is typically higher as identified in our TCO scenarios highlighted in Figure 21 at the conclusion of this section. In essence the fewer components required for the architecture the more secure and lower cost the offering will be, with fewer component cost elements required. This means that vendors with their own secure NOC infrastructure are most suitably placed for regulated environments, as corporate information never runs the risk of exposure to the untrusted WAN environment, nor do other risks such as split tunneling (whereby information from a browser session may be inadvertently leaked into the untrusted WAN domain) pose a threat. Page 29 of 54, Strategy Analytics 2014

30 Figure 13: Walled Garden v BlackBerry Architecture Source: Strategy Analytics Vendors able to offer this approach are limited to BlackBerry and Good Technology. Other vendors wishing to support regulated environments such as MobileIron, offer additional components to their infrastructure, such as the Sentry gateway, which establishes trusted sessions through the use of certificates to prevent man-in-the-middle attacks. Only secured and authorized services can access enterprise resources, and that access can be automatically disabled if the mobile user or device falls out of compliance. However this adds cost to the solution with additional Sentry gateways costing around $4,900 each for the appliance gateway alone (excluding support and maintenance), which raises the TCO costs significantly. 5.3 Vendor Security Rankings Strategy Analytics conducted qualitative interviews with IT decision makers using a variety of EMM solutions which included capturing views on security among other criteria. The respondents Page 30 of 54, Strategy Analytics 2014

31 were asked to rank each vendor on a score of 1 to 5 with 1 being very weak and 5 being excellent. Other criteria are examined in section 6. With a score of 4.9 out of 5, and with the next best competitor achieving 4.4 out of 5, BlackBerry is clearly still out ahead in terms of security. For the purpose of the TCO, it is clear that not all providers offer the same level of security so the comparison relies on the provision of a regulated service where available. Figure 14: Customer Ranking of Security Performance of Different Solutions Customer Ranking of Security Performance of Different Solutions BES10 Mobile Iron Good Citrix Fiberlink Airwatch Source: Strategy Analytics End User Interviews, Jan 2014, n=14 BlackBerry and Good Technology are widely regarded as having architectures which deliver these levels of control for regulated environments. Other vendors such as MobileIron, have added additional capabilities that can be used by regulated environments through the Sentry appliance gateway, which offers secure tunneling and access control to protect data-in-motion. In our interviews with CIOs and IT decision makers, we discovered that BlackBerry received the highest ratings in terms of information security, while Good Technology and MobileIron also ranked highly. A rating significantly above 4 is equivalent to a strong regulated security offering. Page 31 of 54, Strategy Analytics 2014

32 5.4 BlackBerry in Regulated Environments BlackBerry Architecture As Figure 14 highlights, Blackberry is still seen as the most secure architecture, which is outlined in Figure 15 and reinforced by recent announcements of BES10 being granted Full Operational Capability by the United States Department of Defense and FIPS-140 validation for the Secure Work Space for ios & Android containerization product. Some of the reasons were highlighted in the interviews and covered the following areas: BlackBerry supports the full range of security needs; from a basic level up to very high levels of security and control with an end-to-end approach. BlackBerry s protection against data leakage and against unauthorized devices accessing corporate assets. Provision of a single outbound port communication model which negates the need for additional VPNs Ability to secure corporate data and applications on BYOD personal devices MDM options that assure end-users of their privacy (through BlackBerry Balance and Secure Work Space) Regulated-level Enterprise Mobility Management controls and settings (BlackBerry calls this their Gold level EMM option) that enables full compliance for government and regulated environments Page 32 of 54, Strategy Analytics 2014

33 Figure 15: BES10 Architecture Source: BlackBerry All respondents highlighted that BlackBerry was still the most secure end-to-end solution. Some of this was attributed to the limited APIs that Apple makes available to EMM providers that limits what elements can be controlled by third-party vendors, while others said that the more mature EMM solutions were sufficient for their needs. For companies that wanted to be fully compliant, BlackBerry remains a gold standard: Security is a key factor and it is vital that client s information is secure. We know with BlackBerry that the information is securely managed end-to-end and that we are compliant 1 BlackBerry is still the diamond standard for security 2 1 BES5, BES10, MobileIron and Good Technology (Trial) Customer, (Professional Services, UK, >1000 employees), 2 BES5, BES10, and MobileIron Customer, (Professional Services, UK, employees) Page 33 of 54, Strategy Analytics 2014