CIOs Admit They Are Being Forced To Upgrade Enterprise IT (computerweekly.com) 68
Computer Weekly reports:
A Censuswide survey of 2,018 CIOs and senior IT decision-makers at large organisations in the US and UK for independent software maintenance provider Origina has found that organisations spend almost $13m on upgrades pushed by IT providers. On average, 28% of enterprise software budgets go on upgrades, migrations and licensing changes driven by their IT suppliers. IT leaders who took part in the study reported that their organisation would not have actively chosen to upgrade...
The research published in Origina's The Software Tax report, in partnership with Thinkers50, suggests these costs have shifted the balance of power between buyers and sellers. Customers exercise choice once, at the point of purchase. After that, control over the timing and terms of change passes largely to the IT supplier. Out of those surveyed, 78% agree their primary provider of enterprise software, rather than their own organisation, sets the timing and terms of change. A similar proportion said they would have no meaningful choice but to accept if a major enterprise IT provider changed its commercial terms. Some 76% said their organisation has very little real leverage in negotiations, and 80% said moving away from major IT suppliers would cause significant disruption...
Marshall Van Alstyne, professor at Boston University and co-author of The Software Tax, said: "Economists have studied this problem for decades: once a customer makes relationship-specific investments, the vendor gains leverage that no contract can fully anticipate. For CIOs, the lesson is simple: negotiate the exit before the entry. You don't have to leave a vendor to benefit from being able to."
The problem can be summarized succinctly, says Tomás O'Leary, CEO/founder of Origina and co-author of The Software Tax.
"The market has left some of the most experienced technology leaders in the world with little room to refuse, and that cost shows up in budgets, in engineering time and in innovation that never gets funded. We want to make that cost visible so customers can start to take back control of it."
The research published in Origina's The Software Tax report, in partnership with Thinkers50, suggests these costs have shifted the balance of power between buyers and sellers. Customers exercise choice once, at the point of purchase. After that, control over the timing and terms of change passes largely to the IT supplier. Out of those surveyed, 78% agree their primary provider of enterprise software, rather than their own organisation, sets the timing and terms of change. A similar proportion said they would have no meaningful choice but to accept if a major enterprise IT provider changed its commercial terms. Some 76% said their organisation has very little real leverage in negotiations, and 80% said moving away from major IT suppliers would cause significant disruption...
Marshall Van Alstyne, professor at Boston University and co-author of The Software Tax, said: "Economists have studied this problem for decades: once a customer makes relationship-specific investments, the vendor gains leverage that no contract can fully anticipate. For CIOs, the lesson is simple: negotiate the exit before the entry. You don't have to leave a vendor to benefit from being able to."
The problem can be summarized succinctly, says Tomás O'Leary, CEO/founder of Origina and co-author of The Software Tax.
"The market has left some of the most experienced technology leaders in the world with little room to refuse, and that cost shows up in budgets, in engineering time and in innovation that never gets funded. We want to make that cost visible so customers can start to take back control of it."
Proprietary software needs to be abandoned. (Score:4, Informative)
FOSS software of course also has an upgrade cycle however there are really major differences
Re: (Score:2)
BS.
FreeBSD and Linux, force you to upgrade, or the OS vendor will DELETE THE PACKAGE REGISTRY. So unless you feel like recompiling everything from source from the first day you installed the OS, you can not rely on the vendor not doing a rugpull. FreeBSD was so quick to destroy the previous version's ports library that it left machines unable to upgrade when they removed the drivers for that hardware's RAID array. Up until that point the OS was regularly updated. Now it's just stuck and since OpenSSL is the
Re: (Score:3)
FWIW, I have a version of Debian from around 2000 that still runs. I *do* have it isolated from the internet.
Re: (Score:2)
Awesome. But would you put such a system into production in todays environment? These are corporate users relying on their computers for revenue-producing efforts, not a toy in their basement running text-based games.
Re: (Score:2)
Shouldn't pretty much every major org run something like Red Hat Satellite, Artifactory, whatever for this exact issue?
Re: (Score:2)
Shouldn't pretty much every major org run something like Red Hat Satellite, Artifactory, whatever for this exact issue?
Yes, if you are a major organization you need to do supply chain checks and that means you need servers that store artifacts.
I'd be concerned about Red Hat since their commitment to Open Source seems to have faded considerably. It's all very well having the artifacts, but if your ability to know how they are generated and what they contain is compromised you have a problem.
Re: Proprietary software needs to be abandoned. (Score:3)
Re: (Score:2)
I still have really angry memories of having to change every single function that called a regular expression because all php did was reverse the parameter order and rename the function.
Wait until you learn about Python 3.
Re: Proprietary software needs to be abandoned. (Score:1)
Python 2 users were supported for more than a decade after 3 came out, and there was a LOT of migration tooling released. CIOs may not want to be forced to upgrade too often, but if they think upgrading once every 10 years is too much, then they need to quit and get into something more aligned with their expectations. Perhaps blacksmithing.
Re: (Score:2)
Re: Proprietary software needs to be abandoned. (Score:1)
Not half as violent as allowing obsolete approaches and flawed architecture to remain out of some weird combination of concern for backwards compatibility and sentimentality.
Re: (Score:2)
Since it bothered you so much, I can only assume that you inflict breaking changes on end-users merely because you are lazy, without consideration for the problems it will cause them.
Re: (Score:2)
For Linux (Debian in particular), it's more like encourage and assist. You can use whatever version you want, if you know what you're doing.
Re: (Score:2)
Now only if there was a way to mirror the upstream, to render that risk null.
Oh, wait...
Re: (Score:3)
Linux distros also relentlessly expire signing keys so that even if the packages are still there the system will refuse to install them because some signing key has hit its arbitrary EOL. The result is an infinite number of posts to forums telling users how to completely disable all verification of packages in order to allow an older system to be updated.
The fix is pretty trivial, don't arbitrarily decide that a key that was perfectly fine on Tuesday can no longer be used on Wednesday, but that would sap a
Re: (Score:3)
If there were an open source point of sale/inventory package available that was capable of replacing our current proprietary system, we'd be on it in a second. Until there is, and there never will be, we're stuck.
Re: (Score:3)
Not sure of your needs, but I know there are a bunch already ; if you started adopting one of the preexisting ones a few years ago, it would probably be complete for what you need by now. Always worth putting a little aside to make sure that you have a FOSS second supplier available.
Re: (Score:2)
Your listed FOSS benefits exist because the user assumes responsibility for support, the moment you rely on an outside source for support they will dictate upgrade cycles.
Re: (Score:3)
We're talking enterprise here, in which case the organization really has to take control of the upgrade cycles even with outside vendors, otherwise they will end up failing security audits as well as having vendors come in and break things at critical moments like end of year closing.
Re: (Score:2)
Look at the real world - article misses the point (Score:3)
Any major manufacturer would stop adding new parts suppliers at some point in time.
Any major manufacturer would negotiate contracts which help both the supplier and the customer.
IT somehow does not consider this when purchasing, building or using a system.
Somehow, no one of the top government leaders realizes that private equity could severely lower GDP by taking over Salesforce or equivalent and then increasing licensing costs 100x just before the license ends.
Not to mention that Amazon, Microsoft or Googl
Re: (Score:2)
we call that pulling a broadcom
Re: (Score:1)
Re: (Score:2)
I've met that in some terrible Indian IT consulting type companies. I can't understand why they don't understand that there is an FOSS market, that it's the key area for development of strategic software but also for current attempts by companies to control and develop future software. More strange is the fact that they must know that FOSS is included in Windows, MacOS, z/OS and basically everything else. In the 1990s, when Microsoft was still fighting it's battles of old then this could be sustainable, but
Re: (Score:3)
Yes, but 30-40 years ago the computing landscape in companies was much different. It hadn't extended to damn near everything the company did. This is different now so a change 30-40 years ago was minor in terms of cost to the company, now it can elicit major whining from accounting.
Re:Old news is so exciting. (Score:4, Interesting)
Yes, but 30-40 years ago the computing landscape in companies was much different. It hadn't extended to damn near everything the company did. This is different now so a change 30-40 years ago was minor in terms of cost to the company, now it can elicit major whining from accounting.
Ah yes - accounting. You are correct that the accountants will whine. In irony, much of the expense is directly attributable to accounting demands. At the place I retired from, after accounting went from 3 people to the largest division, I joked that soon, we'd be hiring a 6 figure accountant to keep close tracking of the 5 thousand dollars we spent on number 2 pencils. And then...
And all of that intense accounting requires the IT to do that.
Re: (Score:2)
Re: $200 expense (Score:2)
What was her name?
Re: (Score:2)
I had the head of accounting personally come to my cubicle for a $200 expense.
My favorite trick for snotty bean counters is asking "Since we have teh 13 digit job numbers, do I need a special number for using the restroom?
They get very twitchy, because in that world, scratching your butt is removing time from assigned time.
LDAP and Linux are freely licensed (Score:4, Interesting)
Hire up 5-10% more IT and technical writing staff to support and train your regular and engineering staff. You don't need ActiveDirectory, Exchange, and Windows for 90% of your team. Cost for support and licensing is a tiny fraction of Microsoft, etc. and you have more flexibility on when upgrades are forced on you with free or cheap support on a version fork going out to 5 years or more. There are handful of enterprise components that are not easily found in open source. Sometimes you can do without them, or only a certain group within the org needs them. Othertimes you can get contractors to build what you need and a small support staff to maintain it. Especially if you can leverage it as an enhancement to an existing open source project.
Re:LDAP and Linux are freely licensed (Score:4, Interesting)
I don't think the main issue is the end-user software. It's all the other stuff that makes the company work. I work for a small startup, and I can list at least a dozen software platforms that we use, and I'm sure there are dozens more; none of which we could trivially migrate away from. (Fortunately, most of which I don't really want to, as they work fairly well.)
Besides the technical stuff, there's the HR benefits, the expense reporting, the door lock manager, the office reservation system, etc. I'm sure all of these are subscriptions. Many are probably quite inexpensive, but some aren't.
At some point, it will be cheaper to tell Claude, "We use the OverPriced platform. Examine our usage of it, and develop a replacement platform tailored to our needs, and include a transition plan to suck all our existing data and configurations over to the new system." But then there's one more system to support locally, which may not be worth the cost. Or if OverPriced is too ridiculous, do the same, but spin it off as FairPriced and compete.
Re:LDAP and Linux are freely licensed (Score:4, Informative)
Welcome to the yearly budget review. What have we got on the table today?
a) Update hardware and upgrade licenses at a cost that upsets the accounts?
b) Plan a migration of company systems away from an integral supplier, retrain all staff, learn all new different tools, build new interdependencies between software, change ways of working and procedures, all at a cost that would make the CFO go hang himself?
I think most companies will pick a. Even if in the long run there is reduced cost to going the open source direction, it's a HUGE investment to migrate a company's entire IT systems from one platform to another. Huge. The sticker price on the software box isn't relevant here.
Re: LDAP and Linux are freely licensed (Score:2)
There is always negotiation around capital expenditures and head count at the places I've worked. It is tough to make the argument purely on long term savings alone, because it is so disruptive.
On the other hand, engineering managed to get Macbooks added to the list of approved systems even though they are more expensive to purchase and more complex to manage (difficult to image and tie into the corporate services). So it is possible to do things even when they are financially and logistically a less desira
Re: (Score:2)
That sounds great, until the OS vendor stops supporting the OS you are currently running, requiring an OS upgrade that may involve a hardware upgrade.
Running an OS that no longer gets security updates is typically not an option for any organization of a certain size.
There is no such thing as legacy anymore (Score:4, Interesting)
There are still 0.4% of people in denial and still running Windows 7 as well according to Statcounter, they are going to get just desserts if they don't install Linux or force an upgrade to Windows 11.
I've been on both sides of the argument when it comes to legacy systems, but the old ways are obsolete and AI has caused what I call "naked computing", where all vulnerabilities are found almost immediately.
Re: (Score:2)
If it's not actively patched and supported, it's a sitting duck to coding AI and botnets of vulnerability scanners. Like it or not if you don't want to update something, disconnect it from the internet AND the sneakernet by disabling inputs as well. There are still 0.4% of people in denial and still running Windows 7 as well according to Statcounter, they are going to get just desserts if they don't install Linux or force an upgrade to Windows 11. People have such short memories. Remember the day after Microsoft stopped supporting XP? We begged them, we told them it was a ticking time bomb, we even had the chilling term, "The eXPocalypse. But would they listen? NO!. they laughed at us. Told us we were whiners spreading FUD.
Then it happened, the day after support ended, the internet died. Planes fell out of the sky, entire nations were reduced to rubble, the living envied the dead. Crops failed, and we had to start all over from hunter-gatherer days. Humanity hung on desperately, we were on the cusp of extinction.
It was a hard long journey back, but we made it. And the only reason we made it back was Windows 11, the most secure Operating system ever. All hail Microsoft, the savior of the world, as we rise like the Phoenix from the ashes of the eXPocalypse! Praise them with great praise!
Re: (Score:1)
It's not our problem that people misuse tools. If I want to run a website using PHP, and the AI robots discover a problem in PHP to exploit, PHP should be backporting that fix all the way back to PHP3. But instead they decided that they will only backport it to what they consider LTS and tell everyone else to go ef themselves.
Re: (Score:2)
Who is this "they"? A story I read yesterday said that PHP was being maintained by a single maintainer.
Re: (Score:2)
It's not like this is new behavior from PHP.
It's not like PHP is the only choice.
This is called "risk management" and a good technical staff will be doing it constantly. If PHP is a problem, make a strategy to get the fuck off of it, and start executing.
Re: (Score:2)
And the only reason we made it back was Windows 11, the most secure Operating system ever.
Have no fear. Windows 12 will be out soon. Patching all those holes in W11.
Re: (Score:2)
And the only reason we made it back was Windows 11, the most secure Operating system ever.
Have no fear. Windows 12 will be out soon. Patching all those holes in W11.
Wasn't Windows 12 prophesied in The bible in Revelations as the end of the world?
Re: (Score:2)
You know, sometimes AI is good for something: (prompt: "generate a fake prophecy, in the style of the biblical book of revelation, that predicts both windows 12 and the end of the world")...v26 is peak for those not wanting to be bothered with the rest. :-)
And I saw in the latter days a vision, and behold:
2 The firmament of glass was spread out upon the earth, and upon it were set ten thousand times ten thousand windows, each shining with a pale and shifting light.
3 And lo, the users of the earth were gat
Re: (Score:2)
“Behold, I make all things new. The last window is closed, and the true dawn is opened.”
37 He that hath ears to hear, let him hear: for the age of updates passeth away, and the kingdom that cometh shall never again prompt, ‘Would you like to restart now?’
This needs to be at +5 - get to work mods!
I am in utter awe! I laughed until the tears rolled out. Possibly the best thing I've ever seen on the internet, let alone Slashdot.
Re:There is no such thing as legacy anymore (Score:5, Interesting)
There are still 0.4% of people in denial and still running Windows 7 as well according to Statcounter, they are going to get just desserts if they don't install Linux or force an upgrade to Windows 11.
The real world is more complicated than that. For example, we still have a Windows 7 machine in my office. It has some very expensive but still very useful software locked to it that has no direct replacement available on either Linux or Windows 11. Obviously we have to be careful about security and controlling access to a legacy OS like that.
Blunt statements about "forcing an upgrade" are worthless in this kind of situation. Chances are anyone who is still using a system like that has a good reason for it, at least if it's in use professionally. We buy these assets because they solve problems. Those problems might or might not have a useful and cost-effective solution available on a different platform. If there is no modern solution available and the original still works, your statement that "the old ways are obsolete" is by definition false.
What you do need to do is rationally assess the risks and the threats you face and provide other ways of mitigating the risks and protecting against the threats if you can't rely on, for example, a legacy OS that no longer gets security updates to be secure by itself. But then ideally you shouldn't be relying on any single device or piece of software being secure as your only line of defence anyway, and assuming you already have some degree of defence in depth, accommodating unusual requirements is more a redistribution of security responsibilities than a fundamental change of approach.
Re: (Score:2)
We're running a business here. We need real software, not toys created as a fun weekend experiment with a chatbot or burning money to run an agent and get 50% (or more likely 5%) of the way there.
Or to put it another way ... (Score:2, Insightful)
Most CIOs would rather let their software moulder away; Who needs to respond to CVE's anyway?
Balanced Equation (Score:2, Insightful)
The other side of this equation is that CIO's would, more often than not, struggle to get their business to fund upgrades if they were a matter of choice rather than necessity. So it is right to say that CIO's are forced into upgrades, but it would also be right to say that if they really thought this whole matter through, they would probably prefer the status quo than to be in a situation where their board won't approve the upgrades they (or their team) do want to do for various good reasons that don't mee
Re: (Score:2)
Quite so (Score:5, Interesting)
IT services, and SaaS providers, have a business model more similar to Facebook or Twitter. Their benefits are in direct conflict with their "customers'" benefit. A closed system with no interoperability? Benefit; customers cannot change provider. Complicated and obscure back-end? Benefit; customers pay more for support. Non-compliance with reporting and storage formats? Benefit; customers cannot combine with other vendors or export data. This creates quite a problem, as incentives run counter to more traditional business models and favor illegal/unethical business practices. Parasitic behavior in other words.
On the other hand, updating security is a requirement in the AI age. It is such a requirement that one would expect it to be included in the original contract.
Back in my day something called an interface was popular for programming: a promise that a modular implementation would support a set of functions with a specific output. I do feel that the industry should be required to accommodate such standards to enforce vendor interoperability. This would have the added benefit of opening up the field to smaller players, and competition would lead to increased innovation and less rent-seeking from major players (VM-ware is tied with Martin Shkreli for the top position here).
report findings (Score:4, Informative)
This report is largely an advertisement for Originaâ(TM)s contract negotiation services. It is sparse on detail and should be viewed skeptically.
Methodology
* Research firm: Censuswide
* Commissioned by: Origina
* Fieldwork: May 11â"19, 2026
* Sample: 2,018 senior IT decision-makers
* Geography: US 1,011; UK 1,007
* Seniority: Director level or above
* Eligibility: Direct influence over software budgets and renewals
* Organisation size: Revenue of $1bn+ or 10,000+ employees
* Vendor exposure: IBM, HCL, VMware/Broadcom or SAP at meaningful scale
* Industries: Financial services, insurance, telecommunications, public sector and retail
Key findings
* 95%: Had paid for a vendor-driven change they expected to reduce performance, reliability or business value.
* 78%: Said their primary vendor controlled the timing and terms of change.
* 76%: Reported little real negotiating leverage.
* 80%: Said switching major vendors would cause significant disruption.
* $12.87m: Average reported cost of the most recent vendor-driven change.
* 28%: Average share of enterprise software budgets spent on vendor-driven changes organisations would not have actively chosen.
* 84%: Said senior engineering staff often or always maintained vendor-driven changes instead of building future capability.
Contract negotiation priorities
* Renewal pricing: Cap annual increases and define expansion prices.
* Support: Set minimum support periods and advance notice of withdrawal.
* Upgrades: Limit mandatory changes; require written justification and cost estimates.
* Exit: Agree migration fees, assistance and transition rates in advance.
* Portability: Guarantee data export, documented APIs and transition access.
* Maintenance: Permit independent support where feasible.
* Security: Define patching obligations and response times.
* Cost tracking: Include engineering time, downtime and hardware replacement in change assessments.
Note that considering a thriving open source community is missing from their messaging.
Relationship-specific investments or Vendor Lockin (Score:4, Insightful)
Relationship-specific investments. That's vendor lock-in. VMware under Broadcom being a more recent case. In this day and age where everything relies on telecoms and computers, once you standardize on a specific vendors IT system then the IT vendor effectively own you. You're just the delivery people [edge-op.org].
Not what I'd call in upgrade (Score:3)
We just migrated to a hosted server for our main point of sale/inventory system. Not because we wanted to, but because there was literally no other choice. The in-house server was end of life, and the vendor just refused to sell us a new one. There's nothing - we have looked - that can replace it, open source or otherwise, without extensive customization that would take several years and require a full time staff of programmers, plus the active cooperation of the national franchise that would not be forthcoming, at a cost of millions.
And it's not an upgrade. We've had more offline time in the last two weeks that we did in the last year with the in-house server, and there are some very important functions that are, at best, unstable and almost unusably slower. They can't even get the login screen to work right.
And it costs us about 50% more than the platinum support contract we had before.
That's not an upgrade, it's a clusterfuck.
Re: (Score:2)
TCO is no longer taught
These predatory vendors helping 3rd party options (Score:2)
Companies like Origina, Spinnaker, Rimini Street, Natrinsic, Azul and a gaggle of others are all benefiting from rent-seeking predatory licensing and support practices from established brands. Once the incumbent thinks they have you locked in, they turn the screws on service and support costs, especially if you stop buying new kit from them. Ultimately, I think this is a good news story for open source based application stacks....at least the ones that don't get hoovered up by those already bleeding their
"80% said moving away from major IT suppliers woul (Score:3)
The Microsoft model (Score:4, Insightful)
Re: (Score:2)
i mean ms didn't really provide a new os so technically you are still on 10
Who cares least controls the relationship (Score:5, Interesting)
This story is so old it was the reason for Unix. Once the platform controls the essential business process, it owns the business. You work for them now, and all your aspirations are moot.
On the flip side (Score:3)
When you see some CIOs who refuse to upgrade because they don't want to spend money, there is the flip side where these same CIOs keep the software for far too long. In 2026, seeing 2012 versions of programs is a BAD thing in a corporate setting because you run into compatibility issues with newer versions of the operating system(stuff from before Windows 10 having issues under Window 11).
Artificial limits, or subscription models are a bad thing, but when you know something is going end of life, do the jump to something new, before your old software loses support and the VERY important migration path to new software. I've seen it even in the consumer space, the old Eudora e-mail program was going to go end of life(Qualcomm was shutting the project down), and a migration tool to Thunderbird was provided as the path for users. The problem came from those who stuck with Eudora because people did like the program. BUT, then you have the problem where when you DO finally want to upgrade, and the tool to export to Thunderbird no longer works well, or it crashes because of 200+ mail folders. That's where it gets ugly to do the migration.
For Windows at least, Microsoft allowed the Windows 7 to Windows 10(and then 11) upgrade path to continue working, but it's possible that Microsoft may turn off the upgrade from Windows 7 at some point, and that is when it will get ugly for people who want to FINALLY upgrade the OS. Trying to migrate to new hardware for those currently on Windows 7 is already a BIG issue if there are no drivers for this and that.
So, outsourcing isn't the answer? (Score:2)
Friedmanite MBA, outsource everything.
Wait, you mean the company we outsourced to has raised their prices to higher than we were paying for in-house? Why on earth would they do that (other than ROI for them)?