totally agree with that last point. With it not being an "official project" I would actually prefer this. My experiance with espeically with pure security proj

totally agree with that last point. With it not being an "official project" I would actually prefer this. My experiance with espeically with pure security projects (as opposed to security piggybacking on other projects to get what they want) trying to get a business case for a project is really tough. So getting project approval, prioritization, resources all rolling is a very hard and time consuming process. I want this app to be something anyone in a IT security department can just subscribe and use straight away. If it gets a shadow IT following and the orgainzation really likes it I can get then sell a gold or platinum customization piece which will be a proper project with procurement and contracts involved and consulting time from my company Your third point - I really don't want people to be preasured to use this because of the investment, the users then grow to hate the product and that is no good for anyone.