Questions about #3: Considering all the servers in the world that ought to be audited with software like yours, 1. Who is deemed responsible for security aud

Questions about #3: Considering all the servers in the world that ought to be audited with software like yours, 1. Who is deemed responsible for security auditing by management.ownership? In-house administrators or outside consultants? 2. What percentage of these servers are owned by little enterprises (who don't feel the need to buy from IBM/CA/etc.) vs. Fortune 1000 companies? 3. Of those servers whose security audits are done by consulting firms, are those firms big or small? I'm semi-familiar with the bug tracking software space, so I'll use it as a possible parallel. Every IBM-ish tools vendor sells a bug tracking software package. They're always expensive and sometimes suck. They are sold because a salesman visits a large company and convinces them to buy a big, supposedly integrated suite of products. Yet, FogBugz (FogCreek) and JIRA (Atlassian) seem to be pretty good businesses. My experiences suggest that smaller customers (1) won't pay 10x just because it's from IBM, (2) buy based on perception of quality/value rather than vendor image, and (3) allow their technical staff to influence purchases like security audit software. So, back to the questions at the beginning of this post...What percentage of the audit-worthy servers are managed by the kind of people who would purchase FogBugz/JIRA? It seems that you could build you brand reputation among these folks with good blog posts, presentations at conferences, and some guest-authored security articles (the Joel model?). Noting that I know little about security audit software, one downside may be that companies can CYA by saying, "But, we audited with [Insert big company here]'s award winning industry-standard software tool. How can you blame us for getting hacked? Management may be thinking along these lines when choosing to spend $70K on a POS product. However, your customers may be those who actually care if they're hacked or not! I don't like #2 because I think you could easily be beaten up on margins, and I don't see why you would be better at running this business than other entrepreneurs out there. #1 is tough because it doesn't get management attention. Management expects to buy security audit software, and risk aversion leads them to want to make a purchase. However, you'd be relying on a bunch of admins to convince management that they need your tool -- they're likely to use "good enough" Open Source alternatives. WRT #3, You might consider a model where some basic features are free, but customers pay for enterprise-y features along with support. It's a lot easier to get your product in the door if the users can try it out without going through the hassle of convincing management to dole out $5K. So, those were my somewhat random thoughts. I'm considering an enterprise software start-up (non-competing) that may have similar sales characteristics.