From the reports I would be surprised if non-hosted ERP stuff was ever easily targeted. Hosted stuff is a bit of a different story. ideally if you are paranoi

From the reports I would be surprised if non-hosted ERP stuff was ever easily targeted. Hosted stuff is a bit of a different story. ideally if you are paranoid, you should run things in-house and firewalled. If you are less so, I will point out I help run a British-registered hosting company for an open source ERP (the company can be found at http://www.efficito.com http://www.efficito.com). Everyone wants to talk about how the cloud will change ERP and while I am involved in a startup that is operating in this space, I have to say that it is extremely important for users to know that they give up a lot of control over security when they make that choice. We do our best but we cannot compare to a well-run internal installation.