The Total Economic Impact Of Mimecast s Unified Management (UEM) Solution

Transcription

1 A Forrester Total Economic Impact Study Prepared For Mimecast The Total Economic Impact Of Mimecast s Unified Management (UEM) Solution Mimecast s UEM Services Reduce The Complexity And The Costs Of Managing Project Director: Sebastian Selhorst April 2013

2 TABLE OF CONTENTS Executive Summary... 2 Mimecast s UEM Services Reduce The Complexity And The Costs Of Managing Factors Affecting Benefits And Costs... 5 Disclosures... 5 TEI Framework And Methodology... 6 Analysis... 7 Interview Highlights... 7 Costs... 9 Benefits Flexibility Risk Financial Summary Mimecast Unified Management Solution: Overview Appendix A: Composite Organization Description Appendix B: Total Economic Impact Overview Appendix C: Glossary Appendix D: Supplemental Material Appendix E: Endnotes , Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to About Forrester Consulting Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with researchanalysts who apply expert insight to your specific business challenges. For more information, visit Page 1

3 Executive Summary For many organizations, s role is business- or mission-critical, but spiraling costs caused by requirements are leading these organizations to re-evaluate their architectures. A variety of external business and technical pressures are triggering a ripple effect in the costs associated with backup, archiving, ediscovery, security, high availability, and disaster recovery (DR) capabilities. One of the options organizations might look at to alleviate management is peeling off support services like message filtering, archiving, and continuity and using a hosted service provider while keeping the rest of the infrastructure on-premises. In February 2013, Mimecast commissioned Forrester Consulting to examine the total economic impact and potential return on investment (ROI) global enterprises may realize by using Mimecast s Unified Management (UEM) solution. The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of the full Mimecast UEM service on their organizations. Mimecast UEM is a suite of security, archiving, and continuity services, which can also be purchased separately if required. Mimecast delivers a software-as-a-service (SaaS)-based enterprise management solution that complements the client s existing on-premises infrastructure. It provides services including antispam, antimalware, archiving, ediscovery, continuity, and policy management. For a more detailed overview of Mimecast s UEM services, please refer to page 20. Mimecast s UEM Services Reduce The Complexity And The Costs Of Managing Our interviews with seven existing Mimecast customers and subsequent financial analysis found that a composite organization based on the companies we interviewed experienced the risk-adjusted ROI, costs, and benefits shown in Table 1. See Appendix A for a description of the composite organization. Table 1 Composite Organization Three-Year Risk-Adjusted ROI 1 ROI Payback period Total benefits (PV) Total costs (PV) Net present value 102% Within 12 months $697,321 ($344,691) $352,630 Benefits. The organization used in this analysis is a composite based on multiple interviews that Forrester conducted to delve more deeply into the operational impact of Mimecast s UEM solution. The composite organization represents a large business services company with 2,500 users. The firm was running a centralized, on-premises infrastructure What I really like about Mimecast UEM services is that one vendor is providing all of the valueadded solutions that we need: always-on security, archiving, and ediscovery capabilities. (Group IT director, international construction company) based on Microsoft Exchange and wanted to improve its capabilities with regard to archiving, security, and continuity. The company decided to invest in Mimecast s UEM solution and realized the following benefits, which are representative of those experienced by the interviewed companies (see Figure 1): Page 2

4 Figure 1 Three-Year Risk-Adjusted Benefits 5% 4% 20% Legacy security solution cost savings Productivity gains due to increased security 31% Replication cost avoidance 11% Business continuity Archiving cost avoidance 29% ediscovery productivity gains security The composite organization realized two benefits related to security: o o Cost savings with regard to legacy security solutions. Organizations often already have an security solution providing antispam and antimalware in place that is then made redundant by the newly introduced Mimecast services. The composite organization was able to decommission a cloud filtering service, resulting in cost savings with an estimated three-year risk-adjusted present value (PV) of $30,000. Productivity gains. The majority of the interviewed organizations reported a reduction of spam and security-related issues following the introduction of Mimecast s services. This results in time savings for the IT staff and the end users. For the composite organization, these productivity gains have an estimated three-year risk-adjusted PV of $137,000. continuity The composite organization realized two benefits related to continuity: o o Replication cost avoidance. The composite organization avoided building and operating a DR or highavailability solution for . This benefit has an estimated three-year risk-adjusted PV of $79,000 for the composite organization. Business continuity. While the impact of downtime is highly variable by company, in this analysis we conservatively estimate the impact of continuity on end users productivity. During unplanned downtime of the on-premises infrastructure, for example, end users can still send and receive s through the Mimecast services. To estimate the gain in productivity, we conservatively assume Page 3

5 that affected employees are 20% less productive during an outage. In our case, these productivity gains have an estimated three-year risk-adjusted PV of $202,000. archiving The composite organization realized two benefits related to archiving: o o Archiving cost savings. The composite organization moves its existing on-premises archive into the Mimecast environment and thus frees up storage space. Furthermore, it avoids investing in additional storage capacity in subsequent years. In this case, these cost savings have an estimated threeyear risk-adjusted PV of $215,000. ediscovery productivity gains. Due to policy-based data retention of all inbound and outbound , a case management facility, granular litigation hold, and improved search capabilities, the IT staff spends less time responding to ediscovery requests. These productivity gains have an estimated three-year riskadjusted PV of $33,000 for the composite organization. Costs. To achieve the above benefits, the composite organization invested approximately $345,000 over a three-year period. Costs include: o o Mimecast UEM SaaS and support fees. The company introduced the UEM service for all 2,500 users and chose the priority support option for full 24x7 coverage. These fees have a three-year risk-adjusted PV of approximately $320,000. Setup costs. The setup costs include the Mimecast implementation and data ingestion costs, as well as the internal labor costs related to solution deployment, change management, and preparing historical data to be migrated into the Mimecast archive. These costs have a three-year risk-adjusted PV of approximately $25,000 in this case. Page 4

6 Factors Affecting Benefits And Costs Table 1 illustrates the risk-adjusted financial results that the composite organization achieved. The risk-adjusted values take into account any potential uncertainty or variance that exists in estimating the costs and benefits, which produces more conservative estimates. The following factors may affect the financial results that an organization may experience: Size of the organization. The size and geographical footprint of an organization and the number of users define how Mimecast services can be leveraged and how much infrastructure cost savings and employee productivity can be achieved. Industry. Each organization is unique due to its size, industry, and long-term business objectives. is more important to some organizations than to others. Different organizations also have to adhere to different regulations, implement different retention policies, and have different exposures to security threats. All of these factors influence the benefits that an organization can achieve from Mimecast services. Legacy environment. Organizations have invested in legacy systems, related products and services, and integrations with other business applications. The type of technical platform and the complexity of the environment affect the costs that a company incurs and the benefits it can achieved with Mimecast services. Disclosures The reader should be aware of the following: The study is commissioned by Mimecast and delivered by the Forrester Consulting group. Forrester makes no assumptions as to the potential return on investment that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the report to determine the appropriateness of an investment in Mimecast s UEM solution. Mimecast reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester s findings or obscure the meaning of the study. The customer names for the interviews were provided by Mimecast. Page 5

7 TEI Framework And Methodology Introduction From the information provided in the interviews, Forrester has constructed a Total Economic Impact framework for those organizations considering using Mimecast s UEM solution. The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Approach And Methodology Forrester took a multistep approach to evaluate the impact that Mimecast s UEM solution can have on an organization (see Figure 2). Specifically, we: Interviewed Mimecast marketing and sales personnel and Forrester analysts to gather data relative to Mimecast s UEM solution and the marketplace for services. Interviewed a total of seven organizations using Mimecast s services to obtain data with respect to costs, benefits, and risks. Five customers were interviewed for the original case study, and two others were interviewed at the beginning of 2013 to augment the analysis and refresh the case study. Designed a composite organization based on characteristics of the interviewed organizations (see Appendix A). Constructed a financial model representative of the interviews using the TEI methodology. The financial model is populated with the cost and benefit data obtained from the interviews as applied to the composite organization. Figure 2 TEI Approach Perform due diligence Conduct customer interviews Design composite organization Construct financial model using TEI framework Write case study Given the increasing sophistication that enterprises have regarding ROI analyses related to IT investments, Forrester s TEI methodology serves the purpose of providing a complete picture of the total economic impact of purchase decisions. Please see Appendix B for additional information on the TEI methodology. Page 6

8 Analysis Interview Highlights A total of seven Mimecast customers were interviewed for this study. The five initial customer interviews that were conducted for the original case study are now complemented by two additional customer interviews conducted at the beginning of We interviewed: An international construction services company based in the UK. The company employs about 2,500 people in more than 40 locations. It used to provide only limited and inconsistent services to end users in the different locations. For example, just six locations benefited from continuity, and the archive only covered the two main sites. Furthermore, the company experienced more and more storage capacity issues. It decided to invest in Mimecast s UEM services in order to provide better services to the business, especially in terms of continuity and archiving. A US-based law firm with about 750 users across six offices. The firm reported that it wasn t satisfied with its existing filtering service, which did not do a good job of detecting true spam and spearphishing attempts. The relatively small IT security team had to spend an increasing amount of time and effort on these issues. Moreover, if the primary infrastructure went down, the continuity solution had to be turned on manually and users had to be notified to log into the other system. The company decided to invest in Mimecast s security and continuity services to free up time for the IT staff and to provide a truly always-on service. A facilities management company with 50,000 employees, including 5,000 users, based in the UK. This organization originally used a managed service provider to host its cluster and related systems, such as antispam and antivirus. It felt that it was spending too much time and effort fine-tuning the environment and dealing with spam issues on a daily basis. It also had no real archiving or DR solution for its service and was looking for the most cost-efficient way to implement these services. A US-based public-sector healthcare organization with 6,000 users. This organization was running the main infrastructure in-house. It was unhappy with the performance of its third-party filtering appliance and was looking for alternatives that would be more efficient and take less time to administer and maintain. In addition, it wanted to improve its archiving capabilities and ensure continuity of the service. An independent insurance company based in the US with 650 users in 25 locations. This company has a highly decentralized approach to IT operations; each division runs its own infrastructure. It used an external service provider for filtering. The archiving was done manually by using native Exchange journaling and creating DVDs. Its main objectives for the new investment were to ensure the integrity of archived s, speed up the retrieval of archived s, and minimize the hardware and labor costs associated with management. A large construction company based in South Africa with 4,500 users. Due to mergers and acquisitions, this organization found itself operating several data centers with systems from different vendors. One of its main challenges with regards to services was to restore data. As its IT department had to respond to frequent ediscovery requests, it was looking for a new solution that would save it time and effort. Page 7

9 A property management company based in South Africa with 450 users. This company is a spinoff of a larger group. The group IT department originally took care of all IT operations. After the spinoff, the company decided to bring all IT operations in-house or find other service providers. It wanted a robust service with absolute redundancy. Composite Organization Based on the interviews with the seven customers provided by Mimecast, Forrester constructed a TEI framework, a composite company, and an associated ROI analysis that illustrates which areas were financially affected. The composite organization that Forrester synthesized from these results represents a large business services company with 2,500 employees. The company is running a centralized, on-premises infrastructure based on Microsoft Exchange. The Exchange servers are clustered at company headquarters for high availability. Prior investing in Mimecast, there was no replication between sites for business continuity. In the event of a major site outage in either location, servers would need to be restored via tape. The company used another external service provider for filtering for viruses, spam, phishing attempts, and malware. The archiving infrastructure was run centrally at the headquarters, but many users also managed local PST files. The company decided to invest in Mimecast s UEM services in order to: Guarantee a true and complete archive and free up storage space. Improve its security capability. Ensure availability in the case of a major outage. See Appendix A for more details on the composite organization. Framework Assumptions Table 2 provides the model assumptions that Forrester used in this analysis. Page 8

10 Table 2 Model Assumptions Ref. Metric Calculation Value A1 Hours worked per day 8 A2 Average number of working days per year 220 A3 Average fully loaded annual salary rate $80,000 A4 Average fully loaded daily salary rate A3/A2 $360 A5 Average fully loaded hourly salary rate A3/A2/A1 $45 A6 Number of users 2,500 A7 Average size of existing archive per user (in GB) 2 A8 Number of GB of historical data to be imported A6*A7 5,000 A9 Average size of an (in KB) 150 A10 Average number of s (sent/received) per user per day 40 A11 Average number of s (sent/received) per user per year A10*A2 8,800 A12 Additional storage space required per year (in GB) A11*(A9/1,024²)*A6 (rounded) 3,100 The discount rate used in the PV and NPV calculations is 10% and the time horizon used for the financial modeling is three years. Organizations typically use discount rates between 8% and 16% based on their current environment. Readers are urged to consult with their respective company s finance department to determine the most appropriate discount rate to use within their own organizations. Costs This section describes and lists the costs for deploying and running the Mimecast UEM solution for the composite organization over a three-year period. Mimecast UEM Service And Support Costs The composite organization has a UEM enterprise agreement for its 2,500 users. The annual SaaS fee is paid in advance. In addition, the company chose Mimecast s 24x7 priority support. Service fees and support costs are indicated in rows B1 and B2, respectively, of Table 3. Please note that these service costs are only indicative and depend on the region from which the organization s account is provisioned, among other factors. Page 9

11 Professional Services Costs The initial professional service charges and the costs for importing existing archives into the new platform are indicated in row B3 of Table 3. The costs of importing legacy archives are based on the assumption that the composite organization had approximately 5 TB of s to be absorbed and that half of that volume is imported initially and the other half in Year 1, after the switch to the Mimecast service. Internal Labor Costs The interviewed organizations reported that setting up Mimecast s UEM services for their environments was relatively straightforward and only took a couple of days. The internal efforts required for planning, integration, configuration, project management, and basic administrator training have been estimated at 10 man-days for the composite organization. The efforts of aggregating all tape and local PST files and cleansing the data before delivering them to Mimecast account for another 20 man-days (10 initially and a further 10 in Year 1). Finally, 10 additional man-days have been taken into account in this analysis for dealing with the change management and the end user support during the first couple of months of the new service. The resulting labor costs are indicated in row B4 of Table 3 below. Total Costs Table 3 summarizes the incremental costs incurred by the composite organization for using Mimecast s UEM solution over a three-year period. In total, the composite organization spent approximately $410,000 over three years. Table 3 Total Costs (Non-Risk-Adjusted) Ref. Costs Assumptions Initial Year 1 Year 2 Year 3 Total B1 Mimecast SaaS fees 2,500 users $0 ($120,000) ($120,000) ($120,000) ($360,000) B2 Mimecast support costs 24x7 priority support $0 ($7,200) ($7,200) ($7,200) ($21,600) B3 Professional services costs ($6,800) ($3,800) $0 $0 ($10,600) Initial: 20 man-days B4 Internal labor costs Year 1: 20 man-days at $360 per day (see A4 in Table 2) ($7,200) ($7,200) $0 $0 ($14,400) Bt Total costs ($14,000) ($138,200) ($127,200) ($127,200) ($406,600) Page 10

12 Benefits The Mimecast customers who were interviewed for this study described a range of hard and soft benefits that they have accrued from their deployment of Mimecast s UEM solution. The most significant benefits described to Forrester were around avoiding infrastructure and operating costs, improving IT and end user productivity, as well as realizing IT cost savings due to the retirement of legacy solutions. These benefits can be grouped into the following categories. Security Due to the deployment of Mimecast s UEM solution, the composite organization realized cost savings with regard to its former filtering service and reduced the number of spam and security-related incidents, which resulted in productivity gains for both the IT staff and the end users. Legacy security solution cost savings. The composite organization originally used an external service provider for filtering. The service was priced at $5 per user per year. This service was simply decommissioned and resulted in the cost savings detailed in Table 4. Table 4 Legacy Security Solution Cost Savings Ref. Metric Value/calculation Year 1 Year 2 Year 3 Total C1 Price per user per year of decommissioned filtering service $5 C2 Number of users 2,500 Ct Legacy security solution cost savings C1*C2 $12,500 $12,500 $12,500 $37,500 Productivity gains due to increased security. The majority of the companies interviewed for this study reported a reduction in spam, security-related issues, and related help desk calls. This frees up time for both the IT help desk staff and end users. For the composite organization, we assume that about 10% of the end users had serious problems with spam and phishing attempts and that they spent about 20 minutes per week dealing with these issues. Furthermore, five help desk calls per day were related to spam and security. Due to the introduction of the Mimecast services, the composite organization saw the number of issues fall by 50%. The resulting time savings are indicated in Table 5 below. However, Forrester assumes that only a portion of the time gained from improved productivity will actually be realized by the organization. In this analysis, we assume that 75% of the time saved will actually be converted into productive output. Page 11

13 Table 5 Productivity Gains Due To Increased Security Ref. Metric Value/ calculation Year 1 Year 2 Year 3 Total D1 Percentage of users with serious spam or phishing issues 10% D2 Number of users with serious spam or phishing issues 250 (D1*2,500 users, see A6 in Table 2) D3 Minutes spent by end user per week on spam/phishing issues, filtering tool configurations before Mimecast 20 D4 Number of help desk calls (spam, phishing, and inquiries) per day before Mimecast 5 D5 Average duration of a related help desk call (in minutes) 15 D6 Reduction in number of issues 50% D7 D8 D9 Number of hours saved by end users per year Number of hours saved by IT staff per year Average fully loaded hourly salary 1,833 hours/year (D2*(D3/60)/5* A2*D6 138 hours/year (D4*A2*(D5/60) *D6) $45 (see A5 in Table 2) D10 Productivity gain 75% Dt Productivity gains due to increased security (D7+D8)*D9 *D10 $66,521 $66,521 $66,521 $199,564 Continuity By deploying Mimecast s services, the composite organization avoids replicating its infrastructure and ensures full continuity to its end users even during unplanned downtime of the primary infrastructure. Replication cost avoidance. The composite organization wanted to ensure full continuity of service for all employees; by deploying the Mimecast service, it did not have to replicate the primary on-premises infrastructure. The organization avoided costs ranging from hardware, software, and related maintenance costs to network upgrade costs, integration and migration costs, and ongoing operating costs. For the Page 12

14 composite organization, we assume that the avoided hardware costs consist mainly of two servers. The company did not have to buy replication software licenses and did not have to upgrade the network. Related hardware and software maintenance costs, integration, and operating costs were also avoided. The planning, integration, and migration efforts were estimated at 30 man-days and the annual operating costs to oneeighth of a full-time equivalent (FTE). Table 6 Replication Cost Avoidance Ref. Metric Value/calculation Year 1 Year 2 Year 3 Total E1 Estimated hardware costs avoided $20,000 E2 Estimated software costs avoided $10,000 E3 Estimated network costs avoided $5,000 $5,000 $5,000 E4 Maintenance costs avoided (E1*10%)+(E2*20%) $4,000 $4,000 $4,000 E5 Installation, planning, and deployment effort avoided (man-days) 30 E6 Operating effort avoided (in FTEs) E7 Installation,,planning, and deployment costs avoided E5*daily rate (see A4 in Table 2) $10,800 E8 Operating costs avoided E6*yearly rate (see A3 in Table 2) $10,000 $10,000 $10,000 Et Replication cost avoidance E1+E2+E3+E4+E7+E8 $59,800 $19,000 $19,000 $97,800 Business continuity. Each organization is unique due to its size, industry, long-term business objectives, and tolerance for system downtime. unavailability might have very different impacts on organizations, ranging from incident response services and decreased end user productivity to even lost revenue due to missed contractual deadlines. The impact and probability of revenue loss, however, varies significantly by industry and company. To create a more conservative and realistic business case, this analysis only tries to evaluate the avoided loss in end user productivity during unplanned downtime. Readers should, however, evaluate if, in their case, continuity has benefits beyond increased end user productivity gains. The composite organization has an system availability of 99.5% during extended working hours (12 hours per day, 220 working days per year), which results in approximately 13 hours of unplanned downtime per year. The productivity loss calculation is based on the percentage of users affected by the unplanned outages, the cost of their loaded salaries, and their reliance on for productivity. The calculation assumes that on average 33% of organization s users are affected by an outage and that users are 20% less productive during the unavailability of the service. Page 13

15 Table 7 Business Continuity Ref. Metric Value/calculation Year 1 Year 2 Year 3 Total F1 system availability 99.5% F2 Business hours per day 12 F3 Business days per year 220 F4 F5 F6 F7 F8 F9 Hours of unplanned downtime per year Total number of users Percentage of users affected by actual unplanned downtime Number of affected users Average fully loaded hourly salary Employee reliance on for productivity hours (F3*F2*(1-F1)) 2,500 (see A6 in Table 2) 33% 825 (F5*F6) $45 (see A5 in Table 2) 20% Ft Business continuity F4*F7*F8*F9 $98,010 $98,010 $98,010 $294,030 Archive By using Mimecast s archive, the composite organization saves and avoids investing in on-premises storage capacity and improves its ediscovery capability. Archiving cost avoidance. Following the deployment of the Mimecast solution, the composite organization moved its existing on-premises archive into the Mimecast environment. It not only freed up storage space that can be used by other business applications, but also avoided investing in additional capacity in subsequent years. In this analysis, we assume that the existing archive accounts for 5 TB and that each year the storage capacity requirements increase by 3.1 TB (see row A12 in Table 2). We further assume a fully loaded storage cost of $8 per GB per year. Page 14

16 Table 8 Archiving Cost Avoidance Ref. Metric Value/calculation Year 1 Year 2 Year 3 Total G1 G2 G3 G4 G5 G6 Total amount of storage freed up (in GB) Fully loaded annual costs of storage per GB Cost avoidance related to existing archiving storage Additional storage space required per year (in GB) Additional storage space avoided (in GB) Cost avoidance with regard to annual storage growth 5,000 (see A8 in Table 2) $8 G1*G2 $40,000 $40,000 $40,000 3,100 (see A12 in Table 2) 3,100 GB 6,200 GB 9,300 GB G5*G2 $24,800 $49,600 $74,400 Gt Archiving cost avoidance G3+G6 $64,800 $89,600 $114,400 $268,800 ediscovery productivity gains. This benefit includes time savings for the composite organization s IT staff involved in recovering s and associated attachments in response to an ediscovery request. 2 The Mimecast UEM solution enabled the composite organization to conduct faster, more comprehensive, and better documented ediscovery. The solution s fast search, centralized architecture, and complete archiving enabled IT staff to rapidly access, search, and document communications. For the composite organization, we assume an average of five ediscovery requests per month and that the IT staff saves 8 hours per request. However, Forrester assumes that only a portion of the time gained from improved productivity will actually be realized by the organization. In this analysis, we assume that 75% of the time saved will actually be converted into productive output. Table 9 ediscovery Productivity Gains Ref. Metric Value/ calculation Year 1 Year 2 Year 3 Total H1 Number of ediscovery requests per month 5 H2 Number of hours saved for IT per ediscovery request 8 Page 15

17 Ref. Metric Value/ calculation Year 1 Year 2 Year 3 Total H3 Hours saved per year 480 (H1*H2*12) H4 Average fully loaded hourly salary $45 (see A5 in Table 2) H5 Productivity gain (%) 75% Ht ediscovery productivity gains H3*H4*H5 $16,200 $16,200 $16,200 $48,600 Total Benefits Table 10 shows the total benefits for the composite organization that were quantifiable for this study. Table 10 Total Benefits (Non-Risk-Adjusted) Ref. Metric Year 1 Year 2 Year 3 Total PV Ct Dt Legacy security solution cost savings Productivity gains due to increased security $12,500 $12,500 $12,500 $37,500 $31,086 $66,521 $66,521 $66,521 $199,564 $165,429 Et Replication cost avoidance $59,800 $19,000 $19,000 $97,800 $84,341 Ft Business continuity $98,010 $98,010 $98,010 $294,030 $243,736 Gt Archiving cost avoidance $64,800 $89,600 $114,400 $268,800 $218,909 Ht ediscovery productivity gains $16,200 $16,200 $16,200 $48,600 $40,287 It Total benefits $317,831 $301,831 $326,631 $946,294 $783,788 Flexibility Flexibility, as defined by TEI, represents an investment in additional capacity or capability that could be turned into business benefit for some future additional investment. This provides an organization with the right or the ability to engage in future initiatives but not the obligation to do so. There are multiple scenarios in which a customer might choose to use Mimecast s UEM solution and later realize additional uses and business opportunities. Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix B). Page 16

18 While Forrester believes organizations can take advantage of these flexibility options, quantification (using the financial industry standard Black-Scholes or the binomial option pricing models) of the additional value associated with these options for the composite organization would require scenario development and forward-looking analysis, which is not available at this time. Risk Forrester defines two types of risk associated with this analysis: implementation risk and impact risk. Implementation risk is the risk that a proposed investment in Mimecast s UEM solution may deviate from the original or expected requirements, resulting in higher costs than anticipated. Impact risk refers to the risk that the business or technology needs of the organization may not be met by the investment in UEM, resulting in lower overall total benefits. The greater the uncertainty, the wider the potential range of outcomes for cost and benefit estimates. Quantitatively capturing implementation and impact risk by directly adjusting the financial estimates, results in more meaningful and accurate estimates and a more accurate projection of the ROI. In general, risks affect costs by raising the original estimates, and they affect benefits by reducing the original estimates. The risk-adjusted numbers should be taken as realistic expectations since they represent the expected values considering risk. The following implementation risks that affect costs have been identified as part of this analysis: The annual SaaS and support fees vary by geography. The professional services fees depend on the amount of data to be ingested into the Mimecast archive. The amount of internal efforts required to deploy the solution and prepare the historical data for ingestion into the Mimecast archive depends on the complexity of the existing and archiving environment and might be higher than originally estimated. The following impact risks that affect benefits have been identified as part of the analysis: The cost savings with regard to decommissioning legacy solutions depend on the overlap created with the Mimecast services. End user and IT staff productivity gains depend on the ability of the concerned staff to reallocate their time productively. The costs avoided with regard to building an continuity environment and managing an archive depend on the complexity of the existing primary infrastructure, the storage capacity requirements, and the retention policy. The costs avoided might be lower than originally estimated. Table 11 shows the values used to adjust for risk and uncertainty in the cost and benefit estimates. The TEI model uses a triangular distribution method to calculate risk-adjusted values. To construct the distribution, it is necessary to first estimate the low, most likely, and high values that could occur within the current environment. The riskadjusted value is the mean of the distribution of those points. Readers are urged to apply their own risk ranges based on their own degree of confidence in the cost and benefit estimates. Page 17

19 Table 11 Cost And Benefit Risk Adjustments Costs Low Most likely High Mean Mimecast SaaS fees 98% 100% 105% 101% Mimecast support costs 98% 100% 105% 101% Professional services costs 100% 100% 115% 105% Internal labor costs 100% 100% 115% 105% Benefits Low Most likely High Mean Legacy security solution cost savings 90% 100% 105% 98% Productivity gains due to increased security 50% 100% 100% 83% Replication cost avoidance 80% 100% 103% 94% Business continuity 50% 100% 100% 83% Archiving cost avoidance 90% 100% 105% 98% ediscovery productivity gains 50% 100% 100% 83% Page 18

20 Financial Summary The financial results calculated in the Costs and Benefits sections can be used to determine the ROI, NPV, and payback period for the organization s investment in Mimecast s UEM solution. These are shown in Table 12 below. Table 12 Cash Flow: Non-Risk-Adjusted Cash flow: original estimates Initial Year 1 Year 2 Year 3 Total PV Costs ($14,000) ($138,200) ($127,200) ($127,200) ($406,600) ($340,328) Benefits $0 $317,831 $301,831 $326,631 $946,294 $783,788 Total ($14,000) $179,631 $174,631 $199,431 $539,694 $443,460 ROI 130% Payback period Within 12 months Table 13 below shows the risk-adjusted ROI, NPV, and payback period values. These values are determined by applying the risk-adjustment values from Table 11 in the Risk section to the cost and benefits numbers in Tables 3 and 10. Table 13 Cash Flow: Risk-Adjusted Cash flow: risk-adjusted estimates Initial Year 1 Year 2 Year 3 Total PV Costs ($14,700) ($140,022) ($128,472) ($128,472) ($411,666) ($344,691) Benefits $0 $281,973 $267,925 $292,229 $842,127 $697,321 Total ($14,700) $141,951 $139,453 $163,757 $430,461 $352,630 ROI 102% Payback period Within 12 months Page 19

21 Mimecast Unified Management Solution: Overview Mimecast delivers SaaS-based enterprise management, including security, archiving, ediscovery, continuity, encryption, data leak prevention, and policy management. By unifying disparate and fragmented management applications into one holistic service that is always available from the cloud, Mimecast claims to minimize risk and reduce cost and complexity while providing total end-to-end control of . According to Mimecast, its solution seamlessly integrates with a company s existing Microsoft Exchange, Domino, and GroupWise servers to deliver archiving, continuity, security, and policy management. Employees continue to work within Outlook or via webmail. A customers on-premises server supplies the mailboxes, and Mimecast replaces the software and hardware running archiving, continuity, security, policy management, branding, and disclaimers. The Mimecast solution eliminates the growing risks and complexities of management to support emerging security, compliance, regulatory, and ediscovery requirements. All aspects of are centrally controlled and completely configurable with this cloud-based platform, freeing up resources and allowing clients to focus on strategic activities. Mimecast s service stores messages and data according to corporate-defined retention and destruction policies; the robust grid technology produces search results in seconds even as the archive grows over time, and it is priced as a fixed cost per user. End users are able to search their personal archives directly within Outlook, effectively giving them a bottomless inbox. Furthermore, should a customer s Exchange server fail, Mimecast temporarily emulates Exchange, enabling Outlook users to remain online seamlessly during the recovery process. This avoids the cost and complexity of failover and failback DR models. Metadata archiving ensures that ediscovery searches produce comprehensive audit trails for compliance and litigation requirements. Organizations with legacy archive files such as PSTs can import data into their Mimecast archive. Additionally, Mimecast offers a secure, dynamically scalable, cloud-based file archive. It is a centralized, compliant archive for all corporate files, stored alongside . The solution eliminates the need to support separate systems for file and archiving. The solution is meant to reduce complexity, mitigate risk, improve productivity and help address regulatory and compliance needs. Page 20

22 Appendix A: Composite Organization Description For this case study, Forrester has created a composite organization to illustrate the quantifiable costs and benefits of using Mimecast s Unified Management (UEM) services. Forrester s conclusions were derived in large part from information received in a series of in-depth interviews with executives and personnel at seven organizations using Mimecast s services. As each of the interviewed organizations was promised anonymity, Forrester constructed a composite company, a TEI framework, and an associated ROI analysis based on our findings from these Mimecast customers. The composite organization in this study represents a large business services firm. The company has 10 offices across the country, annual revenues of $500 million, and employs 2,500 people. is a critical business tool for this company; contracts, proposals, and other important documents are exchanged via internally and externally. There is an increased need for accountability for all sent and received. The company is running a central, on-premises infrastructure based on Microsoft Exchange. The Exchange servers are clustered for high availability. Prior to the investment in Mimecast, there was no replication between the sites for business continuity. In the event of a major site outage, the servers would need to be restored via tape. All sites used an external service provider for filtering for viruses, spam, phishing attempts, and malware. The archiving infrastructure had run centrally at the headquarters but many users also managed local PST files. The initial reasons why the company was looking for a new solution were to: Guarantee a true and complete archive. Improve its filtering capability. Ensure availability in the case of a major outage. The company evaluated three alternative scenarios: Continue to manage all of its infrastructure on-premises. This included building replication into its architecture for site resiliency as well as refreshing the archiving platform. The cost of adding all of the new hardware and software as well as the headcount made this prohibitive. Outsource its entire service to a provider. This scenario was not feasible; many of its applications required integration with on-premises as well as other collaboration tools. Employ a hybrid solution. In this scenario, the company keeps its mailbox servers on site to maintain their integration with other business applications and tools in their environment while taking advantage of a hosted service to handle the expensive supporting services like filtering, archiving, and continuity. The flexibility and cost savings associated with this last option drove the company to invest in Mimecast. The Mimecast deployment was split into two phases. The first phase was connecting to Mimecast for security, continuity, and archiving services, which took two weeks. The second phase of importing the company s historical data took six months, as the business had to aggregate all tape and PST files, cleanse them, and provide them to Mimecast. Page 21

23 Appendix B: Total Economic Impact Overview Total Economic Impact is a methodology developed by Forrester Research that enhances a company s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders. The TEI methodology consists of four components to evaluate investment value: benefits, costs, risks, and flexibility. Benefits Benefits represent the value delivered to the user organization IT and/or business units by the proposed product or project. Often product or project justification exercises focus just on IT cost and cost reduction, leaving little room to analyze the effect of the technology on the entire organization. The TEI methodology and the resulting financial model place equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization. Calculation of benefit estimates involves a clear dialogue with the user organization to understand the specific value that is created. In addition, Forrester also requires that there be a clear line of accountability established between the measurement and justification of benefit estimates after the project has been completed. This ensures that benefit estimates tie back directly to the bottom line. Costs Costs represent the investment necessary to capture the value, or benefits, of the proposed project. IT or the business units may incur costs in the form of fully burdened labor, subcontractors, or materials. Costs consider all the investments and expenses necessary to deliver the proposed value. In addition, the cost category within TEI captures any incremental costs over the existing environment for ongoing costs associated with the solution. All costs must be tied to the benefits that are created. Risk Risk measures the uncertainty of benefit and cost estimates contained within the investment. Uncertainty is measured in two ways: 1) the likelihood that the cost and benefit estimates will meet the original projections, and 2) the likelihood that the estimates will be measured and tracked over time. TEI applies a probability density function known as triangular distribution to the values entered. At minimum, three values are calculated to estimate the underlying range around each cost and benefit. Flexibility Within the TEI methodology, direct benefits represent one part of the investment value. While direct benefits can typically be the primary way to justify a project, Forrester believes that organizations should be able to measure the strategic value of an investment. Flexibility represents the value that can be obtained for some future additional investment building on top of the initial investment already made. For instance, an investment in an enterprisewide upgrade of an office productivity suite can potentially increase standardization (to increase efficiency) and reduce licensing costs. However, an embedded collaboration feature may translate to greater worker productivity if activated. The collaboration can only be used with additional investment in training at some future point in time. However, having the ability to capture that benefit has a present value that can be estimated. The flexibility component of TEI captures that value. Page 22

24 Appendix C: Glossary Discount rate: The interest rate used in cash flow analysis to take into account the time value of money. Although the Federal Reserve Bank sets a discount rate, companies often set a discount rate based on their business and investment environment. Forrester assumes a yearly discount rate of 10% for this analysis. Organizations typically use discount rates between 8% and 16% based on their current environment. Readers are urged to consult their respective organization to determine the most appropriate discount rate to use in their own environment. Net present value (NPV): The present or current value of (discounted) future net cash flows given an interest rate (the discount rate). A positive project NPV normally indicates that the investment should be made, unless other projects have higher NPVs. Present value (PV): The present or current value of (discounted) cost and benefit estimates given at an interest rate (the discount rate). The PV of costs and benefits feed into the total net present value of cash flows. Payback period: The breakeven point for an investment is the point in time at which net benefits (benefits minus costs) equal initial investment or cost. Return on investment (ROI): A measure of a project s expected return in percentage terms. ROI is calculated by dividing net benefits (benefits minus costs) by costs. A Note On Cash Flow Tables The following is a note on the cash flow tables used in this study (see the example table below). The initial investment column contains costs incurred at time 0 or at the beginning of Year 1. Those costs are not discounted. All other cash flows in Years 1 through 3 are discounted using the discount rate (shown in Framework Assumptions section) at the end of the year. Present value (PV) calculations are calculated for each total cost and benefit estimate. Net present value (NPV) calculations are not calculated until the summary tables and are the sum of the initial investment and the discounted cash flows in each year. Table [Example] Example Table Ref. Category Calculation Initial cost Year 1 Year 2 Year 3 Total Appendix D: Supplemental Material Related Forrester Research Market Overview: Message Archiving Software-As-A-Service, Q3 2011, Forrester Research, Inc., October 4, Q&A: ediscovery Fundamentals For Content & Collaboration Professionals, Forrester Research, Inc., December 15, Page 23

25 Q&A: Message Archiving Fundamentals For Content & Collaboration Pros, Forrester Research, Inc., September 7, Should Your Live In The Cloud? An Infrastructure And Operations Analysis, Forrester Research, Inc., January 5, Appendix E: Endnotes 1 Forrester risk-adjusts the summary financial metrics to take into account the potential uncertainty of the cost and benefit estimates. For more information on Risk, please see page ediscovery requests often occur at the beginning of litigation. To create a credible business case, the analysis in this study only considers the productivity gains for the IT staff in preparing for such a case. The nature of litigation means that the financial risk or benefit at stake for a given company can range from a few hundred to several million dollars. The variability and uncertainty associated with this benefit category prevent us from including it in this ROI quantification. However, being able to present all receipts in a timely manner, being confident about the completeness of evidence document, and gaining more time for the analysis of evidence certainly has a positive impact on the risk inherent to each individual case. Companies are encouraged to determine how far this applies to them. Page 24