John Hagel is the author of Out of the Box: Strategies for Achieving Profits Today and Growth Tomorrow through Web services. Based on interviews with 60 companies, Hagel argues that edge-of-enterprise line-of-business managers, who are under intense pressure to reduce cost, see Web services as an easy way to integrate with business partners. Hagel recently told CIO how Web services, which he defines as any XML-intensive application, are establishing a foothold in large companies.


CIO: Do business managers have the technical know-how to create a Web service and access the databases that are needed for meaningful collaboration?
Hagel:In general, I think this is a major issue because for the business manger the Web service is a totally random and ad hoc event. A business manager confronted with a particular problem has somehow heard about Web services and is looking for ways to implement it and make sure that it is actually appropriate for them. And typically they find a lot of ambivalence from the IT department within their own enterprise.

Often the IT department is skeptical about the technology because it is so new. They are particularly worried about implementation at the edge of the enterprise across the firewall and so they tend to be ambivalent and at worst actually resist attempts to implement Web services. So in many cases these executives are searching around and they find a small specialty firm that has some expertise in Web services and they bring that company in. Basically they are launching what I would describe as a skunkworks initiative where they get sympathetic people in the IT department who are beneath the radar screen to help them drive the implementation. But, in large part, they try to keep a low profile since it is relatively controversial. That is one of the reasons that we don?t hear about these initiatives?the executives who are driving them aren?t looking for publicity. They fear if they get too much attention they will get shut down.


Well, for example, I talked to an IT source at GM who said that he didn?t know of any Web services projects that were going on.
And that is one of the reasons that we have a lot of misconceptions around the early adoption of Web services. First, there is a conception that there is not a lot of activity; second, that the activity that does exist is largely experiments and prototypes, and, third, that it is very focused within the enterprise and the firewall. I think on all three levels that is quite contrary to the evidence I have seen. But when people try to find out about the early adoption of Web services, their first call, quite naturally, is to the IT department. And the IT department, quite naturally, is going to talk about what they are doing, which is not a lot. In many cases they are genuinely just unaware of the activity that is going on in other parts of the company.


This speaks to another argument of yours, that CIOs are often the greatest impediment to the adoption of a new technology.
I want to be clear that it is not all CIOs. Some have emerged as champions of new technology. But I think that there is a very natural tendency to want to resist. Part of it has to do with very legitimate concerns about the early stage of the technology. It is still evolving; there are lots of issues that could create problems down the line. So there is risk here. I think in evaluating risk, you have to look at the incentive structure that CIOs operate under. Again this is a gross generalization, but most CIOs aren?t going to have rewards for major new business initiatives that drive value to the company. But they have a high and increasing risk of being fired if projects fail. As we all know, the tenure of the average CIO is shrinking over time, they are being fired with alarming frequency, and, typically, when they get fired it is because something goes wrong. In that environment it is natural to say that there is not a lot of upside here, so my primary focus [as a CIO] is to make sure things don?t go bad. And the best way to do that is to stick with what I already have as opposed to trying to implement something new that itself could blow up or blow up something else.


Isn?t that an antiquated view of the CIO role? A lot of CIOs have business backgrounds and view themselves as business leaders. Shouldn?t that motivate them to want to help the business?
I think that certainly helps to mitigate the incentive structure. I do think there is a rather perverse incentive structure that has emerged over time and I don?t think it is a conscious thing?most CEOs would be horrified if you laid it out in those black-and-white terms. But I do think it creates conservatism on the part of the CIO. I think a related piece is that CIOs in many cases were primary drivers of ERP and investments in websites, and as a part of the general backlash against that kind of spending, there is a growing skepticism about whether IT will be able to deliver value. The CIO particularly is suspect if he goes into an executive meeting and starts aggressively promoting a new technology. I think a lot of line executives are saying, ?Wait a minute, I?ve heard this pitch before and I am still looking for the return.? So that makes CIOs reluctant.


CIOs argue that Web services standards, especially security, are either immature or simply don?t exist. Isn?t this a strong argument for caution when it comes to deploying Web services?
I think these concerns are completely legitimate. There is a very important role for the CIO to focus on issues and aggressively and creatively resolve these issues. I think at the end of the day this is about trade-offs. As most business ultimately is, it is a trade-off between risk and return. If I can get significant near-term business benefit, I may be willing to take on a higher level of risk than if the return is speculative or long term. And I think that is the trade-off that line managers are making, partly from ignorance.


Did the line-of-business managers you talked to have concerns regarding security or scalability, or the impact of their project on the overall IT architecture?
They certainly don?t understand it at the level a CIO or technically trained people would. With few exceptions, the line executives that I have talked to who are driving these implementations have certainly been confronted with very articulate arguments on the limitations of Web services.


Who confronts them?
Their IT department in many cases. The IT person lays out the risk. And I think the business executives are making a judgment. One could question whether it is ultimately as informed as it could be, but it is certainly not done in total ignorance. They are aware that they are taking risks and I would say, in general, the execs I talked to feel very exposed. They are painfully aware that they are at the bleeding edge and that they don?t have a lot of support and that there are some real issues with the technology. But they also see that they have a real opportunity to deliver some substantial business benefit.


You say that the CIO role has evolved to where CIOs are encouraged not to take risks. Would you say the exact opposite of business managers?
That is the paradox here. The people who ought to be driving IT are being penalized and yet the line executives who are under growing economic pressure are recognizing that their job is on the line if they don?t take these risks.


So CIOs want to use Web services on the least important projects first and business managers want to do it with the most important.
Exactly. One of the issues I have with how the early adoption is proceeding is that it is not with an eye to what?s most important to the enterprise. It is an ad hoc process, where an executive somewhere has latched onto Web services. It is totally random as to whether this is the highest impact area because no one has taken a systematic view as to where this technology could help the most. I think there is a real need both from a technology standpoint and a business standpoint to take a much more systematic approach. CIOs need to think about this from a technology standpoint and ask where will Web services impact the architecture, and from a business viewpoint to find where the highest impact on the business is.


What should CIOs do?
The first thing they ought to do is identify where there are Web services initiatives around the enterprise. I suspect most CIOs would be surprised with the degree of activity. Then it is just a process of engaging and figuring out what you can do to manage the projects. In parallel, I think there is a chance for the CIO to emerge as a champion. The challenge here is not to halt the projects that are underway. I suppose in some cases that may be necessary, but in others you need to support them. Secondly and equally, if not more important, CIOs need to work with their business counterparts to understand where the highest impact areas are across the company and approach it in a systematic way. There is a huge opportunity here for the CIO to become a business leader. This technology has a very compelling business proposition and there is a huge opportunity to educate the business line executives and to help the organization move more aggressively.