Callidus makes sales performance management (SPM) software, which allows companies to track how much their salespeople are dropping to the bottom line and to pay them accordingly (if they are, for instance, working on commission-based salaries). The company has $105 million in revenue.

Despite Stretch's vested interest in a bullish SaaS market, there's plenty of evidence to support his contention. A recent report by Kelton Research found that 73 percent of large companies had adopted or planned to adopt SaaS in the next 18 months.

CIO talked with Stretch about his outlook on CIOs embracing SaaS and why anxieties regarding security and compliance have begun to melt away.

CIO: Didn't your company used to be only on-premise software? When and why did you change to SaaS?

Stretch: We initially delivered our solution only on premise, on a traditional license model. But then, all around us, the whole SaaS movement had begun. Our clients were saying they needed to get to the solution [software] faster. They said, 'We need to worry less about the infrastructure stack and the hardware.' So we basically just followed a lot of the [SaaS] companies that had gone down this road and transitioned the business about two years ago. We have 45-46 customers now [who use SaaS}. It's now contributing profitable revenue to our business. [SaaS] made 23 point of margin in Q1 and we're expecting 50 pts in Q 2.

CIO:Some say CIOs and IT departments have been reluctant to go with SaaS because of security concerns and compliance standards. How have vendors like Callidus gone about alleviating these worries?

Stretch We've been addressing those concerns. For example, there is a stream of consciousness in our business around Sarbanes Oxley. We have customers who have commission budgets of $2 billion and up. A miss in the commission budget can be a miss in the earnings budget. So that's very serious. We will enter contractually binding agreements with [our customers] so they know their data is protected. Some companies will require that their data will be stored in its own physical space and make sure its not mingling with the data of other companies. If they mandate these [security requirements], then that's what we deliver.