In addition, using the hosted services has "dramatically" reduced Henssler's e-mail archiving costs while making it easier for employees to search for and retrieve old messages, O'Pry said.

Moving e-mail to a cloud infrastructure such as Google's can also help organizations lower the costs of complying with e-discovery rules in legal cases, said David Jordan, chief information security officer for Virginia's Arlington County.

For instance, Google earlier this year launched a Postini service called Message Discovery that is designed to help businesses comply with e-mail retention regulations and speed up the process of retrieving messages in response to lawsuits or other legal matters. Such setups can also help customers trim their e-mail hardware, software, management and security costs, Jordan said.

Another possible cost-saving option, he noted, is deploying virtualization and thin-client technologies that let employees access a set of centralized applications. Jordan said he thinks that thin-client architectures are inherently more secure—and thus less costly to manage and control—than traditional client/server computing models.

Any cutbacks should be carefully weighed, though.

Phil Hochmuth, an analyst at Yankee Group Research Inc., said it's understandable that companies might want to rein in their security spending (see related story, at left). But on a longer-term basis, "it would probably be a mistake if they backed off strategic initiatives" just to cut costs now, Hochmuth said.

O'Pry agreed. "Trying to scrimp and save on security in this economy would be a penny-wise, pound-foolish thing to do," he said. O'Pry noted that as a financial services firm, Henssler is "affected more than anyone else" by the downturn. Even so, there's little talk within the company about cutting security spending. "Your most valuable nontangible asset is your reputation," O'Pry said. "You can't risk taking any hits to that."

—Jaikumar Vijayan