While some large enterprises have moved their information-technology infrastructure to a third-party managed service to save costs, small firms\u2014especially startups\u2014have come to rely on cloud services to cut initial outlays and help them focus on the core services and products. \n\nInfrastructure-as-a-service offerings, such as Amazon's Elastic Computing Cloud (EC2), typically are used by larger enterprises to give research-and development groups flexibility in resources. For startups, eliminating the large capital expenditure of a data center at the outset has allowed many to reduce seed money and keep their burn rates that much lower, says Oliver Friedrichs, CEO of antivirus firm Immunet, which launched its first product last August. [For timely cloud computing news and expert analysis, see CIO.com's Cloud Computing Drilldown section. ]"It's a big win for smaller companies to leverage the cloud because you are really saving a lot\u2014it is really avoiding a large, up-front investment," says Friedrichs. "Five years ago, we would have had to build out a data center and the sheer cost of that would have made it much more difficult to launch our business." \n\nImmunet has no datacenter of its own. Instead, the company uses Amazon's EC2 to analyze malicious code for patterns that can help its product, Immunet Protect, recognize viruses and Trojan horses. The firm also uses the cloud to keep antivirus service available to its more than 125,000 users, adding new virtual servers as its user base grows. \n\nThe cost savings and scalability of infrastructure-as-a-service offerings are well known advantages. Yet, there are others. In interviews, three small companies that use the cloud\u2014and one that does not\u2014share the lessons learned from growing up with cloud infrastructure.1. From IT management to software developmentForegoing a datacenter immediately saves small companies a significant cost: Server administrators and datacenter managers. Yet, rather than reduce headcount, many companies are instead using the reclaimed budget to invest in software developers that have experience working in the cloud. \n\n"In a traditional data center, we would need an IT person to rack the system, maintain the servers, and own the hardware," says Immunet's Friedrichs. "So rather than hiring someone, we now have software developers that are writing on a very flexible platform that Amazon maintains." \n\nFor sales forecasting and analytics firm Right90, the cost savings of moving its infrastructure to the cloud was too advantageous to ignore. Right90 didn't start its business using third-party infrastructure, but the cost savings and flexibility of cloud services beckoned. Last year, the company moved out of its data centers in Calgary, Ontario and San Francisco, California and adopted Amazon EC2 with backup to servers located at the firm's own offices. The lack of servers to manage has freed up Right90's IT management team, says Arthur Wong, the firm's CEO. \n\n"The IT operations guys are still doing, what I would call, more strategic things in the organization, rather than managing data centers and servers," he says.2. Downtime is lowOne concern in moving to the cloud is that the providers\u2014such as Amazon, Google, Microsoft and Rackspace\u2014become targets for attacks that could cause significant downtime. Yet, so far, Immunet has had no problems with Amazon's service, Friedrichs says. "It is fair to say that since we launched, we have had zero downtime," he says. \n\nMoreover, the ability to spin up a new server instance in seconds gives customers redundancy that they would not have when managing their own data center, Friedrichs argues. \n\n"In a physical datacenter, your servers would be safe but you would not have clustering and failover to the same extent you have with cloud," he says. "You would have to plan in advance and have the redundant servers bought and provisioned."3. Security is still your headacheMany companies believe that using a third party's datacenter to host your servers means that security will be managed as well. \n\nNot true, Friedrichs says. \n\n"You do need security knowledge and security background, because you own these systems," Friedrichs says. "There is no difference between securing these in Amazon's cloud and securing them in your own datacenter." \n\nNot only do companies have to worry about the security of their virtual systems in the cloud, they have to\u2014in many cases\u2014prove what measures they are taking. File transfer service YouSendIt decided to create and manage its own datacenters in 2004, before cloud services came into vogue. But, even today with 12 million users, the company will not move its infrastructure into someone else's cloud because, among other reasons, security and compliance are still outstanding issues, says Ranjith Kumaran, founder and CTO. \n\nData security regulations, for example, are not handled well today, he says. \n\n"Our European customers want to make sure that their data stays in Europe," says Kumaran. "Can Amazon guarantee that? That's never been answered."4. Your ability to use cloud depends on your customersThe problems with the location of where the data is stored underscores that the decision to move to cloud is not determined by the companies, but by their customers and clients. Compliance can be a major issue for many companies, but other security concerns frequently come into play. To date, cloud services have not been able to satisfy them adequately, says YouSendIt's Kumaran. \n\n"We have actually had customers say that, 'We like your stuff, but we want to run it behind our firewall,'" he says. \n\nFor those customers, YouSendIt has created a solution that will make use of their on-premise storage. In addition, if the customers want to "walk the datacenter," YouSendIt can show them their London facilities, rather than figuring out what part of a virtual datacenter would satisfy the customer.5. The cost advantage only lasts so longDespite dealing with security and compliance issues, the cost savings of being able to tap into computing like a utility are enormous and something that startups will likely not give up anytime soon, says Nanda Kishore, CTO of ShareThis, which allows people to share links to sites. \n\nSince its founding in 2005, ShareThis has grown to serve 150,000 sites and processes 1 terabyte every day. Last year, the company had 30 to 50 virtual instances serving up links and information, which has grown fivefold today. The flexibility of the cloud has allowed it to grow quickly with no capital costs. \n\n"That notion of dynamic provisioning is a serious advantage of the cloud," says Kishore. "It is like a utility, you provision it when you need it and release it when you are done. That's a big cost advantage." \n\nYet, as companies grow, the cost advantage declines, argues YouSendIt's Kumaran. \n\n"Eventually, you get to a point where you get those economies of scale, and you move your bandwidth-intensive stuff over to your own infrastructure," he says. "We have done the math: Best case, it is a wash if we move to Amazon. The worst case, it could be 2.5 times our cost to run it in the cloud." \n\nShareThis has already run into that problem as well. Dealing with bandwidth costs became a major challenge. The company's solution? Push that portion of the service to the edge using Akamai. \n\n"Because bandwidth is what you pay based on consumption, it was a significant portion of our costs," ShareThis' Kishore says. "So we solved the problem by moving our data to the edge where it is cheaper." \n\nKishore estimates that ShareThis saves 30 percent on bandwidth costs compared to Amazon. \n\nYet, such growth issues are problems that most startups would love to have. For most small companies providing online services, the cloud's advantages vastly outweigh the disadvantages, says Right90's Wong. \n\n"I don't know of a startup in Silicon Valley that has servers anymore," says Wong. "I know ten CEOs of startups in the Valley and none of them have servers, maybe a mail server at most."\n\nFollow everything from CIO.com on Twitter @CIOonline.