The online delivery of software—sometimes labeled software as a service—has been a long-standing dream for some vendors and CIOs. The concept is simple and attractive: rather than buying a software license for an application such as enterprise resource planning (ERP) or customer relationship management (CRM) and installing this software on individual machines, a business signs up to use the application hosted by the company that develops and sells the software, giving the buyer more flexibility to switch vendors and perhaps fewer headaches in maintaining the software. For many years, traditional software vendors (those who sell licensed and packaged software, often along with a maintenance contract) have been able to overlook a rising crop of competitors that offer software as a service, as the latter have struggled to develop truly competitive services. It’s now time for traditional companies to pay attention, for they risk losing their privileged position to attackers that offer applications in this new way.

The complacence of traditional vendors is easily understood in light of the record: the first generation of online software delivery, in the late 1990s, failed to meet the reliability and quality standards demanded by business users. But the new delivery method appears to...