The same survey finds similar-size businesses not using cloud services worry they might not be secure enough and that the costs of transitioning to them might be a hurdle.
The goal of the survey was to find out the expectations small and midsize businesses had for cloud services and how that compared to the reality experienced by companies that are already using cloud services, says Tim Rains, director of Microsoft's Trustworthy Computing.
The upside for security is that cloud services on average cuts 18 hours per week from security management time, the survey says, because much of it is handled by the provider, Rains says. "It doesn't eliminate the need for patch management on-premise, but there's less of it to manage," he says.
That saves money, but also increases security because providers are likely to patch and upgrade in a timely manner as a competitive edge.
The survey says that over the past three years, businesses using cloud services enjoyed decreases in security spending that are more than five times the savings reaped by businesses that didn't use cloud services. Of those using cloud services, 20% say they reduced their security management costs, but the number was just 4% for those that didn't use cloud services.
Still, 40% of those respondents not using cloud services say security is the reason they don't, but 67% of them say they would be more confident about using cloud services if there were industry security standards. Visibility into how cloud providers operate their networks so customers can map that to standards and best practices would make 38% of respondents more confident about buying cloud services.
A third of those not using cloud services say they see the cost of transitioning to cloud services as a barrier.
The survey questioned 94 small and midsize businesses using cloud services and 93 that did not. Microsoft says cloud users were defined as companies that used a cloud service via a subscription model, and did not differentiate among SaaS, IaaS and PaaS offerings, or what types of data or functions were entrusted to those services.
The survey was conducted by research firm comScore, which did not reveal to respondents that the survey was sponsored by Microsoft. Respondents were not qualified based on which cloud vendor they used.
A small to midsize business was defined as one with between 100 and 250 PCs in its network.