Do you remember the story of Dan Farmer who, while working for Silicon Graphics, wrote a piece of freely downloadable software called SATAN (Security Administrator Tool for Analyzing Networks) that would expose all of the vulnerabilities of just about any Internet connected system it was pointed at?

SATAN achieved instant notoriety for revealing some astonishing vulnerabilities. Despite the good it did for the many companies that quickly buttoned up their security, SATAN earned Farmer a highly controversial pink slip from Silicon Graphics for releasing a tool that was as potent for the bad guys as it was for the good. Indeed, a typical reaction to the software's release in April 1995 ran like this: "If you don't test the security of your systems with SATAN, someone else will."

For customers, that's the beauty of the Internet and the way it commoditizes markets like the flower business. The cost of switching after one merchant fails you is zero. But for businesses that can lose customers to a competitor in a blink of an eye, the cost of a system-borne snafu -- such as an interminable hour glass after a customer clicks the "place your order" button two days before Mother's Day -- can be irrecoverable. For seasonal businesses where system loads are subject to spikiness, Mercury Interactive's pre-production testing tools are designed to melt your systems down before your customers do.

The type of organizations that can benefit from Mercury's tools aren't limited to Internet-bound businesses nor are its solutions just about stress testing system scalability to find out how many straws it takes to break your camel's back. There are plenty of brick-n-mortar retail operations, call centers, and other business process types where a system meltdown can not only paralyze the business, but be quantified in terms of hard dollars lost. When was the last time you called an airline or hotel to book a reservation only to hear a keyboard smashing in the background and a frustrated reservation agent asking if you can call back later because the computers are down. "Sure I can call again," you think. "I can call another airline."

Mercury Interactive can also test functionality. Said Lochhead, "Our core offerings automate the way you stress test applications for quality and performance. To test the quality, you can create a script that mimics what a user will do with a piece of software and then use that script to see if the functionality does what it says its supposed to do. For commonly deployed software like SAP, PeopleSoft, and Java 2 Enterprise Edition-based application servers, we ship with some pre-existing scripts to get you started."

Not only does Mercury support those and many other common application environments, but Lochhead claimed that the company knows more about what it takes enterprise applications like ERP to succeed in production environments than do the solution providers themselves. Mercury has engineers on sites where those applications are being developed. "If you're an ISV," said Lochhead, "you can do the best job possible in quality assurance and testing. But because of how the production environments are so different from each other and changing, they can never tell what it will take for those apps to survive or scale in customers' infrastructures." According to Lochhead, the ISVs have some real incentive to work closely with Mercury: revenues. "ISVs have found that if they don't work well with us, then they'll have a much more difficult time getting their customers to upgrade," Lochhead said.

In addition to pre-production stress testing of your soon-to-be-rolled-out applications, Mercury's probes can be attached to production systems in a way that feeds critical IT performance data to the desktops of business executives in terms that they understand (cost). Drawing comparisons to competitive offerings, Lochhead talked about how many systems will show IT managers a red or yellow indicator to indicate that certain performance or scalability thresholds have been exceeded. Mercury, in contrast, plots the availability and scalability of production applications and networks against metrics like transactions per hour. "Let's say you're at 70 percent of what your performance should be," said Lochhead. "We measure the business impact of that. For example, using our dashboard, a business executive can see that the company is losing $150,000 per day or the average time it takes to sign up a new customer to a [wireless service] plan."

While Mercury's dashboard isn't new, the fact that Mercury's technology now makes it more readily available directly to business executives is. It used to be available only to the IT managers in charge of running Mercury's solutions. One reason the technology probably had to be rewired to support this sort of dashboard distribution is that Mercury, in Managed Service Provider (MSP) fashion, now hosts the same sort of application and infrastructure performance monitoring that it provides as the vendor of locally installed solutions. Enough companies have opted for the MSP-delivered version of its solution, said Lochhead, that Mercury is now taking over 8 million measurements per day. In the "MSP-mode," the probes live on your infrastructure (or even the infrastructure of your other ASPs, if you can negotiate that up front), and the data is fed back to and processed on Mercury's systems and then results are fed back to the dashboards on the desktops of IT managers, business executives, or both.

Ultimately, dashboard architecture facilitates a variety of IT-related business conversations that can help to keep IT plans as closely aligned as possible with business goals. Perhaps the conversation that's beneficial to both the CIO and the executive office is the one that covers the hard dollar cost of poorly optimized information technology. From the CIO's point of view, such quantifications can help articulate the expected ROI to the corner office.. From the CEO's and CFO's points of view, it provides a framework to which the IT department or an ASP, Service Level Agreement-style, can be held accountable.

Mercury's extensive exposure to many production environments also helps the company to resolve architectural and technological shortcomings through some lightweight autonomics as well as through sets of solution-specific best practices that Mercury calls "run books." On the autonomic side, Lochhead said, when a technical problem is bringing a system close to the breach of an SLA, Mercury's technology can validate the problem, and, using software agents which support over 60 different environments (Unix, Windows, Linux, WebLogic, WebSphere, Oracle, .Net, J2EE, etc.), automatically shuts down the failing processes and restarts them. Beyond autonomics, Mercury's run books are akin to what Mapquest does for those seeking directions. They bottle the expertise of category experts and, in hopes of avoiding the escalation of the problem to a real (and more expensive) expert, prescribe technical solutions and application optimizations.

Mercury's complete portfolio includes: testing pre-production applications and infrastructures for their production-readiness; monitoring of production environments in away that can keep business executives informed of how closely aligned their IT configurations are with business goals; and two tiers of automated resolution and optimization. According to a Gartner report issued in Fall 2003, Mercury Interactive's position in the category of Distributed Platforms Quality Assurance from a leadership and ability-to-execute point of view was unmatched.. Compuware is a distant second place and, beyond that, none of the other vendors are even listed as leaders in Gartner's report. If you had asked me, before my meetings with Lochhead, to name a 14-year-old software company with $506 million in annual revenues, $1.3 billion in the bank, that's in both the NASDAQ 100 and the S&P 500, and that has 2,400 employees in more than 35 countries, the name Mercury Interactive would never have crossed my mind.

We don't hear much about Mercury's category - that of business technology optimization (BTO). As far as I can recall, I've never written about BTO. However, after listening to Lochhead, I've concluded that companies can't afford to be ignorant of BTO. It's a technique that can help businesses understand if their technology is holding them back or helping them to achieve their full potential. Ignorance could be a costly oversight.

You can write to me at david.berlind@cnet.com. If you're looking for my commentaries on other IT topics, check the archives.