Does Workplace have a Facebook problem?

Facebook emerged from 2018 bruised from a series of revelations that undermined trust in the popular social media platform and raised questions about its commitment to privacy.

There were the Cambridge Analytica revelations last March, security bugs later in the year that compromised data for millions of users, and a host of smaller privacy concerns. Perceptions of the company – and its stock price – took a beating.

At the same time, the company continued to push its Workplace by Facebook enterprise software, touting ease of use and familiarity as selling points for companies looking to get their employees better connected.

It’s not clear yet how high-profile troubles on the social media side of things might spill over to the company’s collaboration suite. But they’re likely leading to greater scrutiny by at least some customers, analysts said.

“Facebook’s privacy and data issues have cast a long shadow over the Workplace business, which is trying to move further into the sunlight,” said Wayne Kurtzman, a research director at IDC. 

“Enterprises have to weigh user trust, corporate trust, and ease of use in the platform, knowing the platform itself may keep some users from adopting it. Meanwhile, other enterprises have made the jump quite successfully.”

Workplace was launched in 2016 following a lengthy beta period, essentially recreating Facebook’s immensely popular social network for a corporate audience.

Competing in a crowded workplace collaboration market dominated by Microsoft, Google, Slack and others, Workplace has seen early momentum, with deployments at 30,000 businesses, according to adoption stats from October 2017 – the last time such figures were made publicly available.

Marquee customers include Starbucks, Royal Bank of Scotland, Walmart and a recent company-wide deployment for 210,000 staffers at the world’s largest food company, Nestlé. On Tuesday, Facebook also announced that telecommunications company Telefonica is rolling the application out to 120,000 users worldwide following a pilot project. Telefonica said Workplace will help connect its frontline workers and executives, and will integrate with of Office 365. Telefonica also plans to incorporate bots into Workplace in future in order to automate processes.

Workplace and Facebook

As Workplace continued to ramp up efforts to attract large corporates with a range of new features during 2018, its parent company has been beset by various controversies. In March 2018, millions of users found out their Facebook data had been harvested without their knowledge by Cambridge Analytica and re-used for political purposes.

Later in the year, the company acknowledged a bug that gave hackers access to 50 million user accounts. Facebook says that Workplace customers were not affected by the bug.

The Workplace team, based in London’s Rathbone Place, operates separately from the wider Facebook operations.

“We’re an independent team, but are part of the Facebook family of apps and services. We’re proud that we are headquartered in London and that our product is built here,” said Kyle McGinn, director of Workplace.

From a user perspective, the basic functions of the two apps are largely the same, with features that will be familiar, such as the news feed, groups and live streams.

Facebook

Indeed, one of the main selling points of Workplace is that it is instantly recognizable and can be picked up fairly easily by employees – an advantage over other enterprise social networks (which are often modeled on Facebook’s consumer platform to some degree). Rival platforms can be hampered by low adoption levels because of the learning curve necessary to get the most from them.

There are some fundamental differences between Facebook’s two platforms, however.

Workplace is, of course, built for work: there are more than 50 integrations with third-party software applications, group chat and video functions, file-sharing, as well as IT security and management controls – such as single sign-on and identity management – that are often required for corporate deployments.

Workplace has a different revenue model to the consumer business, relying on subscription payments ratherthan advertisements. Workplace has two pricing tiers: a free Standard service, and fully-feature Premium tier that costs $3 per active user per month.

Facebook asserts that Workplace Premium customers retain control of employee data held within the application. If an enterprise customer decides to shut their account, Facebook says it will delete all customer data from its servers in accordance with its own data deletion policies.

From a data privacy and security standpoint, the application has certification for ISO 27001 and 27018 standards, which relate to information security management and personal data protection. Its application hosting practices are audited by independent third-party auditors with the industry-standard SOC3 report, while Workplace Premium customers can access a more detailed SOC2 report.

Facebook last year also launched its Security Center tool during Flow, the first Workplace user conference; Security Center is a dashboard for systems administrators to monitor potential security events at a glance.

“At Workplace, security is at the heart of everything we do,” saidMcGinn.“We regularly work with our customers, including their legal, security and procurement teams, to ensure they’re aware of our security certifications and credentials.”

‘A higher level of scrutiny’

Despite moves to operate the two businesses independently and position Workplace for a business audience, Angela Ashenden, principal analyst at CCS Insight said Facebook’s corporate culture will likely affect the way its Workplace software is viewed by an enterprise audience.

“We’ve certainly seen an impact from the data security/privacy issues in the level of overall trust that organizations have in Facebook,” said Ashenden. She pointed to a recent report from the analyst firm; it indicates that 40% of IT decision-makers say trust in Facebook has declined in the last 12 months.

“There are also still lots of organizations trialing and interested in trialing Workplace – where there is a need to build better communication and knowledge sharing across an organization, Workplace is still going to be an appealing option,” said Ashenden. The challenge will come when moving to an organization-wide deployment, she added, where there are “specific requirements around security, compliance and data governance.

“Those are likely to be more challenging in the wake of the various security and privacy scandals,” she said. “Certainly, I would expect the sales cycle to be longer now.”

That view is shared by Joel Jacobs, vice president and CIO at The MITRE Corporation. Jacobs has been interested in the corporate use of Facebook at MITRE since before the launch of Workplace, though MITRE has relied on an internally-built, open source social network in recent years. Migration cost is one of the reasons the organization has not deployed Workplace thus far.

MITRE has a standard vendor risk assessment process that reviews a supplier’s control and use of customer data. Reports about Facebook’s past data management issues are likely to require more time is spent on assessing Workplace, he said.

“It inspires a higher level of scrutiny,” said Jacobs.

“In the case where there are statements in open press about security concerns and controls of data – and frankly reuse of data according to the broader consumer licenses – we would want to make sure that we understood what the bounds were. And in the case where there has been any issue of either a breach or reuse [of data] or the like, it just increases the scrutiny before we would be comfortable with it.

“So that would be part of our risk assessment in adopting a platform,” he said.

In practical terms, increased scrutiny means higher costs, said Jacobs. “There is enough out in the world on Facebook writ large that we would want to be very careful, and that actually increases the switching costs from another platform to this one,” he said.

“From every news report or statement from the company, it gives you another point to ask to confirm that problems have been solved and options have been narrowed and so on,” Jacobs said. “These are big complicated platforms and you really want to make sure that you are not [at a later stage] saying, ‘Well this in the news’ and you didn’t even ask about it, and then later it turned into a problem for you. 

“So I can imagine that their sales cycle is longer than it was for exactly that reason.”

Companies express confidence

However, it’s clear that there are large customers who are confident in the platform.

Nestlé, for example, is in the process of rolling out Workplace to connect its entire workforce of around 323,000 employees.

“The Workplace platform runs separately from the Facebook platform,” a Nestlé spokesperson said. “The data belongs to Nestlé and is administered by us. We place a lot of emphasis on data protection, and the new system is fully compliant with relevant data protection rules.”

The application is also deployed in highly-regulated industries, such as healthcare and the financial services sector, a Facebook Workplace representative said.

One such customer is the UK’s Royal Bank of Scotland (RBS).

“We did look at how Workplace was constructed, how it was developed,” said Royal Bank of Scotland’s chief information security officer, Chris Ulliott. “We have a standard process that we use for all software-as-a-service solutions and there are a number that we use across the bank. We treat Workplace no different to any of our other vendors.” 

Ulliott said that the bank was in contact with Workplace after the security breach reported in 2018. However, the breach did not cause undue concern at the bank, he said – and RBS was impressed with how the incident was dealt with.

“Workplace isn’t unique,” Ulliott said. “[All vendors] have security issues. For me, what is really important is how well a vendor manages those [issues]. And that was where – if we take the login credential issue… – that is where Facebook as a vendor responded incredibly quickly: they were able to give us updates on what they were doing, and they managed it in a really professional way.”

Building trust

Facebook is already working to highlight the distance between its consumer and business products. Notably, Facebook announced last summer that Workplace will be moved to its own workplace.com web domain during 2019, moving off its current domain, facebook.com/workplace.

“The two products are treated separately,” said McGinn. “We have announced a plan to move Workplace to the workplace.com domain – this will be a visual change to bring Workplace in line with the rest of the family of apps and services, like Instagram and WhatsApp, which have their own domains.”

More could be done, however, to increase levels of confidence and trust among enterprise users, said Kurtzman. This could mean shifting the Workplace brand further from its parent company.

“To increase trust, Workplace could benefit in creating a new brand and narrative that truly separates them from Facebook,” he said.

“Change the name to Workplace. Remove “Facebook” from the URL (which is already planned). Create plain language consent agreements.Prove to users and companies that they are the customer, and not the product.”

Ashenden said that Facebook has made some “important investments in its security and certifications,” that provided “a good baseline.” However, “there is still work to do in terms of providing tools to help organizations manage and control the way data is stored and shared.”

“Building trust is the biggest issue,” she said. “While the Workplace team is largely autonomous and operates the Workplace service separately from the wider Facebook business, the corporate culture and the way Facebook as a business conducts itself will continue to impact the way the Workplace business is perceived.”

Ashenden added that, more generally, Facebook could do more overall to improve perceptions among businesses – which extends to other tools in its portfolio, in particular, chat tool WhatsApp. It is becoming a “major headache for many IT organizations,” with employees using WhatsApp for work purposes, potentially leaving organizations exposed to various compliance and data governance issues, she said.

“All these things impact the company’s perception of trustworthiness – and their understanding of their business customers’ issues and concerns,” Ashenden said.