There's worse news. If you're using application services without realising that's what you're doing, then you probably haven't taken any of the essential precautions required before entering into an ASP contract. That means you're exposed to risks you don't even know about.

Since I spend my waking hours researching, writing about and talking to ASPs, people often ask me: what is an application service provider? Let me answer with a definition, and then some examples.

An application service provider is any third party whose main business is providing a software-based service to multiple customers over a wide area network in return for payment.

There are three main forms of application services a typical business might use today:

1) Application outsourcing
This is the one that attracts all the hype, characterised by publicity-hungry ASPs such as USinternetworking, which just floated on Nasdaq; or Corio, which this week gained equity backing and special partner status from PeopleSoft. They promote the cause of delivering top-tier enterprise applications on a pay-as-you-go basis. They claim to be a brand new emerging category, but really they are just the tip of an outsourcing iceberg. Every level of the IT infrastructure can be selectively outsourced today, from data networks, through systems management and on to messaging. Enterprise apps just happen to be the bit at the top that sticks out of the water.

2) Application hosting
Most Internet service providers who host web sites are desperately unwilling to become ASPs. It's complex, difficult work that is outside of their core competence. But customers want web sites with interactivity and transaction handling that integrates with their existing in-house systems. In other words, they want web sites that run applications. By default, any ISP that hosts such sites is acting as an ASP. But only a minority of high-end ISPs and web hosting providers are gearing up the resources they need to make a success of it.

3) Websourcing
Probably the world's most successful ASP to date is E*Trade, the online broker. For a monthly subscription, users rent access to an online trading cockpit that's dripping with applications - instant graphing and statistical analysis, realtime information feeds and more. For a more business-orientated example, check out ServicePort, a business portal from startup Portera Systems that offers a suite of online applications for professional consultants.

One day, all computing will be websourced out of online servers operated by third-party specialists like E*Trade and Portera. But not for a while yet. Last week, thousands of US taxpayers thought they could rely on Intuit's online TurboTax service to file their tax returns on time to the IRS. On Tuesday, they found the service was down for 16 hours while Intuit fixed problems caused by unexpectedly high demand.

Intuit's problems were caused largely by its failure to realise that it has become an application service provider, exposing its online services to a whole new set of pressures and responsibilities. Nor had its users, caught equally unaware, gone through the essential ASP risk assessment checklist: How likely is a failure? What's your fallback in that event? Do you have an exit route? If you don't, what recourse do you have?

At least the application outsourcers, with their IT provider background, are well-versed in the skills of sustaining mission critical computing. But what they gain in systems management expertise, they have to make up in applications infrastructure. ASPs are taking enterprise apps into completely new territory where the pitfalls are as yet undiscovered.

The bottom line is that application services are emerging so fast that most ASPs don't even realise that's what they're called, while those who do are still working out how it's done. Yet virtually every organisation already unwittingly bets parts of its business on all of them getting it right.