"[Mashups are] really a solution looking for a problem," he said. "It's great to be able to put your pizza places on a Google map, but what good is it?"

One clear-cut role for mashups has emerged, he said. "Mashups are becoming killer-use cases for SOA," Bloomberg said. "You can show a mashup-based solution to an executive, and they'll get it."

Yet, any serious conversation about SOA inevitably turns to governance. "You can't just let anybody mash up anything ... all that has to fit into the governance framework an organization has," Bloomberg said.

IBM says its tools have governance and security built-in. JackBe also offers governance components, which include a connector to Hewlett-Packard's SOA Systinet, a management platform for SOA.

The ever-present spectre of vendor lock-in is another concern, Gourley warned. "The challenge is that each of the big players have inherent biases to build things that only work best with their solutions," he said. "This is never their stated intent, but the internal pressures to do that are something that all CTOs should watch closely."

Meanwhile, smaller companies like JackBe are "absolutely forced to work well with everyone," he said.

Then there's the question of what constitutes a mashup developer. While mashup vendors broadly proclaim their tools' ease of use for nonprogrammers, some level of development skill is realistically required, according to Coté.

"I think what you can do in [Microsoft] Excel is the bar," he said. "If a user can create macros and pivots in Excel, then mashups should be conceptually within their grasp.... [But] you're always going to need programmers."

Gourley said "the ideal mashup developer is no developer at all."

"A mashup platform should be so easy to use that in-house developer talent can succeed with it, and it should also be so easy to use that end-users can do the mashing," he added. "When large integrator companies claim that they field mashups, I start asking them hard questions like, 'Did you really field a mashup or did you hard-code the interface?'"

"But ... generally some development is required, and when a mashup platform is selected it should be one that lets internal developers field solutions fast, in days versus in months," he added.

Even before choosing a vendor's offering, companies should lay the groundwork for their mashup strategy, Gourley said.

A first step is to determine the initial data sources to be used. "You can add more later, but it helps to have an initial list so you can ensure the data can be securely consumed." Second, companies should go with a browser-based product, he argued. "You have many options to chose from, including thick applications, but browser-based solutions are more maintainable."

Echoing Bloomberg, Gourley said the most important thing is to "begin with a vision for what needs to be accomplished. Without a vision, the odds of success will be much lower."