Application service providers (ASPs) provide access to application software over wide area networks and have been viewed as a means of making the benefits of outsourcing available to small businesses. However, many enterprise ASPs get the majority of their revenue from very large businesses while many vertical niche ASPs get their revenue from small businesses. We analyze this seeming anomaly from a risk management perspective. ASPs present a greater risk management problem to would-be customers than traditional outsourcing. We analyze the nature of the risk differences and then propose a model of how would-be customers process those risks. In our model, prospects first assess whether they can tolerate the worst case scenario and if they are able to do due diligence on the likely outcome. They consider benefits only if one of the previous assertions is true. The worst case scenario for enterprise applications is truly dire and only technologically sophisticated businesses are better able to identify the true risk profile. For vertical niche ASPs the worst case scenario is relatively mild, but economies of scale make the benefits relatively more appealing to small businesses.