I'd still bet on Google's security setup for its Apps customers over your friend's company. Also a consideration, Google would cost only $900 a year for 15 users, which is a considerable savings over dedicated staff.

I recommend Google Apps all the time. It's almost certainly better than what they're using now and is very good at not having problems.