Kerberos Support vs. NTLM Support

Guest

I would like to get a feel for IT admin's opinion on a subject: if a
third party piece of client-side software wanted to play in my all
Microsoft single-sign on environment and it could only use NTLM cached
credentials (e.g. cached from the initial workstation logon) to effect
automatic logon to the third party software, would I be losing
functionality or security?

Is the safe play to ensure that whatever I get can use the Microsoft
Kerberos ticket cache (or whatever you call the cached credential for
Kerberos)?

Are XP Pro workstations going to have Kerberos cached credentials only
such that the users will always have to re-type their password to get
into the third party software?

Thanks for your thoughts,
Royce