I am about to upgrade our clients and server to version 10 but I am getting a LOT of resistance from our IT department which considers Bonjour both a security risk and a generator of excess network traffic. Can 10 be run without it in any reasonable way?

I don't see why Bonjour would be a requirement. So going IP only should be fine. But it sounds like your IT is attaching old philosophies to Bonjour as they must have to AppleTalk.

I sure IP only you'll be fine. Just make sure they give you static IP and DNS name for the server.

static address and DNS name for the server is not a problem, although it is a hassle to have users add a favorite compared to just seeing it in local hosts.

The bigger problem is some files are still shared peer to peer by our sales people. They'd have to know the name or address of all of their co-worker's workstations as who will be the host is a matter of who opened the file first. As part of our bidding process they are continually making copies for historical purposes so the files can't be hosted on our server.

They all know their own PC names since we use BGInfo to display it on the desktop so they should be able to find any shared file by asking for the host's DNS name.

Unfortunately they're going to see this as a downgrade from the way 8.x has worked for them up until now

I see your point. This is straight from FMI:

If Bonjour is not installed or the service is not running, FileMaker Pro can’t discover remote networks. For example, you won’t be able to view hosted databases in the Open Remote File dialog box or display the list of remote files to use as your external data source.

Without Bonjour, you have to manually enter the IP addresses for remote databases.

While I don't like having FMI rely on 3rd party software like this, I think I dislike it even more if they tried to keep to their own batch of code to do the same thing. This way at least security holes discovered outside the FM world will benefit us.

So your IT is really showing a bit of ignorance here: they had no problem with some bit of code built into FM that had who know what kind of issues, but they won't rely on some other code that is a published standard?