Analysis of the Global Security Information and Event Management (SIEM) and Log Management (LM) Market All Information Becomes Actionable

Transcription

1 Analysis of the Global Security Information and Event Management (SIEM) and Log Management (LM) Market All Information Becomes Actionable April

2 List of Exhibits Chart Slide Number Executive Summary 8 Key Findings 9 Executive Summary Market Engineering Measurements 11 Executive Summary CEO s Perspective 17 Executive Summary SIEM/LM Illustration 18 Executive Summary Introduction to the Research 19 Executive Summary Key Questions This Study Will Answer 20 Market Overview 21 Market Overview Definitions 25 Market Overview Improving SIEM and LM 27 Total SIEM/LM Market Percent Revenue by Distribution Channel 28 External Challenges: Drivers and Restraints Total Market 30 Drivers and Restraints 31 Drivers Explained 32 Restraints Explained 37 3

3 List of Exhibits (continued) Chart Slide Number Forecasts and Trends Total Market 43 Forecast Assumptions 44 Total SIEM/LM Market Revenue Forecast 45 Total SIEM/LM Unit Shipment and Revenue Forecast 46 Total SIEM/LM Market Pricing Trends and Forecast 47 Total SIEM/LM Market Unit Shipment Forecast by Region 49 Total SIEM/LM Market Revenue Forecast by Region 50 Total SIEM/LM Market Unit Shipments Forecast by Product Type 52 Total SIEM/LM Market Revenue Forecast by Product Type 53 Total SIEM/LM Market Unit Shipments Forecast by Vertical Market 56 Total SIEM/LM Market Revenue Forecast by Vertical Market 57 Market Share and Competitive Analysis Total Market 59 Total SIEM/LM Competitive Analysis Market Share 60 Competitive Factors and Assessment 61 Competitive Environment 63 4

4 List of Exhibits (continued) Chart Slide Number Top Competitors 65 Points of Competitive Differentiation 66 Enterprise Segment Breakdown 79 Enterprise SIEM/LM Segment Market Engineering Measurements 80 Enterprise SIEM/LM Unit Shipment and Revenue Forecast 82 Enterprise SIEM/LM Market Pricing Trends and Forecast 83 Enterprise SIEM/LM Competitive Analysis Market Share 85 Enterprise SIEM/LM Segment Competitive Environment 86 SMB Segment Breakdown 88 SMB SIEM/LM Segment Market Engineering Measurements 89 SMB SIEM/LM Unit Shipment and Revenue Forecast 91 SMB SIEM/LM Market Pricing Trends and Forecast 92 SMB SIEM/LM Competitive Analysis Market Share 94 SMB SIEM/LM Segment Competitive Environment 95 The Last Word 97 5

5 List of Exhibits (continued) Chart Slide Number The Last Word Predictions 98 The Last Word Recommendations 99 Legal Disclaimer 100 Vendor Profiles 101 Vendor Profile AccelOps 102 Vendor Profile Alert Logic 108 Vendor Profile AlienVault 112 Vendor Profile HP ArcSight 117 Vendor Profile IBM 122 Vendor Profile Intel Security (McAfee ESM) 129 Vendor Profile LogRhythm 136 Vendor Profile RSA (EMC) 146 Vendor Profile SolarWinds 152 Vendor Profile Splunk 158 Appendix 166 6

6 List of Exhibits (continued) Chart Slide Number Partial List of Companies Interviewed 167 List of Companies as Others 168 List of Acronyms 169 Partial List of Companies Acquired or Exited 171 Market Engineering Methodology 172 Market Engineering Measurements 173 Additional Sources of Information on Study Topic Area 176 Learn More Next Steps 177 7

7 Key Findings Frost & Sullivan estimates security information and event management (SIEM) and log management (LM) vendors sold $ billion of SIEM/LM appliances and related services for the basis year of the study This represented an improvement of % more than Note: In the report the term SIEM/LM will be used the majority of the time as the appliance is usually sold as a combination of products and functions. When the term SIEM is used without LM, this is in reference to the single module or console that houses the analytics or physical archive. SIEM is also is also used to refer to the logistical functions of the technology. The traditional use cases for SIEM/LM in compliance, storage, and forensic investigations remain important (and in some industries indispensable). The traditional SIEM/LM use cases can be argued to be passive in nature. The new approach to SIEM/LM is to use SIEM/LM as a part of an active cyber defense plan. The following is how SIEM is used to enhance an active cyber-defense posture: o Bidirectional communication between SIEM and other cyber security platforms (e.g., firewalls and vulnerability management (VM)) enhances the efficacy of each platform. o Incident mean-time-to-detect and mean-time-to-respond can be greatly reduced if analytics are applied in the SIEM. o Analytics are applied to detect anomalous behavior from end users. o Rules violations can be used as a way to create alarms or fed into a ticketing system. o Analytics can be applied to SIEM for redundancy. For example if a patch is applied, subsequent polling of the SIEM will determine if the patch got through to the endpoint. 9

8 Key Findings (continued) In the report, Frost & Sullivan classifies five different product types: physical appliance, virtual appliance, software, managed service, and software-as-a-service (SaaS). In the years , the physical appliance form factor will have the largest product group in terms of revenue. In 2019, SIEM/LM is projected to have revenues of $ million. However, the physical appliance will have the slowest moving CAGR at % during the same forecast period. Frost & Sullivan expects SaaS to be the fastest rising product group in terms of CAGR with %. North America is the region that accounts for most SIEM/LM sales accounting for % of all global SIEM/LM revenues in In 2019, Frost & Sullivan expects that share to drop to % of revenue. In 2014, Frost & Sullivan estimates nearly unique SIEM/LM customer contracts. By 2019, Frost & Sullivan estimates there will be slightly more than companies using SIEM/LM products. SIEM/LM deployments are nearly universal with companies that have more than endpoints. Most of the growth has to come from midsized markets. In 2014, the average annual contract price (ACP) for SIEM/LM products to a company was nearly $. In 2019, the ACP will be slightly more than $. The comparative lack of growth in SIEM/LM average ACP is the result of an increase in smaller companies using SIEM/LM products, and persistently strong competition in the enterprise segment. 10

9 Executive Summary Market Engineering Measurements Total SIEM and LM Market: Global, 2014 Market Overview Market Stage Market Revenue Market Units/Volume Average Price Per Unit Market Size for Last Year of Study Period Growth $ $ $ (In Billions) Customers Per Customer (In Billions) Base Year Market Growth Rate Compound Annual Growth Rate Customer Price Sensitivity Degree of Technical Change Market Concentration % % % 2014 (CAGR, ) Of Top 3 Companies Decreasing Stable Increasing Note: All figures are rounded. The base year is

10 Executive Summary Market Engineering Measurements (continued) Competitor Overview Number of Competitors Total SIEM and Log Management Market: Global, 2014 Number of Companies that Exited Number of Companies that Entered Total Addressable Market Replacement Rate Attachment Rate Years EPS per Appliance Total Addressable Market Maximum Attachment Rate Current Potential Users Industry Advancement Average Product Development Time Average R&D Spend by Product Marketing Spend as a Percent of Market Revenue $ % Loggers per Appliance Businesses Years (In Millions) Decreasing Stable Increasing *Companies with revenue of more than $1.0 M Note: All figures are rounded. The base year is

11 Market Engineering Measurements (continued) The purpose of this section is to explain the Market Engineering Measurements overviews, total addressable markets, and product development criteria. In the upcoming sections, Market Overview and Drivers and Restraints Total Market, the ways that SIEM and Log Management vendors improved revenues by % from 2013 to 2014 is discussed. Market revenues are determined by rolling up the estimated revenues of SIEM/LM original equipment manufacturers (OEM), software, and service providers. SIEM/LM deployments are now almost exclusively based on throughput. The amount of events per second (EPS) processed determines the licensing/pricing. EPS is usually calculated as a rolling 24 hour ingestion rate average. In some SIEM/LM contracts, there may be incremental charges for additional loggers, collectors, and platform integration modules. Customer price sensitivity is a subjective criterion. If Vendor A and Vendor B offer nearly identical services for a customer with basic SIEM/LM requirements, then the lower cost vendor is likely to win the account. However, customers consider the training of personnel, in terms of using new tools, to be a part of the pricing paradigm. Incumbent vendors do have a slight advantage. In this report, Frost & Sullivan is counting each customer contract as one unit shipped. Similarly, SaaS, physical, software, managed service, and virtual SIEM/LM contracts are counted as one units each. The total cost of customers engagements is on average nearly $. 13

12 Market Engineering Measurements (continued) Customer count is also preferred because a SIEM/LM is often included in a managed security service provider (MSSP) offering or in services provided to security operation centers (SOC). The companies that offer MSSP would not count the SIEM/LM as a discrete appliance sale. By using customers as the basis for counting, we can count SIEM/LM as part of the IBM QRadar platform (or similar platforms) for example. The degree of technical change is also a subjective measurement. The way that SIEM/LM ingests data, log events, store data or allocate storage, and handles compliance reporting has not changed conceptually over the last decade. However, the way SIEM/LM is being integrated with other network security platforms is a recent development. Machine-learning, correlation, and all-in-one appliances are recent products/applications that are emerging as important product differentiators and are technically difficult. The Top SIEM/LM vendors in terms of revenue are (HP ArcSight, RSA, and IBM). In 2014, these vendors accounted for % of all NAC revenues. Frost & Sullivan believes the market share of the top three SIEM/LM vendors will collectively decline as a percent of the market over the next few years as SIEM/LM vendors such as LogRhythm, AlienVault, and SolarWinds address small and mid-market needs and compete for enterprise accounts. Worth reiterating, HP ArcSight, RSA (EMC), Intel Security (McAfee) and IBM will show good growth rates; but not at the same pace as the overall SIEM/LM market. 14

13 Market Engineering Measurements (continued) The replacement rate is the contract term duration that businesses typically have for either SIEM/LM as a service or to license an appliance. Almost all contracts are for one year. However, in SIEM/LM sometimes businesses want to lock in maintenance and support pricing and will sign longer contracts. Some contracts are signed as in-perpetuity, although that only applies to certain SIEM/LM features. The attachment rate is the average capacity for one appliance. For a single appliance the active events per second (EPS) is EPS. Capacity changes are determined by how much normalization of data occurs and if the data is accepted as structured or unstructured data. SIEM/LM appliances scale horizontally and the major vendors can correlate millions of EPS. The maximum attach rate is based on the number of loggers per SIEM appliance. Frost & Sullivan is seeing one logger per appliance (generally). Roughly % of SIEMs are an all-inone appliance and there are no external loggers. To understand more about loggers see Market Overview Definitions. In statistics kept by the US Census Bureau, there were US businesses in 2011, with or more employees. Frost & Sullivan extrapolates a global number of businesses that have or more employees and have a significant Internet presence to be businesses. The businesses represent the number of companies that could buy a SIEM/LM product. 15

14 Market Engineering Measurements (continued) A SIEM/LM is a universal tool used by enterprise-sized businesses. Any type of business with a significant Web presence will use a SIEM/LM. Any business with or more endpoints should use a SIEM/LM (unless the business is decidedly low-tech). SIEM/LM vendors make significant changes to their platforms (based on new threat signatures) at least on a quarterly basis. For HP ArcSight, Intel Security, and IBM that have their own threat monitoring services, the SIEM is updated two or three times a week to accept threat intelligence. While SIEM/LM vendors frequently make.v1,.v2, etc. revisions to their platforms, it takes roughly years to refresh a SIEM/LM platform completely. Frost & Sullivan estimates SIEM/LM research and development (R&D) spending represented % of revenue in The $ million average spending is the calculation of SIEM/LM vendors spending % of their $ billion in revenues on R&D. The 2014 % R&D spending rate is normal historically in SIEM/LM, but will start to slow through 2019, as the larger investments in correlation engines, and partnership integration modules have already been made. In 2014, SIEM/LM vendors spent % on marketing. This number could be low because when companies spend money to advertise complete threat mitigation platforms, they are also spending money on the SIEM engines that coordinate cyber defenses. 16

15 Executive Summary CEO s Perspective By adding correlation engines and behavioral analytics into their platforms, SIEM/LM vendors provide an effective last line of cyber defense. In terms of global revenues, for the years , SIEM/LM vendors should expect % CAGR. SIEM/LM products on-premises, as software, or in various virtual and cloud environments should be transparent to the end user. 4 All-in-one appliances are making a strong impression in small and midsized markets. 5 The pricing of SIEM/LM is now based upon events per second (EPS) processed. 17

16 Executive Summary SIEM/LM Illustration Key Takeaway: Log management lays the critical foundation for SIEM to address continuous security intelligence SIEM tackles the intelligence problem: Correlate Analyze Act How do I use all this data? Log Management tackles the big data problem: CISOs need both Collect Administer Archive How can I handle all this data? 18

17 Executive Summary Introduction to the Research Purpose of the Research o This report provides an analysis of the market for SIEM/LM including: Three years of historical market sizing base year 2014 and five years of market forecast Market shares for the market participants Market description and market trends Drivers and restraints Individual company profiles of the market participants Segments of the market to be analyzed include: o By product type o By geography o By customer type o By distribution channel 19

18 Executive Summary Key Questions This Study Will Answer What do customers expect from SIEM/LM vendors? Which feature sets are being adopted by SIEM/LM vendors to win business? How is SIEM/LM being used to help with compliance and security in specific vertical markets? What are the forecasts for SIEM/LM customers and revenues by region? By vertical market? By size of business? By product type? What is the market share for SIEM/LM vendors for the total global market for business sizes SMBs and enterprises? What are notable points of competitive differentiation among SIEM/LM vendors? 20