Sales of the study at $320 per copy (paper format) complements the financing of the project.

Transcription

1 1

2 TABLE OF CONTENTS 1. FOREWORD INDUSTRY PROFILE MARKET STRATEGIES TRADE EDUCATION, TRAINING, AND R&D FINANCING CASE STUDIES CONCLUSIONS AND RECOMMENDATIONS Sales of the study at $320 per copy (paper format) complements the financing of the project. 2

3 1. Foreword Security is the order of the day. September 11, 2001, brought security into the limelight. But September 11 was more of a wake-up call than the harbinger of a commercial boom. Most of the growth in security has been fed by the spread of the Internet. As well, the digitization of traditional security devices (mainly CCTV) has accelerated their networking. This phenomenon, in turn, triggered a convergence between information security (infosec) and physical security. Advanced security is the result of this development. Who is doing what in this new security arena? Are the infosec companies invading the turf of the physical security firms or the other way round? What are the structures of the new cluster and, first of all, is there an advanced security cluster? It is to answer these questions that CATA Alliance initiated this twofold project: creation of a database and conducting a survey. From April to May 2003, about 700 advanced security companies were identified and placed on the CATA Alliance Web site ( in order to enable other companies whose names did not appear to register. Between May and August 2003, a survey was conducted by fax, , and telephone. Almost half of the companies responded (294 over 698). At the same time, 36 one-on-one interviews were performed, resulting in the production of 28 case studies. The advanced security project is the result of a collective effort. It was financed by seven sponsors from both the public sector (Department of Foreign Affairs and International Trade, Industry Canada, and the Conseil du Trésor du Québec) and the private sector (Bell Canada, BMO Financial Group, LGS/IBM Canada and Canada Post). We would also like to extend our thanks to our associate partners: the Canadian Commercial Corporation (CCC), the Canadian Information Processing Society (CIPS) and the Canadian Alarm and Security Association (CANASA). 3

4 2. Industry Profile The advanced security industry is made of pure players, that devote 100% of their activities to security, and hybrid companies whose core business encompasses a wider range of activities (computer science, telecommunications, business auditing). The typical advanced security company is an SME with seven employees (median value). The industry is highly centralized in three cities: together, Toronto, Montreal, and Ottawa account for 62% of all companies (436 out of 698). ONTARIO AND QUEBEC ARE HOME TO 75% OF SECURITY COMPANIES Region Companies % Ontario Québec British Columbia Prairies Atlantic Canada Source: CATAAlliance survey-april-august 2003 Nearly two-thirds of companies are active in the infosec sector. Only 10% of companies do both information and physical security, which demonstrates how nascent the convergence process is. Altogether, CATAAlliance estimates the total advanced security industry represents 22,000 jobs and several billion dollars in revenues (respondents only declared revenues in the range of $1.5 billion). 4

5 3. Market Strategies The advanced security industry is growing and growing fast. Close to 50% of the advanced security companies surveyed defined themselves as being in an early growth stage. Over 85% of respondents declare growing revenues. The telecom crisis slowed down growth, and some companies lost some ground, but the recovery has usually been quicker than in the rest of the IT industry. The advanced security market is evenly divided between public-sector (governments, ports and airports, borders, etc.) and private (finance, telecommunications, pharmaceutical, etc.) clients. In the private sector, regulated industries are more likely to use advanced technologies than are unregulated ones. Most of the users are large organizations or high-growth SMEs. The residential market is almost entirely untapped. At present, serving the residential market is considered a sign of low-grade security. The main growth driver in the advanced security industry is new product launches. Over the next two years, other more market-oriented drivers will become more important. Acquisition strategy plays a relatively small role and this may be the clearest sign that the extravaganza of the 1990s is over. The most important obstacle to growth for companies operating in advanced security markets is access to funding to support new technology development. OBSTACLES TO GROWTH 30,0% 25,0% 25,9% Financing Gouvernment procurement 20,0% Market information Lack of accepted standards 15,0% 10,0% 5,0% 15,3% 15,0% 14,0% 13,2% 7,5% 6,2% 2,8% Recruiting of skilled staff Privacy policy Access to new techology Relations with suppliers 0,0% Source: CATAAlliance survey-april-august 2003 Financing issues are felt particularly strongly because the high-tech slow-down has temporarily shut off the flow of risk capital. Two of the four obstacles are linked to government policies directly in the case of procurement and indirectly for standards. This underlines the urgent need to re-establish trust, as well as the pivotal role played by governments. 5

6 4. Trade Close to 69 % of advanced security companies export, the U.S. being the prime destination for almost all of those firms. The primary non-u.s. export markets are Europe (45%), Asia and the Middle East (35%), Latin America (13%), Oceania (5%), and Africa (2%). WORLD DESTINATIONS OF CANADIAN EXPORTS Source: CATAAlliance survey-april-august 2003 Close to 90% of advanced security companies that export their products are engaged in ongoing research and development. This high proportion indicates the importance of R&D and the need for companies to upgrade their products and services to ensure their competitive success. The marketing/sales focus of the advanced security industry is targeted to selling products through direct methods. Over 90% of companies use direct sales channels to sell their products, while 73% employ indirect channels. Only 10% of companies employ indirect sales channels only to sell their products. Close to 60% of advanced security companies do not use government programs to help them export their products. 6

7 5. Education, Training, and R&D Recruitment of skilled staff is the fifth obstacle to growth cited by security firms. However, opinions vary greatly about the availability of skilled staff in Canada. Training seems to be held in high regard by security companies: Canada has the world s second largest number of CISSP professionals. Education in security is at an embryonic stage in Canadian universities. Only one master s-level university program is specifically dedicated to IT security: it is given by Concordia University College of Alberta in Edmonton. At the undergraduate level, cyber-security courses are scattered among more than 700 university programs delivered on IT. R&D is almost universal in the security industry: a bit higher among manufacturers and software developers (above 90%) and relatively lower among service providers (above 70%). But R&D teams are generally small five researchers on average. Many of these researchers have the impression that they are isolated. The lack of a national drive supplied by a security champion is resented. R&D ACTIVITY No 17% Yes 83% Source: CATAAlliance survey-april-august 2003 The main reasons for conducting R&D in the advanced security industry are still technological: close to 70% give developing new products/services and improving/upgrading existing products as their reasons. The great novelty is the emphasis put on marketing: close to 30% conduct R&D to enter new markets. 7

8 6. Financing Close to 50% of advanced security companies are searching for financing to support their corporate growth. FINANCING STILL A PROBLEM Yes 44% No 56% Source: CATAAlliance survey-april-august 2003 The high proportion of advanced security companies seeking financing to support future growth indicates a significant under-funding of the industry. In fact, the figure could even be higher due to the fact that many companies responded that they were no longer looking for financing because venture capital has dried up. Again, it appears that the main reason cited in the search for financing relates to product commercialization, which is at a level equal to R&D. This is an encouraging sign. Company expansion and acquisitions account for only 10%, which is another departure from the 1990s. The lack of appropriate financing may also result in lost market potential in both the short and long terms, as companies are unable to fund new product development and innovative strategies for expansion into export markets. 8

9 7. Case Studies Companies profiled in this section were chosen to illustrate the different core businesses and the level of intensity of their activities in advanced security The figure below illustrates this first level of profiling: Intelligent Switched Systems Entrust Callio Technologies Equipment / Software Dephy Technologies VX Technologies Wallace Wireless SCS Card Technology Solutions Cloakware BioDentity Systems Corporation Silanis Technology Pure Okiok Data Hybrid Cyberun IT EWA IBM LGS C-CORE Mar Computer Systems CyberSecure Elytra Enterprises Fusepoint Services / Integration Deloitte & Touche Bell Canada Post Securiguard The companies identified on the left-hand side of the figure Callio Technologies, Intelligent Switched Systems, Sign@metric and Cloakware represent specialized advanced security firms in either the manufacturing or the software-producing side of the business. Still on the left-hand side, clustered in the services and integration section, are Okiok Data, Cybersecure, Fusepoint, Cyberun IT, and Elytra, which are either service providers or integrators. Moving toward the right-hand side of the figure, one discovers companies that are involved in security but also market other types of activities. For example, EWA, a prime advanced security player, is also involved in defence. The same goes for IBM LGS, which, as a hybrid, plays the role of both IT developer (upper right-hand case) and an integrator (lower right-hand case). 9

10 The second level of profiling was based on a set of three factors: A distinct business model An aggressive export strategy A commercially viable technology or service Special attention was also paid to illustrating the dynamism of advanced security firms located outside the traditional high-tech triangle, Toronto, Montréal, and Ottawa. 10

11 8. Conclusions and Recommendations The growth of the advanced security sector in Canada is being driven by three key industry developments: A shift toward massification of the security market: Security technology is becoming more accessible to smaller business users. The end of the two solitudes : Convergence of physical and information security. A shift toward dematerialization of security: digital technology will solve the security paradox (openness vs. closure) by shaping a new paradigm based on dematerialization of all protection concepts. Recommendations: Security Requires Government Intervention Security is linked to the government by many links: public order is the secular role of the state. Commercial security is no exception. Government has a decisive role to play in at least four aspects of the development of the advanced security industry in Canada: Government Role No 1: A procurement partnership with SMEs. Governments should recognize the security sector and organize their departments to meet the industry s specific procurement needs. Government Role No 2: Standard setting. Governments should become more proactive is setting security standards and ensuring that they are enforced within the Canadian industry. Government Role No 3: Education and training. Governments should foster the development of a structured forum between universities, the private sector, and government. Government Role No 4: Transparency and obligation to report incidents. Governments should take steps to encourage transparency of reporting security incidents. Sales of the study at $320 per copy (paper format) complements the financing of the project. 11