2016 Trends in Information Security

Transcription

1 PREVIEW 2016 Trends in Information Security DEC 2015 Scott Crawford, Research Director Garrett Bekker, Senior Security Analyst Eric Ogren, Senior Security Analyst Adrian Sanabria, Senior Security Analyst Information security spending continues to grow, but not without some unwelcome headwinds for security s major incumbents. A host of startups offer new alternatives and their valuations are going through the roof. Regardless, major players are embracing key domains such as cloud security, but enterprises continue to face challenges in sourcing expertise Research, LLC

2 ABOUT 451 RESEARCH 451 Research is a preeminent information technology research and advisory company. With a core focus on technology innovation and market disruption, we provide essential insight for leaders of the digital economy. More than 100 analysts and consultants deliver that insight via syndicated research, advisory services and live events to more than 1,000 client organizations in North America, Europe and around the world. Founded in 2000 and headquartered in New York, 451 Research is a division of The 451 Group Research, LLC and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publication, in whole or in part, in any form without prior written permission is forbidden. The terms of use regarding distribution, both internally and externally, shall be governed by the terms laid out in your Service Agreement with 451 Research and/or its Affiliates. The information contained herein has been obtained from sources believed to be reliable. 451 Research disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although 451 Research may discuss legal issues related to the information technology business, 451 Research does not provide legal advice or services and their research should not be construed or used as such. 451 Research shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice. NEW YORK SAN FRANCISCO LONDON BOSTON 20 West 37th Street 3rd Floor New York, NY P F Geary Street 9th Floor San Francisco, CA P F Gower Street London, UK WC1E 6HH P +44 (0) F +44 (0) Liberty Square, 5th Floor Boston, MA P F II

3 About the Authors SCOTT CRAWFORD RESEARCH DIRECTOR Scott Crawford is Research Director of the Information Security practice at 451 Research, where he leads coverage of emerging trends, innovation and disruption in the information security market. Well known as an industry analyst covering information security prior to joining 451, Scott s background includes experience as both a vendor and an information security practitioner. GARRETT BEKKER SENIOR SECURITY ANALYST Garrett Bekker is a Senior Analyst in the Enterprise Security Practice at 451 Research. He brings a unique and diverse background, having viewed enterprise security from a variety of perspectives over the past 15 years. Garrett spent more than 10 years as an equity research analyst at several investment banking firms, including Merrill Lynch, where he was the lead enterprise security analyst, in addition to covering infrastructure software and networking companies. ERIC OGREN SENIOR SECURITY ANALYST Eric Ogren is a Senior Analyst with the Information Security team at 451 Research. Eric has extensive experience in software development, technology marketing, and as a security industry analyst. Prior to joining 451 Research, Eric held marketing leadership positions with security vendors such as RSA Security and OKENA, and technology vendors such as Digital Equipment. ADRIAN SANABRIA SENIOR SECURITY ANALYST Adrian Sanabria brings a broad perspective on security to 451 Research, drawing on more than 12 years of enterprise security experience. With a background in system administration and system architecture, he was the security architect and chief incident handler for Elavon, one of the largest payment processors in the US. III

4 Key Findings While the security market continues to grow, major incumbents may be experiencing unexpected headwinds in the face of new startups and product categories responding to enterprise demands for more effective security. The stratospheric valuations of many startups, however, don t just trouble incumbents looking to acquire. They may pose a risk to the market as a whole. SaaS security is finally coming into its own as major vendors take the plunge into markets such as cloud application control. The shortage of skilled and experienced security personnel continues, but it also introduces new opportunities for specialized security services to help close gaps. IV

5 Executive Summary 2016: THE CHANGING OF THE GUARD As technology continues to expand in multiple directions, so does the security challenge. But there is more to the continuing demand for security technology than simply riding the coattails of IT evolution. According to data maintained by the Privacy Rights Clearinghouse, the number of records breached has continued to grow over each of the past four years but 2015 s figure is already more than double the number for all of Thus, a paradox emerges: While security spending remains high, so do security breaches. At the same time, IT is undergoing a tectonic shift driven by cloud, mobility, analytics and the emerging implications of the Internet of Things (IoT). But the growing seriousness of cyber threats lurks behind them all, coloring the bright promise of innovation with the darker reality that new developments also mean new opportunity for those who are only restrained by what they can t get away with. The bad news for some: The security techniques to which we ve become accustomed may not translate so well if at all to these new ways to do IT. Clearly something needs to change. For years, compliance has been a principal driver for information security spending. Today, however, organizations recognize that they really do need to be secure and they are demanding both technologies and expertise that go beyond legacy approaches to get the job done. This sense of the changing of the guard in security has become palpable in Our expectation is that it will manifest in a number of ways in In this report, we take a look at the evidence we re beginning to see that suggests the impact on security s major incumbents. We also examine some of the harbingers of change that, taken together, factor into this supertrend unsettling the status quo. But change is not always pretty and can sometimes be outright painful. One of the trends we expect to continue into 2016 is both a cause and an effect of the demand for better security: an ongoing shortage of qualified security expertise. But one person s crisis is another s opportunity, and in considering the bottleneck organizations face in cultivating the security skills they need, we also explore the opportunity it presents to providers of security services. As organizations continue to wrestle with fundamental changes in the nature of enterprise IT and as they look ahead to a future filled with intelligent things everywhere we may be seeing only the very beginnings of the change we expect. This report presents the trends we see shaping information security in the coming year. V

6 2016 TRENDS IN INFORMATION SECURITY 451 Research s 2016 Information Security Trends Source: 451 Research, 2015 Incumbents That Don t Innovate Will Stagnate Seismic Shifts and Shorter Innovation Cycles Will Rock the Security Status Quo The Big Boys Will Move Further into Cloud Security There Are Still Not Enough Skilled People and It s Not Getting Better Change Will Bring New Opportunities for Services-Based Delivery Winners Startups that capitalize on multiple trends to support a comprehensive value proposition; vendors that can integrate as well as innovate Post-AV vendors that go after AV certification and are able to replace the incumbents; vendors that translate insight into action; vendors that recognize that software security extends well beyond application testing; companies that are able to successfully purge or transfer liability for data protection to third parties Established cloud application control (CAC) vendors; cloud-wary enterprises Vendors able to offer flexible options for enterprises that need them; enterprises able to train and promote within and/or create internship programs to identify budding talent Cloud-friendly product vendors; hightouch product vendors; resourceconstrained enterprises Losers Vendors that don t move quickly on acquisitions in burgeoning markets; vendors that can t overcome their legacy; startups left behind after acquisitions of leading players in a given space Incumbents that don t get products to market that compete well against challengers before significant customer base is lost; companies that choose to wait and see or don t perform thorough data discovery assessments Vendors that only offer a single product; incumbent security vendors slow to respond to the rise of cloud computing; CAC startups with unrealistic valuations Enterprises that fail to determine where security efforts are wasted and where they can be better spent; vendors that cling to one particular architecture, sales or services model Traditional MSSPs that fail to adapt; incumbents slow to package their products for services-based delivery METHODOLOGY Reports such as this one represent a holistic perspective on key emerging markets in the enterprise IT space. These markets evolve quickly, though, so 451 Research offers additional services that provide critical marketplace updates. These updated reports and perspectives are presented on a daily basis via the company s core intelligence service, 451 Research Market Insight. Forward-looking M&A analysis and perspectives on strategic acquisitions and the liquidity environment for technology companies are also updated regularly via Market Insight, which is backed by the industry-leading 451 Research M&A KnowledgeBase. Emerging technologies and markets are also covered in additional 451 Research channels, including Business Applications; Cloud and IT Services Markets; Data Platforms and Analytics; Datacenter Technology; Development, DevOps and IT Ops; Enterprise Mobility; European Services; Information Security; Internet of Things; Mobile Telecom; Multi-Tenant Datacenters; Networking; Service Providers; Storage; and Systems and Software Infrastructure. Beyond that, 451 Research has a robust set of quantitative insights covered in products such as ChangeWave, Voice of the Enterprise, Market Monitor, the M&A KnowledgeBase and the Datacenter KnowledgeBase. All of these 451 Research services, which are accessible via the Web, provide critical and timely analysis specifically focused on the business of enterprise IT innovation. For more information about 451 Research, please go to: VI

7 Table of Contents TRENDS 1 Trend 1: Incumbents That Don t Innovate Will Stagnate 1 Figure 1: As Security Product Revenues Grow, the Largest Incumbent Vendors May See the Rate of Growth Dampen RECOMMENDATIONS WINNERS LOSERS Trend 2: Seismic Shifts and Shorter Innovation Cycles Will Rock the Security Status Quo 4 POST-AV ENDPOINT VENDORS STAND READY ON THE BATTLEFIELD S EDGE, BUT THE INCUMBENTS HAVE YET TO DON THEIR ARMOR MORE THAN EYE CANDY: PUTTING SECURITY ANALYTICS TO WORK TAKING IT TO THE STREETS: SOFTWARE SECURITY EXTENDS UPWARD THROUGH THE SUPPLY CHAIN, OUTWARD THROUGH A PROFUSION OF THINGS (UN)SHARING IS CARING WHEN IT COMES TO DATA RESIDENCY RECOMMENDATIONS WINNERS LOSERS Trend 3: The Big Boys Will Move Further into Cloud Security 7 Figure 2: More Vendors Have Entered the SaaS Security Market as They Recognize Its Importance RECOMMENDATIONS WINNERS LOSERS Trend 4: There Are Still Not Enough Skilled People and It s Not Getting Better 10 Figure 3: Information Security Number of Employees RECOMMENDATIONS WINNERS LOSERS VII

8 2016 TRENDS IN INFORMATION SECURITY Trend 5: Change Will Bring New Opportunities for Services-Based Delivery 12 RECOMMENDATIONS WINNERS LOSERS THE LONG VIEW 14 FURTHER READING 15 INDEX OF COMPANIES 16 VIII