THREAT INTELLIGENCE EXECUTIVE OVERVIEW. A Market for Secrets KEY FINDINGS

Transcription

1 A Market for Secrets As the arms race escalates between attacker and defender, organizations are trying to make more informed risk decisions and prioritize their responses. This means intelligence and not just more data, but better information behind it. The threat-intelligence market has blossomed in the past year, but is still inchoate and confusing to vendors and customers alike. This report provides an overview of the many facets of threat-intelligence products and services, identifies major trends and looks at the market size and M&A implications. KEY FINDINGS Out of 55 vendors we examined, nearly all of them offered at least three of the most common data elements (hash values, IP addresses and domain names); only half of them offered more complex types of intelligence. For this reason, we see signs of a potential bifurcation in the threat-intelligence market between the easily collected and standardized data, and the more sensitive and costly information. In the case of an intelligence-sharing platform, the vendor s challenge is to build a community of members that are incentivized to trust one another. Trust usually happens between individuals, not organizations. As a result, the sales cycle of a collaboration membership can be much longer than that for a one-way data feed, and the intelligence flow can be easily disrupted. With 36% of respondents saying they were using threat intelligence and a further 8% stating that it was in their plans, we see some modest growth (in the previous year, the in-use rate was 31%). Those who do have it are planning to spend somewhat more on it. From 2012 to 2013, the four leaders in mindshare remained the same: Symantec, IBM, Dell and McAfee. FireEye came out of nowhere to take the fifth spot among vendors in use in 2013, passing homegrown. We estimate that the aggregate revenue generated by the 43 stand-alone threat-intelligence vendors we have identified totaled $1.0bn in 2013 and will grow at a CAGR of 34% to reach $3.3bn in FEBRUARY 2014

2 REPORT SNAPSHOT TITLE Threat Intelligence ANALYST Wendy Nather Research Director, Security RELEASE DATE February 2014 LENGTH 32 pages ABOUT THIS REPORT Threat intelligence is one of the oldest new markets around. We believe it is becoming such an open market now because of several factors, including the rising awareness of widespread security breaches, which makes enterprises realize that no one is safe, the development of more techniques in big data and analytics, and the increasing numbers of security researchers and investigative methods for identifying threats. In this report, we examine threat intelligence as a market: how it is generated, processed and sold. We look at the most frequent types of data sold as threat intelligence, the buyer s view of the offerings and the unique factors that can affect vendors. We also propose a set of criteria by which enterprises can evaluate threat intelligence products and services.

3 TABLE OF CONTENTS SECTION 1: EXECUTIVE SUMMARY INTRODUCTION KEY FINDINGS METHODOLOGY AND SCOPE SECTION 2: THE DANGER IN DEFINITIONS WHAT IS? THE DIVIDING LINE SECTION 3: DECONSTRUCTED SOURCES OF COLLECTION OF FORMS OF DELIVERY APPLICATION OF AND THE PYRAMID OF PAIN Figure 1: The Threat Intelligence Pyramid of Pain A (NEARLY) PYRAMID-SHAPED MARKET Figure 2: Number of Vendors Offering Each Type of Threat Intelligence Data SECTION 4: ASPECTS OF THE THREAT-INTELLIGENCE MARKET ADDITIVE SECRETIVE TRANSITIVE ELUSIVE SECTION 5: WHO S USING (OR AT LEAST THINKS THEY ARE) SURVEY SAYS Figure 3: Security Management Technology Roadmap, Figure 4: Technology Roadmap Plans for Threat Intelligence, Time Series.. 21

4 Figure 5: Vendors Named in Threat Intelligence INTERPRETING THE RESULTS MAIN DRIVERS FOR PURCHASING STRENGTHS AND WEAKNESSES OF SECTION 6: MARKET SIZING FOR 26 Figure 6: Market-Sizing Feature Definitions Figure 7: Threat-Intelligence Vendors Pure Play Figure 8: Threat-Intelligence Market Revenue* SECTION 7: THREAT-INTELLIGENCE EVALUATION CRITERIA 29 SECTION 8: SUMMARY AND CONCLUSIONS 32 INDEX OF COMPANIES 33

5 ABOUT 451 RESEARCH 451 Research is a leading global analyst and data company focused on the business of enterprise IT innovation. Clients of the company at end-user, service-provider, vendor and investor organizations rely on 451 Research s insight through a range of syndicated research and advisory services to support both strategic and tactical decision-making Research, LLC and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publication, in whole or in part, in any form without prior written permission is forbidden. The terms of use regarding distribution, both internally and externally, shall be governed by the terms laid out in your Service Agreement with 451 Research and/or its Affiliates. The information contained herein has been obtained from sources believed to be reliable. 451 Research disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although 451 Research may discuss legal issues related to the information technology business, 451 Research does not provide legal advice or services and their research should not be construed or used as such. 451 Research shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.