Prediction 2003: Security Software Growth Slows

Transcription

1 Dataquest Predicts Prediction 2003: Security Software Growth Slows Abstract: The security software market will decline from 10 percent growth in 2001 to only 6.7 percent growth in 2002 as prospects for a surge in IT spending won't occur until mid By Norma Schroder, Fabrizio Biscotti and Colleen Graham Strategic Planning Assumptions By 2006, new license revenue in security software will grow by half (0.7 probability). In 2006, the top 5 security software best-of-breed vendors will collectively lose share to NSM titans, most of which are expanding their footprint in security management software (0.8 probability). By 2006, intrusion detection, firewall and antivirus software markets will cease to exist as independent markets and will converge into one or more of the following a new security software suites market, the existing NSM availability and performance software suites market and the existing networking equipment market (0.7 probability). By 2006, security auditing software products and identity management software products will converge with NSM configuration management and provisioning products, which will perform life cycle configuration of security devices and user access rights, including parameter and user initialization, auditing, tracking, correcting and updating (0.7 probability). Publication Date: November 13, 2002

2 2 Prediction 2003: Security Software Growth Slows Prediction: Market Drivers Strong, but Inhibitors Slow Growth Into 2003 When all the 2002 results for vendors roll in this January, the expectation is for security software growth to slip to 6.7 percent (down from 10 percent in 2001) in terms of new license revenue. The weakening growth performance can be attributed to stagnant business investment. Despite heightened buyer interest in improving security after Sept. 11, little panic buying has occurred in the enterprise segment or even in the government segment. A boomlet did not materialize. A revival of security software spending is not expected until mid In the meantime, during the tight IT budgets of 2002 and into 2003, IT departments are expected to spend on smaller security projects with a fast payback, low implementation overhead and staged pay-as-you-go deployment. In addition, appliances and managed service providers are expected, on the margin, to gain share in security user spending at the expense of security software vendors. These factors will limit the security software market's revenue upside in the short term and perhaps longer. By 2006, new license revenue in security software will grow by half. Impact on 2003 Increased competition will lower average deal size and cause multistage deployments. In the small and midsize business (SMB) space, buyers will find individual modules of software suites from known security specialists attractive. But, in 2003, appliances and managed security service provider (MSSP) substitutes will limit the opportunity for software only SMB solutions. Reacting to 2003 Security software vendors should continue to adjust their costs to prepare for low revenue gains in Vendors can exploit heightened buyer interest in becoming security certified by leading with security audit offerings that identify security holes. Vendors should then follow through with remediation and management products and services. Vendors should plan on selling more small chunks in a multistaged rollout by repackaging and repositioning any monolithic products as multiple modules where feasible. Security vendors should focus on verticals or geographies that are holding up during current economic doldrums. The public, healthcare, housing and consumer goods sectors are counter-cyclical at this time. Most of Asia/Pacific is less affected by the downturn, and efforts to increase sales there could provide returns.

3 Prediction: Dominance of the Top 5 Security Software BOBs to Erode Consolidation will occur in security software. But, not all the largest security best-of-breeds (BOBs) will be doing the consolidating. The expectation is that, in general, network systems management (NSM) titans or dark horses will have that role. In 2006, the top 5 security software BOB vendors (which had the largest revenue in 2001) will collectively lose share to NSM titans, all of which are expanding their footprint in security software. Impact on 2003 Merger, acquisition, divestiture and demise (MADD) activity will significantly intensify. Vendors must anticipate aggressive entry in the security space by NSM and other vendors attracted by the relatively high revenue growth prospects. Larger security vendors are best positioned to sustain themselves by cross-selling from their portfolios of modules to their installed base. New customers are scarce. Reacting to 2003 Large security vendors should continue to spend on research and development (R&D) and integration of any acquisitions to be positioned strategically to compete with NSM titans with an even broader portfolio of offerings. NSM vendors need to invest in marketing themselves to enterprise buyers as an equivalently credible choice for security needs as a BOB. Smaller security BOBs should seek partners to create virtual suites or to increase indirect sales through original equipment manufacturer (OEM) relationships. Prediction: Intrusion Detection, Security Auditing, and Identity Management Are Convergence Markets Ironically, as network infrastructure becomes more intelligent and the "smarts" of security software improves during the next few years, security administrator head count may dwindle in the enterprise because the function may be pulled back to its systems and networking roots. The questions are how fast will it happen and which vendors in the IT infrastructure ecosystem will capture the most revenue from providing security? 3

4 4 Prediction 2003: Security Software Growth Slows By 2006, the intrusion detection (IDS), firewall and antivirus software markets will cease to exist as independent markets and will converge into one or more of the following a new security software suites market, the existing NSM availability and performance software suites market or the existing networking equipment market. By 2006, security auditing software products and identity management software products will converge with NSM configuration management and provisioning products, which will perform life cycle configuration of security devices and user access rights, including parameter and user initialization, auditing, tracking, correcting and updating. Impact on 2003 Up to 50 percent of the user spending in 2003 on network IDS-based packet inspection and signature detection IDS will be embedded in network equipment and appliances. Auditing, identity management and provisioning software is expected to go from its current infancy stage (characterized by bleeding-edge technology pure plays) to becoming acquired functionality that is incorporated into offerings from NSM software and systems and network hardware vendors. In 2003, growth of SMB security outsourcing will continue to grow. Within a decade, 90 percent of SMBs will outsource regular auditing, access management, firewall and intrusion detection to their MSSP, which is many cases, will be their Internet service provider (ISP), their Web-site hosting service provider or their PC provider. For more information, please see the Gartner Dataquest Perspective "Security for SMBs: The Outsourcing Option (ITSV-WW-DP-0244). Reacting in 2003 If you are a security software startup or small pure play with less than one year's cash, consider selling out before being bought out. If you have a general release product, and at least some production customers, you have assets that will fetch a better price now than next year. If you are a security software startup or small pure-play with less than one year's cash with an auditing product, sell your product to service companies that need it to provide a service (security audit specialists, desktop migration specialists or server consolidation specialists). It's not just security value-added resellers (VARs) that will want to sell auditing. It would be a good item for a consultant to add to a desktop migration project or file server migration project. If you are a large security software specialist, borrow a page from NSM systems vendors. Broaden your portfolio of offerings with application specific security modules that know about vulnerabilities and misconfigurations in typical practice (for example, Oracle, SQL Server, Siebel, SAP and others). An application-specific solution is highly salable because it focuses on the customer's exact pain point within a specific application or platform.

5 5 Bottom Line In 2003, IT wallets will still be hard to pry open very far for security, except after a breach. Large NSM vendors will enter this market with their policy management know-how as they try to round out their offerings across the entire distributed NSM, storage and security management stack. For a management titan, if you aren't complete, you can't compete. Smaller security management software vendors face an uphill battle in gaining awareness with enterprise buyers. Use telesales, Web downloads, and equipment and applications partners to bundle free samples. For more information, please see the Gartner Dataquest Perspective "Now Is the Time to Market Software" (SOFT-WW-DP- 0082). Smaller BOBs in security systems software should consider offering their products for private branding resale by other systems and application independent software vendors (ISVs). Selling to a small group of ISVs is less costly than trying to market to a disparate market of end-user enterprises. All vendors should refine marketing and sales programs for smaller chunks, staged deployments and lower approval levels. Focus on counter-cyclical verticals and regions, such as healthcare, government, and Asia/Pacific. Longer term, all vendors must position for a future where security software splits into a systems side and a management side. On the systems side, BOBs will sell software, such as encryption, as an OEM specialty product to systems and application ISVs. On the management side, the established management software vendors have the installed base and deep pockets to win most of the mind share of the enterprise security buyer. Key Issues How is the competitive landscape of this market going to change? What are the future growth prospects for this Industry?

6 6 Prediction 2003: Security Software Growth Slows This document has been published to the following Marketplace codes: SOFT-WW-DP-0112 For More Information... In North America and Latin America: In Europe, the Middle East and Africa: In Asia/Pacific: In Japan: Worldwide via gartner.com: Entire contents 2002 Gartner, Inc. All rights reserved. Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice