RSA Conference review: vendors continue to miss the mark

For those who are used to seeing me post here, I have been writing more frequently to security vendor strategists rather than security & risk practitioners. I just posted on Forrester's Vendor Strategy blog about my impressions from RSA. You can read the unabridged version there, but here's the CliffsNotes:

1. End user attendance was way down, as was end user enthusiasm. Low buzz on the floor.
2. If you can spare the money and time, it's still a great place to go to see lots of vendors and talk with them in detail. For first level compare-and-contrast work in evaluating security products, the RSA Conference remains unparalleled.
3. Vendors never seem to get it. Two questions for you. First, "What's more important: security delivered in a cloud/SaaS model, or securing all your IT applications, systems, and interactions that are taking place in the cloud?" Seems simple, right? Not to vendors. The second question I know the answer to (thanks to our big data surveys we do) "What's more important, reducing cost or reducing complexity?" The complexity of security practice (of which cost is a manifestation but is by no means the sole issue facing security teams) looms like a dark cloud. It keeps you from focusing on strategic work, keeps products from working together, and it hinders greater IT and business initiatives.

If you went to RSA, I would love to hear your thoughts about the conference; I had no time to attend any of the sessions. I was hoping to sit in on a few (those that seemed decidedly not vendor pitches), but missed them all.

Anything stand out? Will you go next year?

Content Security Waves

After many months of work, we finally published the much-awaited content security Waves. On the Forrester SRM website, under the content security tab, you will be able to find three Wave documents: Email Filtering Wave, Web Filtering Wave, and Content Security Suites Wave.

 

We included ten vendors for all three Waves, Cisco Systems, Google, Marshal8e6, McAfee, Symantec/MessageLabs, Microsoft, McAfee/Secure Computing, Symantec, Trend Micro, and Websense. The intent of the Waves is to evaluate vendors who provide filtering functionality for multiple communication protocols (e.g., email, Web, and IM). Consequently, we did not include some of the pure-play vendors, such as Blue Coat Systems (for Web filtering) and Proofpoint (for email filtering), in the evaluations.

 

The evaluation of email filtering vendors revealed a mature market, characterized by strong appliance vendors with upstart cloud providers poised to win market shares. More specifically, we found that Symantec, Cisco Systems, and McAfee/Secure Computing lead the field because of their strong functionality and focused strategies. Google, Microsoft, Symantec/MessageLabs, and Websense are close behind with innovative cloud-based offerings. Trend Micro, Marshal8e6, and McAfee trail the field (see Figure1).

The evaluation of Web filtering market indicated a less than mature market, with

Websense and McAfee/Secure Computing lead the pack. Trend Micro, Cisco Systems, Symantec/MessageLabs, and McAfee are Strong Performers but fall short in certain areas of technology. Google, Marshal8e6, Microsoft, and Symantec lack either strong capability or cohesive vision, and trail the field (see Figure 2)

As the content security market continues to evolve, Forrester sees a growing market demand for consolidated content security suites rather than point products. In the third Wave, we evaluated content security suite offerings. The evaluation uncovered a budding market where only a small number of vendors reported adequate suite functionality. More specifically, we found that Websense leads the market because of its wide functionality and suite-oriented strategy. Symantec, McAfee/Secure Computing, and Trend Micro all have a clear strategy for product suites but are a notch down from Websense. Cisco, Symantec/MessageLabs, and Microsoft fall short in offering broad suite functionality. Google, McAfee, and Marshal8e6 trail the field for lacking either suite focus or comprehensive capabilities (see Figure 3).

To see the detailed evaluation criteria and vendor scores, please refer to the actual Wave documents: Email Filtering, Web Filtering, and  Content Security Suites.

 

Figure 1: Email Filtering

Figure 2: Web Filtering

Figure 3: Content Security Suites

The Top 5 Things We Think You’ll See At RSA

Trying to guess what will be HOT at RSA is always a fun game.  2009 promises to be different than most years as pure technology may not be the focus of this year’s show.  Attendance may be lighter and conspicuous consumption of new gadgets may no longer be in vogue.  We’ll know more come Tuesday, but in the meantime, here’s our guess as to what the big topics may be:

1.  It's the Economy, Stupid.

Every year the message is “buy our product and we’ll make you more secure.” Be assured that vendors still want your money, but budget-conscious CIOs and CISOs are changing the game this year. Expect a lot of messaging in 09 around the big financial Buzzronyms (buzzword+acronym) such as TCO and ROI. The smaller companies see an opportunity in this crisis. We anticipate that RSA will signal a much needed price war in the security space. Larger, more established companies may struggle to compete on price, especially if they are publicly traded. Stockholders hate seeing margins slashed. 

2.  The "Cloud" is a cool name.

The IT and Security marketing people finally got one right. The transition from a clunky, cumbersome acronym like SaaS to the ethereal, evocative term “cloud” probably has as much to do with the uptick in outsourcing security as any other factor.  et’s face it, “cloud” just sounds cool, as in: “Hey, let’s just send that to the cloud.” It makes it sound like you know what you’re talking about, whereas using the word “SaaS” always sounded like you were cursing. Plus, cloud services may sound right in an era of tight money, as these providers promise tremendous costs savings. Don’t get me wrong; IT security in general is horrible at branding. The last good brand in our business was the firewall, which resonated with customers. Today we have things like DLP, which we all know is really all just mirrors anyway, or SIEM, which is unpronounceable. Come on security marketers! A little originality please?

3.  If you've got money, we're listening.

The economic crunch is hurting security vendors. Many startups and even some established companies are mostly VC funded and those VCs need to get their money out pronto. Cash is king and companies with cash will find bargains out there as backers contemplate an exit strategy. Startups that turned down buyout offers just last year may be feeling seller’s remorse, as it may take a couple of years to get to the pricing levels we were at in Q3 '08.  I know of at least one big acquisition announcement planned for RSA and I anticipate others. Does the recent Sourcefire announcement with Symantec signal a potential acquisition? After all, SF has been an acquisition target for awhile now. Time will tell.

4.  It's easy being Green.

Green IT makes us feel warm and fuzzy. It is also the best buzzword bingo term to come out in a long time. There’s a bandwagon a rollin’ so expect security vendors to jump on it. Will green products make you more secure? Good question.

5.  Vendors love Compliance.

Expect PCI and other compliance initiatives to be pushed and promised all over the place. Compliance is great for consumers and vendors and a pain for corporations. There is nothing better than the big stick of compliance to force you to buy a product. Compliance is important as it incentivizes good security practices, but beware of over-hyped products that promise the moon. Caveat Emptor.

We’ll follow up in May and see how well our predictions worked out. Stay tuned and have fun at the show. Hope to see you there.

New Security and Risk Podcast - The GRC Technology Puzzle

It’s bad enough when your boss puts you on the spot about a recent project you’ve finished...it’s even more interesting when that conversation is recorded for the general public.

Listen to Research Director Rob Whiteley interview me about one of my recent reports in our new podcast, The GRC Technology Puzzle: Getting All The Pieces To Fit.

For those of you interested in why analysts write the reports they do and how they might have done things differently, our podcasts provide a behind-the-scenes look at what customer conversations, market trends, and other issues motivate our research.

This report specifically tackles the increasingly complicated GRC technology landscape, a market segment that includes literally hundreds of vendors vying for their share of corporate budgets. The highlight is a graphic that illustrates the different categories of technology available on the market and the distinct role they play in a broad GRC program.