Dizzying Days for Security Outsourcers

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Outsourcing network security is a fast-growing trend, and the sector developing to manage all security functions for businesses is undergoing tremendous change — both positive and negative.

So-called “managed security service providers” (MSSPs) are attracting customers eager to pass off to specialists the oversight of firewalls, virtual private networks, and software for the detection of viruses and security breaches. IT consultants Frost & Sullivan estimate that the domestic MSSP market — which claims to provide better security at much lower rates than companies can do themselves — will grow by a factor of 12 in the next six years, from $166 million to more than $2 billion by 2007.

As in the crazed late-1990s, which saw IT companies race to enter expanding markets like consulting, business-to-business exchanges, and telecommunications infrastructure, new companies are charging into the field. This spring saw three businesses, security consultants Securify and RipTech along with networking giant Cisco, jump into the MSSP game.

At the same time, the inevitable shakeout from an overly crowded field has already started. With customers still gingerly testing the waters, especially in the wake of the IT economic slowdown, two early entrants into the market, Pilot Networks and The Salinas Group, have turned away from MSSP services and are refocusing.

“Clients are expected to outsource security in droves as they begin to realize that no magic plug-and-play security solutions exist,” said Jason Wright, Frost & Sullivan’s security technologies program leader. “But MSSPs without sound business models may get out of the market almost as quickly as they got in.”

Among services offered by MSSPs: monitoring of Internet and intranet traffic to report unusual network traffic, firewall breaches, or other events. While such firewall monitoring contracts start at better than $2,000 for each network server and can cost far more than $100,000 a year, that can prove cheaper than hiring a couple of technicians (for smaller companies) or a team (for larger ones).

Not long ago, most larger businesses were assumed to want to keep their own security in-house. But that’s been largely disproven, especially among early adopters such as financial service and insurance firms, health care companies, government agencies and manufacturers.

Analysts say Cisco entered the arena in order to expand the market for its network equipment, providing the hardware equivalent of “plug-and-play” software as its consultants can manage security infrastructure (firewalls, VPNs, and intrusion detection systems) for which businesses have just paid tens or hundreds of thousands of dollars. Cisco also plans to jointly market services with other security businesses that are part of its vendor program.

Such agreements could be a key as customers evaluate which MSSP is right for them. Among the major players in the field are Counterpane Security, Foundstone, Internet Security Systems, OneSecure, RipTech, and TruSecure.

Wright said, “Some of the most important competencies illustrated by leading market participants are synergistic partnership agreements, proprietary data mining technology, a modest expansion strategy, and solid funding.”