The other day another article discussing the venture capital industry arrived in my inbox. It was from John Batdorf, a banker with Viant Capital I’ve worked with over the years and someone whose opinion I respect, so I paid attention. However, with the title “Is venture capital failing to keep the security ecosystem afloat?” I didn’t really need much prodding. Overall, the article touches on the topic we’ve been raising for some time now: while the attacks are all the more sophisticated, the investment dollars are in decline. Essentially the supply vs. demand equation for security is completely out of whack. This is not good. The reasons for this are numerous, but rather than turn this blog into an industry report we want to highlight the implications of this scenario as it pertains to the user community.
We strongly urge buyers not fall into the easy trap of
ignoring the privates over this one issue. There are plenty of healthy, viable,
and valuable private companies offering security protection. There are also plenty
of "dogs" on their last breath. Identifying the dogs is key; dumping the entire
market segment out the window because investors are less enthusiastic is flat
out wrong. How to separate the dogs is the challenge -- and we’re here to help,
of course.
Let’s look at the vulnerability management space as a proxy. We chose this space as most every organization knows it well enough. Sure there are the big dogs offering a scanning capability, but is IBM really going to invest in the acquired ISS scanner? My guess is that it’s not likely. So the classic “safe” move is not really a good one.
Instead, look at the private market: there are at least three companies we are very familiar with that have all done well – and from very different approaches. Core Security, Tenable, and Qualys each have a different approach to the market, ranging from comprehensive efficient capability to proven open source adaptation to SaaS (software/security as a service).
They each have different financing and expense structures -- from international development to solid venture backing to no VC needed -- but fundamentally they are each providing real value to their clients. Yes, they all do more than just pen testing and that certainly has helped the companies grow, but the point is simply that private companies are doing well even in these toughest of times.
Yes, it is tough out there and every buyer needs to have a higher level of scrutiny. But that applies to every vendor – from the brand new start up asking you to be a beta customer to the largest of the publicly traded guys, no one is immune from the harsh economic realities. In fact, the risk of working with a larger vendor could be higher than with the startup; in security, if the product doesn’t work, it’s you who may be in economic trouble.
Comments