This article originally appeared in Dark Reading
Money has poured into cybersecurity following high-profile breaches in recent years. The cybercrime industry could be worth $6 trillion by 2022 according to some estimates, and investors think that where there’s muck there’s brass. But like generals fighting the last battle, many investors are funding increasingly complex point solutions while buyers cry out for greater simplicity and flexibility.
Addressing this problem requires a radical shift in focus rather than a change of course. Vendors and investors need to look beyond money and consider the needs of the end users.
More money, more problems
London’s Infosec recently included over 400 vendors exhibiting, while RSA in San Francisco boasted more than 600. And this only includes those with the marketing budgets and inclination to exhibit. One advisory firm claims to track 2,500 security startups, double the number of just a few years ago. Cheap money has created a raft of zombie companies with little chance of IPO or acquisition, along with an even greater number of headaches for CISOs trying to make sense of it all.
The market is creaking from this trend, with Reuters reporting M&A down 30% in 2017 even as VC investment increased by 14%. But the real pain is being felt by CISOs trying to integrate upwards of 80 security solutions in their cyber defences, as well as overworked analysts struggling to keep up. The influx of cash has also caused marketing budgets to spike, leading to a market where it is deemed acceptable for increasingly esoteric products to be promoted to CISOs as silver bullets.
All of this feeds into a sense of “product fatigue”, where buyers are frightened into paying for the latest black box solution, only for their blood pressure to further spike when they find that they don’t have the necessary resources to deploy or support these tools. This situation does not benefit any of the parties – the overwhelmed CISO, the overly-optimistic investors or the increasingly desperate vendors who find themselves caught in limbo between funding rounds when their concepts weren’t fully baked to begin with.
Addressing complex modern threats calls for sophisticated tools and products, but we cannot fight complexity with complexity. SOC teams cannot dedicate finite analyst capacity to an ever-expanding battery of tools. Fragmentation within the security suite weakens company defences and the industry as a whole, and the drain on analysts’ time detracts from crucial areas like basic resilience and security hygiene.
Platforms, not Products
The industry doesn’t need more products, companies or marketing hype. We need an overhaul of the whole approach to security solutions, not an improvement of components. Security should be built on platforms with a plug-and-play infrastructure that better supports buyers, connecting products in a way that isn’t currently possible.
Such platforms should be flexible and adaptable, rewarding vendor interoperability while punishing niche solutions that cannot be easily adopted. This would lead to collaboration within the industry and create a focus on results for end users, rather than increasingly blinkered product road maps. Such platforms could act as a magnifying glass for innovation, providing a sandbox to benchmark new technologies and creating de facto security standards in the process.
This move from proprietary architecture to open modular architecture is a hallmark of Clayton Christensen’s Disruptive Innovation theory, and it is long overdue within the security industry. Buyers will have greater control of their tech stacks, while vendors and investors will get to proof of concept faster and see greater efficiency within the market.
One example of such a platform is Apache Metron, an Open Source Security platform which emerged from Cisco. Metron has been adopted by a number of major security providers and provides us with a glimpse of what the future of security should look like.
Collaborating, creating industry standards, or making technologies Open Source does not mean vendors can’t make money; in fact the reverse is true. Customers will be more willing to invest in security solutions that they know are future proofed, that don’t come with the dreaded “vendor lock-in”, and that simplify rather than further complicate their architecture.
Like all of security, there are varying degrees of risk and reward, but this approach is starting to look like the only logical future in an increasingly frothy, confusing and low ROI field. There will be a correction in the security market, whether it is in a month or a year. The fundamentals that will cause this are already evident, so there is an excellent opportunity to learn the lessons in advance and minimise the pain by contributing towards the platforms of the future.