Signal Hill Blog: Analysis & Perspectives

This year’s 21st RSA security confab, as in years past, saw a broad mix of early-to-mid stage vendors rubbing elbows with the world’s largest IT companies. There were many off-floor meetings, receptions and deal-making efforts, and the usual vendor initiative announcements. Themes of the day included: BYOD (for Bring Your Own Device/Disaster – an allusion to use of mobile devices at work); APT (Advanced Persistent Threats – super-bad malware used by rogue states and criminal rings); and Security Risk Management (tying security into the broader risk picture). Discussion keynotes ranged from big-picture (Tony Blair on the dangers of openness run amok, e.g. Wikileaks) to highly technical (the core of the conference), and even silly (what Darth Vader could have done better as the Empire’s CSO).

Walking around the floor and mingling at various receptions, we saw leading vendors from the 18 security subsectors we track all well represented. Traffic was high (perhaps not the highest we have seen over 12 years, but top 2-3) and enthusiasm was even higher. More than we have heard in recent years, exhibitors commented that they were actually signing up customers on the floor and seeing firmer business leads. Government customers were said to be much more visible than before.

What was evident from RSA is that the industry remains as vibrant as ever – probably more than ever. A primary reason for this is ‘Openness’ – pervasive collaboration online, Google-ization of IT, and mobility are eliminating computing silos and democratizing technology use, even at large enterprises. Everyone is becoming, in effect, their own IT administrator connectable to everything. All this has created a bonanza for vendors that secure privacy, manage access and protect digital assets. Our 2012 IT Security M&A report highlights growth in M&A momentum over the past year as big vendors (and PE firms) stock up on ‘openness enablers’ offering the greatest traction and most promising security technology.

While cloud, big data and interconnectedness are great positives, most news headlines mentioning IT security do so in the context of bad news. Recent surveys highlight a continuing rise in security vulnerabilities and breaches, confirmed by reports of major breaches – such as of Playstation, TJMaxx, U.S. DoD, and even RSA itself – and the list seems endless. A March 27 article in the WSJ (“U.S. Outgunned in Hacker War”) sums it up well, quoting the FBI’s assessment that “we’re not winning,” and that current security efforts are “unsustainable.” We believe the two-sided coin of positive advances in computing and rising security losses will fuel accelerated sector spending, investment and M&A this year and well beyond.

Discussions with exhibitors at RSA also highlighted the growing integration of security with other technology areas, including infrastructure management (notably cloud), business intelligence and applications. Vendors in all layers of the traditional IT stack are incorporating security as a key ingredient, and consequently, we are seeing more non-security vendors on the RSA floor offering security solutions, and we expect more to become acquirers.

If one were to sum up the lessons of RSA in a sentence, it would be that, “As technology becomes simpler, security becomes harder,” which suits the industry’s vendors just fine.

- Don More, Managing Director