“While the existing services have managed to attract a number of important clients and demonstrate the validity of the hosted MSS model, the expected growth in this market is not likely to come from selling e-mail and Web security services alone,” states Frost & Sullivan Programme Manager Jose Lopez. “The future growth in this market is anticipated to come from additional security services such as firewall and intrusion prevention services that are already popular CPE-based services.“
In 2008, Frost & Sullivan expects to witness a stronger commitment from this type of MSSPs that will start to offer these services to a larger audience. Therefore, the growth witnessed in the past few years is likely to be sustained by the introduction of new services and stronger commitment from MSSPs, which will drive the market in the region until 2013.
There has been an important level of consolidation in the market in 2007, especially with the entry of Google after its acquisition of Postini, and Websense's acquisition of SurfControl. This adds to Microsoft's entry in this market with the acquisition of Frontbridge Technologies in 2005.
“The entry of companies such as Google and Microsoft validates a market that has been questioned in the past as many were sceptical about the feasibility, profitability and market acceptance of the hosted MSS model,” observes Lopez. “While these have been the most significant moves in the industry, further consolidation is expected and any of the specialist hosted MSS vendors could be attractive acquisition targets for a larger IT or telecom vendor wanting to enter this market or complementing its services portfolio.”
The current market structure is likely to change in the coming years as demand for hosted services gains relevance. While the focus of the existing hosted security services is almost entirely on providing a clean pipe for end users, primarily around e-mail security services, many other security services can also be delivered in the cloud.
The type of competitors is also poised to change in the future with telecom and network services providers taking over from specialist MSSPs. Given the scale and performance issues, only telcos will have the capability to fully exploit the hosted model for the delivery of large scale multi-services. Therefore, specialist MSSPs should consider partnering with these vendors rather than entering into the market on their own.
“Large IT and telecom service providers are expected to be major providers of hosted security services in the future,” explains Lopez. “These companies have the capability to bundle hosted security as part of a bigger IT outsourcing deal or network service package which provides stronger value proposition and cost savings.“
Other than in-house capabilities, these participants are more likely to utilise specialised hosted security providers or pure-play MSSPs who provide management services for the security devices hosted by the telecom/IT service providers. Although pure-play, CPE-based MSSPs such as VeriSign already have some minor hosted services or are planning to provide them, they are most likely to offer them as back-end providers in the above-mentioned arrangements and as peripheral offerings to some direct customers.
“However, the hosted MSS model continues to encounter significant challenges at this point in the lifecycle” cautions Lopez. “The challenge of establishing and maintaining the trust of existing and potential clients alike is, therefore, paramount to the future of the industry as a whole although this restraint will gradually be reduced over the next few years by ongoing consolidation with the presence of well-established IT and telecom vendors.“