Are there too many cybersecurity companies?

The most potent global threat in 2018 may not be armed conflict or civil unrest, but cybersecurity.

While cybersecurity awareness has increased with high profile breaches in recent years, the core problem remains of how industries can protect themselves and their customers when so much of our interaction has gone digital. Here are some predictions for the challenges companies may face in 2018:

There are too many security vendors, and many of them will go out of business

I recently spoke with several CISOs from major companies about their needs from specialized threat analysis and protection vendors. I learned a surprising fact: these organizations averaged over 80 security vendors helping to protect them.

That may sound like an enviable position; so many vendors providing protection for a company’s business efforts. But it signals that there is too much noise in the market. CISOs don’t want to manage 80 products — they want to have a holistic solution involving fewer vendors.

As companies struggle against the rapid expansion of attack surfaces and increasingly sophisticated attacks, there are over 200 threat analysis and protection vendors in network security alone that have raised capital. But unless these vendors cover one of those new attack surfaces and are well-integrated into the overall process management of an enterprise, they are not helping CISOs.

In 2018, I expect CISOs to reduce the number of security vendors at their companies by at least 20 percent, leading to one quarter of these specialized companies going out of business or being acquired for $50 million or less.

Changing architecture will continue to open up security opportunities for big companies

Every major vendor understands cloud computing problems, but Microsoft has been leading the way recently. In 2018, I predict Microsoft will make significant security acquisitions, positioning itself as a major vendor most focused on enterprise security.

Customer demand in the digital economy has been evolving for several years now. This has required enterprises to build faster and more efficient data centers, changing from outdated, stovepipe systems to leveraging new and exciting architecture technology like containers, microservices and serverless solutions.

Although pushing data and connecting to business partners in the cloud gives companies scalable, cost-saving solutions, it also requires an entirely different form of cybersecurity. A company like Palo Alto Networks — which does a great job of protecting at the perimeter — will need to reinvent themselves for these new areas.

Expect major executive departures in 2018 as high-profile breaches intensify

Advances in technology provide fascinating and powerful tools, but they also give attackers an advantage over enterprises. As the companies diligently research and protect all of their endpoints and vulnerabilities, the attackers only need to find one vulnerability to exploit.

This problem becomes incredibly complex for CISOs because the attack surface has expanded so greatly in recent years. With every new device consumers use to log into accounts and conduct real transactions — laptops, desktops, mobile phones, and so on — that provides a new contact point.

The advance of the Internet of Things (IoT) then complicates the problem exponentially. More data is being used in homes through connected televisions, appliances and technologies like Nest. The workplace is no different — everything right down to the printer creates new attack surfaces.

In this race, the attackers have the advantage. Because of that, we will see the recent slate of high profile breaches continue into 2018, and I foresee several more public company CEOs losing their jobs over the security failures.

Specialized threat analysis and protection vendors will provide integrated, holistic solutions

Standard procedure is for enterprises to contract with large vendors like McAfee or Symantec and enhance those with small, specialty vendors. However, in recent years companies have started focusing on holistic efforts, finding vendors they can integrate into overall process-oriented solutions. These holistic solutions must address key new attack surfaces and solve specific problems.

In the arena of network security, I have an investment in ForeScout which not only solved the network visibility issue that all enterprises have, but is also well positioned to address the new threats associated with the IoT.

I believe we will see increased adoption in 2018 of integrated threat analysis and protection vendors like ForeScout, AlienVault in security information and event management, CounterTack in endpoint security through MSSPs and Zscaler in cloud security. Of the above, AlienVault is one of my prior investments, but I see opportunity from other startups and established vendors to provide a more holistic security solution.

It may be tempting to just add money and players to the space, but I believe the industry needs to change, and quickly. Increasing the number of vendors will not automatically raise the quality of protection, and we need integrated solutions to help combat a problem the size and scope of cybersecurity. Although the demand for cybersecurity will only increase in the foreseeable future, smart investors should be looking for vendors that will reduce the noise.