Marktkommentar #3: The SIEM/XDR Market Continues to Consolidate

In my view, this leads to the following conclusions:

• Compared with normal fluctuations in business life, the impact of a cyber attack is usually negligible. Take MGM Resorts, for example: it sounds bad at first, damage amounting to EUR 90 million. But MGM made a profit of more than EUR 1 billion 2 years before that. And 3 years before that, it made a loss of EUR 1 billion (I guess due to corona). In other words, the cyberattack was almost irrelevant in terms of profits.
• Evotec and Maersk also made losses in the year before the respective attacks
• In relation to the turnover of a single year, the effects of the damage are in some cases only rounding errors. If you assume 5% of sales for the worst case, you are on the safe side.
• This is also in line with the typical recovery time objectives for operators of critical infrastructures (example: Colonial Pipeline, 6 days RTO => ~ 2% of annual turnover as damage due to business interruption)
• Conclusion 1: A healthy company (positive free cash flow, not overindebted) can easily cope financially with a successful cyber attack. Scaremongering is not called for here.
• Conclusion 2: This does not mean that investments in security are not worthwhile. On the contrary, the risks for employees and customers must of course be handled responsibly. However, the budget should be used in a targeted manner, and reasonable upper limits for ongoing expenditure can be derived from the figures.

If anyone has any counter-examples, of course! It is also clear that the effects on authorities, especially law enforcement or the defense sector, can be completely different.

Here are a few notes from provider briefings (not a provider recommendation, of course):

Cyberproof:

• Subsidiary of UST (larger IT company from the USA, approx. 24k employees). Cyberproof itself is the security division with approx. 800 employees worldwide
• Focus on Managed SOC / MDR and also provision of SOC analysts based on T&M
• Covered tech stack comparatively broad:
  • SIEMs: Sentinel, Splunk, Chronicle, QRadar and occasionally also Elastic
  • EDR/XDR: Crowdstrike, MS Defender, Cybereason
• Follow the Sun or for EU customers dedicated 24/7 from SOC in Barcelona (L1+L2) with L3 analysts in Israel/UK
• Reference customers DACH e.g. Dräger, Vaillant, Richemont, Nestlé, Schindler
• Target customers tend to be global companies with individual playbooks (including Axa and Maersk)

Island Security:

• Enterprise Browser – roughly somewhere between VDI and Web Proxy/CASB, I would say. As far as I know, CyberArk offers a similar product as part of its Identity Suite, as does Palo Alto.
• It works very well for restricting and monitoring/recording access to web apps and SaaS (incl. PAM functions). Particularly helpful for unmanaged devices => BYOD, external service providers and whenever proxies such as ZScaler, Netskope or similar are bypassed or do not work. Native integration with MS Conditional Access
• Blocking (“redacting”) of the clipboard/screenshots
• Can reduce the necessary scope of VDI (Citrix, VMWare, Microsoft)
• Based on Chromium
• Large financial groups (JP Morgan, but also SwissLife) as customers
• 5000 users => 120 EUR/user list price, resellers receive 40% discount
• Sequoia as VC investor, now valued at ~3 billion USD

Nasuni:

• Software for “NAS Unified” as a replacement for NAS and file servers, i.e., scalable enterprise file system especially for hybrid environments => fast local access times at low costs via object storage, good for cross-location collaboration
• With integrated backup + recovery functions (which is why we looked at this). Example: Immutable snapshots via own file system, which does not provide for manual deletion / modification of written files (not even with administration rights). However, according to my current understanding, attacks are still possible by setting up the retention time of snapshots.
• Not for databases, but for unstructured data (prime example: CAD files). Native integration with e.g. Siemens TeamCenter PLM or AutoCAD
• Customer brings their own object storage (public or private cloud) and their own encryption keys. The latter are not stored in the object storage, but on one of the decentralized access points (managed by the customer, no decryption options from the provider). Encryption is enforced (at rest and in transit).
• Already 1000 corporate customers worldwide, around 100 of them in the DACH region
• Exemplary: Transparent provision of e.g. current pen test and SOC2 Type 2 reports for download
• At a slightly higher level, I was impressed by the data sheet, which describes the advantages in a refreshingly clear and comprehensible way based on technical criteria. With security products, the marketing material usually impresses with cool pictures and creative word creations. It underscores the impression that the IT infrastructure/operations community is more mature and more mature in comparison.

We would also like to take this opportunity to thank you for your feedback and encouragement on our last market commentary!

• In fact, some of the security providers are loss-making according to GAAP or IFRS accounting (e.g. Rubrik: losses of around 50% of revenue in each of the last two financial years). In most cases, however, the companies are cash flow positive because we first transfer our SaaS license fees and then use them
• Are the high marketing + sales costs perhaps simply due to the fact that cybersecurity solutions are products that require so much explanation? => Also a factor, but in my view this is more due to strong competition, a lack of product differentiation and overinvestment by VC/PE companies. Other B2B categories that require explanation, such as automation technology, have much lower sales costs.

And here’s a treat for those of us who like to play / have played Civilization or other strategy games extensively (and perhaps also for anyone who is worried because their own children play so much computer games): Good gamers, good managers? A proof-of-concept study with Sid Meier’s Civilization (researchgate.net)

As always: Questions, suggestions, comments, experience reports and also opposing opinions or corrections are welcome by email.

Best regards
Jannis Stemmann