It’s not a new technique, but that doesn’t mean that cybercriminals cannot make rich rewards from SEO poisoning.

Read more in my article on the Tripwire State of Security blog.

Read More

Russian vodka-maker Stoli Group has filed for bankruptcy in the US after ransomware attack and alleged persecution by the Putin regime

Read More

Law enforcers in Germany have taken down dark web marketplace Crimenetwork and arrested a suspected administrator

Read More

Security leaders continue to be under intense pressure. Increasingly, they are turning toward third parties for support and expertise as their cybersecurity woes become more dire and it becomes harder to recruit and retain talent.  This is reflected in the projected growth for cybersecurity services through 20281 (managed security services, managed detection and response, security consulting, and security professional services).

According to Gartner1, end-user spending for all security services will grow from $77.4 billion in 2024 to $116.9 billion in 2028, with a compound annual growth rate (CAGR) of 11.4 percent. Managed detection and response (MDR) is forecasted to be the highest growth area of security services, with a projected 17.1 percent CAGR through 2028. This is in part due to the continued, acute need for support with threat monitoring, detection, and response. However, it’s also due to a growing need for help with risk identification, management and governance, exposure and vulnerability management, and incident readiness due to increasingly stringent requirements by regulators for reporting in these areas.

Let’s compare that to the forecasted growth rate of network security products (a 9.9 percent 5-year CAGR, 2023-28, projected to reach $32.8 billion) and security software spending (a 13.4 percent 5-year CAGR, 2023-28, projected to reach $132.0 billion). What’s the storyline? The desire for help and expertise within security is as critical as the need for security products themselves. And, as the threat landscape grows ever-more formidable, especially with adversaries leveraging new AI tech, that need is likely not going to wane. 

With this growing demand, many, many different (and very large) providers have realized the opportunity in security services and are diving into the security services market for their piece of the “cyber money pie.” This includes everyone from software vendors, telecom companies, cloud service providers, IT service providers and traditional IT consulting firms to global MSPs (managed service providers) and MSSPs (managed security service providers). This is creating a very crowded market, and one in which business models are quickly changing so providers can better compete. For example, many organizations now see some of the big consultancies as a “one-stop shop,” for everything from consulting to MDR.

In managed security services, for example, the top 10 MSSPs include (alphabetically): Accenture, Atos, AT&T (LevelBlue), Deloitte, Fortinet, Leidos, HCL Tech, NTT Data, PwC, and Tata Consultancy Services. Together, these providers hold 49 percent of MSS market share worldwide. Extending beyond the top 10 to top the 30 global MSS providers, the total “owned” market share jumps to 88 percent, leaving just 12 percent for the smaller, regional players. The raises several questions. Can the smaller, regional players compete against these big guns? Or, do they have to remain satisfied with fighting over the remaining 12 percent market share globally (which equates to approximately $3.5 million worldwide for MSS in 2025). Is it possible for smaller players to take a portion of the $26 million projected 2025 market share from the top 30?

How can smaller, regional players win the security service game?

Yes, smaller, regional service providers are going to be the most challenged as the services market continues its rapid evolution, especially as they try to keep up with technology changes, AI’s impact on service delivery, cyber skills shortages, and more. However, they also have an advantage, including the ability to:

Specialize in industry or specific tech environments such as OT, cloud, or edge
Provide regional context (including culture and language support)
Partner with the larger players who can’t be everything to everyone 

This is why many are choosing to partner with the larger providers in the market, augmenting their existing services, including the operational delivery of those services. It’s the classic “do I build or buy?” Which path should a regional player take to not just survive, but to thrive as a security service provider? On the one hand, building out your own service operations and tech platforms will likely yield higher margins, but it requires a significant investment of time, capital, and people. Can the “build” be done fast enough to keep up with the market?

For many, partnering means they can refocus their energy from development or operations to the business of selling, marketing, and building stronger relationships with their customers. Partnering with a larger provider can mean faster time-to-market on new services while also giving less established brands important credentials and “weight” in terms of customer trust (which is a big deal when it comes to cybersecurity). It’s the more compelling path. 

LevelBlue, formerly AT&T Cybersecurity, has worked with regional MSSPs, MSPs, IT service providers, resellers, and more as just such a partner for nearly three decades. And, we continue to support those regional players with a flexible, highly extensible technology, tactical threat intelligence from LevelBlue Labs (formerly Alien Labs), operational and consulting support, and integrations through our partnerships with the leading global tech providers.

We’re also continuing to expand service opportunities for our indirect channel partners in areas that will help them to compete and grow in a market saturated with heavy hitters. LevelBlue channel partners today can build their own MDR service using LevelBlue’s platform, USM Anywhere, bundled with the SentinelOne endpoint security platform. The advantages to service providers and resellers include discounted pricing and operational support from a partner with more than 30 years of experience in security services. As one of the top ten MSSPs globally, LevelBlue also brings established market best practices, which we share with our partners.

We’re beginning to roll out additional service offers in the areas of incident response and exposure and vulnerability management that our partners can resell or build upon. Think of these as a fast-track to an expanded and comprehensive MDR service suite.

Why isn’t plain-ole’ threat detection and response good enough?

Life is getting complicated for security leaders, and they now expect more than just “alarms thrown over the fence” from their providers. They are seeking a partner who can deliver in multiple areas and become a trusted advisor. 

There are good reasons why MDR is the fastest segment in security services.  

Organizations are struggling to build and maintain internal security operations teams that include SOC analysts, threat hunters, threat intelligence research teams, endpoint security pros, and vulnerability management experts. The cost and complexity has become too high for anyone other than the biggest and most sophisticated organizations (and even they are looking to augment their in-house teams). 
The MDR market is evolving at a very fast pace. Customers are asking for proactive protection (i.e., vulnerability and exposure management and incident readiness) paired with effective reactive mitigation, response, and recovery. And, they want response to inform future preventative measures – taking the learnings from an incident to improve their security posture and reduce future risks. This requires more than just a single platform. It requires tech (often more than one platform), people, and established processes working together. 
Let’s not forget new regulations, which now call for annual or bi-annual reporting on how organizations identify, mitigate, and govern risk. In addition, they require faster, more comprehensive reporting on incidents that could have a material impact on the business. For example, the European Union NIS2 directives and DORA updates, U.S. SEC regulatory updates, as well as regional and other country-specific requirements have all rolled out in the last three years. Customers need help not only understanding the requirements but also ensuring they are set up to comply.

With 40 percent of IT services contracts having a security services component by 20281 (up from 25 percent in 2022) according to Gartner, it’s easy to see there is opportunity for everyone to grow their business. However, regional security service providers must meet the opportunity by expanding their suite of services beyond traditional MSS and MDR.  How they accomplish this will determine the speed at which they bring new services to market with which they can capture a bigger piece of the cyber pie.  Whether you are an IT services provider, managed service provider, small consultancy, traditional MSSP, or even a reseller, it’s going to get more difficult to compete in the very crowded and raucous security services market. Now is the time to rethink or simply refresh your business model and consider new ways of growing your business — on the coat tails of someone bigger.

1 Gartner Market Share Analysis: Security Services, Worldwide, 2023
2 Gartner Forecast: Information Security, Worldwide, 2022-2028, 3Q24
3 IT Key Metrics Data 2024: IT Security Measures — Analysis

Read More