Feb. 6, 2015

As various applications became available as cloud-based services, cybersecurity solutions have started following this trend as well. Cloud-based cybersecurity solutions, known as Security as a Service (SECaaS), are expected to enable users to reduce costs just like other cloud-based services. This report will discuss how SECaaS has been adopted in the United States, including market forecasts and survey data.

1.Cybersecurity Goes to the Cloud

SECaaS refers to cybersecurity applications and services that are delivered via the cloud to protect on-premise information systems as well as data and assets in the cloud. SECaaS is a relatively new service that allows organizations to use cybersecurity services without the installation and operating costs that traditional on-premise appliance and software incur.

In April 2014, MarketsandMarkets forecasted that the global SECaaS market would grow from about $4.2 billion in 2014 to over $8.1 billion in 2019. North America is forecasted to be the largest regional market in the world in terms of investment and adoption of SECaaS. Major factors in the growth of SECaaS are the accelerating adoption of cloud computing and strong demands for managed cybersecurity services by companies, especially small and medium-sized businesses. On the other hand, according to MarketsandMarkets, the global cybersecurity market is expected to grow from about $96 billion in 2014 to about $156 billion in 2019. By comparing the size of these two markets, it could be estimated that the SECaaS market was only about 4% of the entire cybersecurity market in 2014 and will only be about 6% in 2019. Nevertheless, in recent years there has been an obvious trend in cybersecurity vendors of various sizes adding SECaaS to their service portfolios; it is clear that the cybersecurity industry is keeping an eye on the budding demands for SECaaS.

2.Examples of Security Areas Composing the SECaaS Market

MarketsandMarkets and Gartner consider email security, web security, and identity and access management (IAM) as security areas that are leading the growth of the SECaaS market. Market overviews of these three areas are as follows.

  • Email Security

    In 2014, SearchSecurity surveyed about 460 of IT professionals in North America on cybersecurity security investment and the survey revealed that email security was the type of SECaaS that they would most like to purchase in the near future. According to Ed Moyle, Director of Emerging Business and Technology Trends at ISACA, an international association of IT professionals, the survey results stem from changes in the work environment in which more employees are accessing work-related emails at and outside of work via BYOD (Bring Your Own Device) policies. Traditional methods that control security at each endpoint would be ineffective in such a new work environment. Instead, SECaaS-type security solutions can filter emails before they reach devices or corporate internal networks, which can prevent them from consuming the bandwidth of these networks and increase the efficiency of email archiving tasks. SECaaS can also streamline and centralize existing email security measures by migrating them to a single service in the cloud.

    Moreover, being cloud-based, they can allow companies the flexibility to use solutions that require big data processing, such as encryption of emails and inspection of outbound emails to prevent sensitive data from leaking. Many of the major email security solution providers, such as Cisco, Intel Security (McAfee), Microsoft, Proofpoint, and Symantec, have already provided SECaaS-based solutions. Some of them also provide a hybrid on-premise and SECaaS email security solution in order to support customers transitioning from a current on-premise solution to a SECaaS solution incrementally and to respond to demands from companies that would like to keep handling sensitive data internally.

  • Web Security

    Solutions to secure the Internet, such as URL filtering, anti-malware, and application controls, are defined as part of the Secure Web Gateway (SWG). SWG is primarily delivered nowadays as appliance-based solutions while SWG vendors are considering providing cloud-based SWG as a way to differentiate themselves from others.

    In 2014, Gartner has named five vendors-Cisco, Websense, Blue Coat Systems, Intel Security (McAfee), and Zscaler-as leaders in the SWG market. Of them, only Zscaler is specialized in cloud-based SWG while others provide SWG both as an appliance and via cloud. California-based Zscaler, founded in 2008, offers its cloud-based SWG services to over 5,000 organizations in 200 countries, including global enterprises such as GE, Nestlé, and ExxonMobil, thousands of medium-sized businesses, and governments such as the U.S. Marine Corps and NATO. This demonstrates the broad range of applications of cloud-based SWG.

  • IAM

    There are differing opinions about who may be interested in cloud-based IAM solutions, or Identity as a Service (IDaaS). One opinion is that there is interest in IDaaS from small and medium businesses who would like to expand basic IAM functions; another is that there is interest in IDaaS from medium and large-sized businesses who need to control access to both applications in the cloud and legacy applications on premise. Nowadays, large IT companies, such as Salesforce and Microsoft, are seen in the IDaaS market. However, the market was originally pioneered by startups that were focused on IAM issues, which had become more complex due to emerging cloud services. Okra and OneLogin are typical examples. Both companies were founded in 2009, are located in San Francisco, California, and provide multiple IAM solutions, including Single Sign On (SSO) to thousands of different Software as Service (SaaS) applications and strong authentication. In addition, they provide integration to existing directory services, such as Microsoft Active Directory, that centrally manage information about various assets, users on corporate networks, access control, and user provisioning.

  • WAF

    In 2014, Gartner also referred to encryption, Security Information and Event Management (SIEM), vulnerability assessment, and web application firewall (WAF) as security areas of SECaaS that will grow. In terms of WAF, traditional appliance-based solutions are currently the mainstream in the market. Although cloud-based WAF currently protects less than 10% of public web applications, Gartner predicts that the percentage will exceed 50% by the end of 2020. WAF is a cybersecurity technology that detects and blocks attacking traffics against web applications. Major cloud-based WAF providers include Akamai, CloudFlare, Incapsula, and Qualys. Recently, Verizon has launched its own WAF as a cloud-based solution that it believes is superior to traditional appliance-based solutions in terms of cost, scalability and flexibility. Verizon’s new WAF offering was made possible by its acquisition of EdgeCast, one of the major U.S. Content Delivery Network (CDN) service providers in 2013. The market entry of these enterprises is expected to make the cloud-based WAF market competition more active. Speaking of the cloud-based WAF market, Scutum (Symantec WAF), which NTT DATA distributes as an agent, accounts for 50% of the market in Japan.

3.Cybersecurity Services in the Future

There are still many challenges related to cloud computing, including security. However, as more companies place trust in cloud computing, more data and systems will migrate to the cloud. As reliance on the cloud becomes more prevalent, it would be inadequate to leave cybersecurity technologies only on-premise. The cloud-based platform that AT&T has been developing, known as Astra, is a movement to support such an idea. Astra separates software from traditional security appliance hardware and moves it to the cloud so that users can call security services quickly and easily to protect assets like data on cloud and endpoints connected to cloud. Astra is security in the cloud for the cloud. In order to secure today’s corporate environment, which has been changed by mobility and the cloud, this kind of revolutionary security delivery measure will be essential.