Counterpoint: There is demand for security innovation
Over in the Securosis blog, Rich Mogull wrote a post “There is No Market for Security Innovation.”
Rich is right that there’s currently no market, but that doesn’t mean there’s no demand. I think there are a couple of inhibitors to the market, but the key one is that transaction costs are kept high by a lack of data about outcomes. Every one of the startups selling you a product will claim that it blocks “APT” and “Data loss” but none of them have compelling data about efficacy. None of us have great, broad data about what problems lead to breaches, and none of us have data about what solutions products effectively prevent those problems. None of us have data about how often the products are deployed and managed effectively.
So when the salespeople come in with their “$204 per record” and compliance demands and all the rest, there’s no good way to distinguish between it, and as a result, the market is a slog for both real innovation and snake-oil.
If someone could innovate to address these problems, say by collecting and analyzing data about what really happens inside a company, they might have a business.
More broadly, for a market to function, there needs to be supply which exists in plenty, and demand, which exists, and a way to link them. And there’s the chasm.
I’ll also point out that we discussed innovation a bit on pages 126-127 of The New School, where we opine that much security needs to be integrated into your infrastructure and thus will be purchased from larger vendors.
If an innovation can’t make it to market, where does the outcome data come from? It seems you need market entry to get outcome data to get market entry? Don’t other barriers like protectionist incumbants, marketing from 800 pound gorillas and pay-to-play skew outcome data against innovation by causing an uneven playing field? Perhaps 80% of the improvements come from %20 of the innovations that can’t enter the market.