How To Cope
So how does a security buyer deal with a market that's in constant flux? How do you know if that startup with the innovative product will be around tomorrow?
You can't know, says David Escalante, director of computer policy and security at Boston College. "It's like gambling. You can't predict when you buy one of these things if it [the startup] will go out of business, or get bought by a bigger company that decides the product isn't strategic and just drops it."
His solution is to never buy technology unless it will provide ROI in less than two years: "Our tendency is to point out to people that we don't think the product will last so long, therefore they have to give us a better price."
CIGNA also takes a short-term approach with some small startups. If one of its strategic partners doesn't provide a solution for a particular problem, CIGNA will deploy a specific product on a limited basis to address the problem.
"When we look at a tactical product, we look at a lifespan of one to two years," McKenna says.
Other security managers share that outlook, says Paul Klahn, director of consulting services at FishNet Security. These days, customers are inclined to ask a vendor right off the bat whether it's going to be bought. "There's not a lot of expectation anymore that these products will be around a long time," he says.
Wary of losing support or other changes that might accompany an acquisition, some customers are turning to VARs (value-a...
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
dded resellers) like FishNet to provide consistency. In the event a vendor is sold, a customer still knows that there is someone they can call for support, Klahn says.
As always, before a purchase a security buyer should try to find out as much as possible about the supplier.
"We really try to look for the best solution that's available," UNC's Brown says. "If it's a startup, we do as much due diligence as we can. We try to protect ourselves, but we're going to get the best solution out there, be it from a startup or a big guy."
After his bad experience, Pentz says he's more likely to check references supplied by the vendor and found elsewhere. He'll also research online the vendor's support quality. He even tries to find out if a company is on the block and whether the potential buyer's customers are happy, and advises others to do the same.
And when a vendor is acquired, users need to ask the buyer a lot of questions about support and plans for the acquired technology, says Amrit Williams, analyst at market-research firm Gartner.
But the best solution for security buyers faced with a changing market is interoperability, says CIGNA's McKenna.
"If we had interoperability across the industry, then it becomes vendor independent. We're seeing some of that with federated identity," he says. "It doesn't matter what product you buy, they all work with each other. We just need more of that across the whole security market. That's more customer protection than anything."
|
