IT Outsourcing, Security Testing and Data Loss Prevention Offer Biggest Growth Opportunities
Worldwide spending on information security products and services will reach $81.6 billion in 2016, an increase of 7.9 percent over 2015, according to the latest forecast from Gartner, Inc. Consulting and IT outsourcing are currently the largest categories of spending on information security. Until the end of 2020, the highest growth is expected to come from security testing, IT outsourcing and data loss prevention (DLP).
Preventive security will continue to show strong growth, as many security practitioners continue to have a buying preference for preventive measures. However, solutions such as security information and event management (SIEM) and secure web gateways (SWGs) are evolving to support detection-and-response approaches. Gartner expects the SWG market will maintain its growth of 5 to 10 percent through 2020 as organizations focus on detection and response.
"Organizations are increasingly focusing on detection and response, because taking a preventive approach has not been successful in blocking malicious attacks," said Elizabeth Kim, senior research analyst at Gartner. "We strongly advise businesses to balance their spending to include both."
Ms. Kim said that security spending will become increasingly service-driven as organizations continue to face staffing and talent shortages. Managed detection and response (MDR) is emerging, with demand coming from organizations struggling to deploy, manage and use an effective combination of expertise and tools to detect threats, and then bring their environment back to a known good state. This is particularly true for targeted advanced threats and insider threats. With more MDR providers emerging targeting the midmarket, Gartner foresees these services being an additional driver for security spending for both large and smaller organizations.
According to Gartner, spending in security markets such as consumer security software, secure email gateways (SEGs) and endpoint protection platforms (EPPs) continues to show constrained growth due to commoditization.
Other assumptions in the information security market behind Gartner's latest forecast include:
The average selling price for firewalls is expected to increase by at least 2 or 3 percent year over year until the end of 2018.
This is driven by the market benefiting from higher demand for high-end equipment among cloud providers and other service providers, due to larger bandwidth needs and an increasing number of devices. While vendor competition continues to put pressure on pricing, enterprises, service providers and web-scale organizations are moving toward deploying bigger and more expensive firewalls. As a result, the deployment of large firewalls by cloud service providers will remain an important source of revenue growth for vendors.
By 2018, 90 percent of organizations will implement at least one form of integrated DLP, up from 50 percent today.
Organizations have been deploying DLP to address regulatory compliance, intellectual property (IP) protection and data visibility and monitoring. Newer solutions that include user entity and behavior analytics, image analysis, machine learning, and data-matching techniques are being used to augment existing solutions.
Public cloud adoption will impact firewall spending by less than 10 percent until the end of 2019 but will have an impact after that.
While software as a service (SaaS) adoption is growing, the effect on firewall spending will be limited for the next three years. SaaS is the first choice for only 16 percent of CIOs surveyed by Gartner in 2015. Transitions also take time, during which vendors of cloud access security brokers (CASBs) will not only continue to evolve to cover more than just SaaS, but also perform similar roles for infrastructure as a service (IaaS) and platform as a service (PaaS). In addition, firewall vendors will also have to deal with one of their main challenges for the next few years: decrypting Secure Sockets Layer (SSL) at scale.
Half of midsize and large organizations will add bigger, more advanced inspection-oriented features to their network firewalls by 2019.
Bandwidth has been increasing, requiring larger-scale, higher-performing and more expensive firewalls. In addition, organizations are looking to firewalls to consolidate other features, such as web filtering and intrusion prevention capabilities. Some are enhancing their firewalls with new content inspection features, such as malware sandboxing.
More detailed analysis is available to Gartner clients in the report "Forecast Analysis: Information Security, Worldwide, 1Q16 Update."
Gartner Security & Risk Management Summits
Gartner analysts will provide additional analysis on IT security trends at the Gartner Security & Risk Management Summits 2016 taking place in Sydney, Mumbai and London. Follow news and updates from the events on Twitter at #GartnerSEC.
Gartner, Inc. (NYSE: IT), is the world's leading research and advisory company and a member of the S&P 500. We equip business leaders with indispensable insights, advice and tools to achieve their mission-critical priorities and build the successful organizations of tomorrow.
Our unmatched combination of expert-led, practitioner-sourced and data-driven research steers clients toward the right decisions on the issues that matter most. We're trusted as an objective resource and critical partner by more than 15,000 organizations in more than 100 countries—across all major functions, in every industry and enterprise size.
To learn more about how we help decision makers fuel the future of business, visit www.gartner.com.
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.