Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/27/2009
05:14 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Security Vendors Offer More Freebies, Deals To Existing Customers

Under increasing budget constraints and intensifying threats, organizations are asking their vendors for free, enhanced features and better deals -- and they're getting them

Security customers are asking their vendors for more new features for their existing products at little or no cost as they struggle to balance smaller or flatter budgets with ongoing compliance requirements and a constantly changing threat landscape.

Several vendors at last week's RSA Conference acknowledged that many of their customers, now faced with tightening budgets and, in some cases, loss of manpower from layoffs, are asking for freebie feature upgrades to their existing installed security tools. And the vendors are obliging to hold onto their customer base and survive the downturn.

"It's a buyers' market," says Nick Selby, vice president and research director at The 451 Group. "About eight months ago, simultaneous with the real market crash, [large] customers started demanding more from their vendors. By now, even the less proactive customers are holding vendors' feet under the fire."

Selby says organizations are asking for a higher level of support and additional features. "In larger organizations, they are demanding and getting concessions from vendors for free software, free gear, upgrades, and more seats," says Selby, who declined to name those organizations. "This is absolutely a trend."

Some of the announcements at RSA were about new, free features for existing tools. IBM ISS was one vendor last week that announced major upgrades to some of its security gear at no extra cost to its existing customers. Among a series of product announcements, IBM rolled out a Web application firewall feature for its Proventia IPS products that combines IBM's Rational AppScan vulnerability scanner and the Web application firewall. John Pirc, senior product manager for IBM ISS's network business line, says intrusion prevention systems (IPSes) are evolving into more inline devices mainly due to regulatory pressures.

It's not a "rip and replace" situation anymore for organizations, Pirc says. "They are trying to reduce appliance sprawl," he says. "You will see us add more features to it."

The IPS, which historically has been slammed by some security experts as a dead-end technology, is enjoying a resurgence as a multifunction network device. "It provides value and a big bang for the buck," The 451 Group's Selby says.

He says most vendors had previously been offering and negotiating special deals with some customers on an ad hoc basis, but the more sweeping upgrades announced during the past week aimed at all existing customers "is a sign of the times."

The downward pressure on the price of endpoint solutions, for instance, is helping customers score some good deals, as well. Endpoint commoditization by Google and Symantec, for example, is making the per-seat price very low, Selby says. "There's real downward pressure on the mainstays of security," he says.

Paul Zimski, vice president of solution marketing for Lumension Security, says these days the firm's customers are looking for ways to save money and be more productive in their security operations. And Lumension is looking at more ways to deliver that: "This is the time to stay entrenched -- and to bring in new technologies," Zimski says. "Our long-term plan is to upgrade features and modules...The endpoint will be the delivery mechanism for other services.

"I believe strongly that customers are looking to consolidate solutions and IT investment anywhere they possibly can right now. It's going to be important that vendors be aggressive in delivering incremental value by providing additional capabilities and modules to existing platforms."

Lumension's big news at RSA was that it had signed a deal to purchase Securityworks, a Dallas-based provider of compliance and risk management solutions. Shavlik Technologies, meanwhile, announced it had added Sunbelt Software's VIPRE antivirus and antispyware engine to its patch management product, Shavlik NetCk Protect 7. The company says it will provide that upgrade to its existing NetCk Protect customers "at very little or no additional cost."

For security vendors, "It's a matter of treading water and riding this out," The 451 Group's Selby says. Selby is also bullish on security mergers and acquisitions: "It's a fantastic time to buy security assets," he says. "Vendors are looking for opportunities to grow, and there are tremendous opportunities."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25250
PUBLISHED: 2021-04-13
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privil...
CVE-2021-25253
PUBLISHED: 2021-04-13
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to exec...
CVE-2021-28645
PUBLISHED: 2021-04-13
An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target ...
CVE-2021-28646
PUBLISHED: 2021-04-13
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
CVE-2021-28647
PUBLISHED: 2021-04-13
Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file during the installation progress and could execute a malicious program each time a user installs a program.