Rocky Road For Managed Security

But the market that looked so rosy back then has since undergone a massive shakeout. Many companies have gone out of business or sold off their managed security operations to competitors.

Among the recent casualties: Para-Protect and Predictive Systems transferred their managed security services businesses to Riptech; Three Pillars was acquired by TruSecure; and Telenisus sold its managed security assets to VeriSign.

Companies are realizing that managed security is a capital-intensive business that requires a longer payback period than other investments, said Allan Carey, an analyst at research firm IDC.

Not reaching economies of scale and a slower-than-expected customer acquisition rate are other factors, he said.

But despite those obstacles, IDC predicts that the managed security services market will grow to $2.2 billion by 2005 from $720 million in 2000. And those that have survived the shakeout say interest in the market remains strong.

"The shakeout is providing a lot of opportunity for us," said Ken Ammon, president and CEO of Netsec, Herndon, Va.

Clients whose providers have gone out of business and those worried about their providers' viability are looking to Netsec, which has a strong base of federal customers, Ammon said.

Security spending by government agencies has remained strong despite the recession and has also helped prove Netsec's credibility to large commercial enterprises, he said.

For its part, Counterpane, Cupertino, Calif., credited a sharp increase in the number of customers at the end of last year to a strategy of selling its security monitoring service exclusively through channel partners.

Minneapolis-based Espiria is among the 50-plus solution providers that signed on with Counterpane. Hugh Voigt, CEO of Espiria, said Counterpane's service complements its offerings, which help customers build "end-to-end security programs."

He expects revenue generated from Counterpane's service to account for up to 35 percent of Espiria's overall revenue. And demand for managed security will continue to grow, he said.

"The overall sense of urgency around security has grown," Voigt said. "Monitoring is a tangible item that people can put in place to show they're working on the issue."

By teaming with Counterpane, Espiria doesn't incur the heavy costs of building and staffing a data center to host the service.

Espiria helps companies prepare to offer monitoring services, assisting them with security policy development, architecture design and infrastructure work. That preparation is one reason sales cycles for managed security solutions can be long, Voigt said.

The firm also provides incident response and forensics work to complement Counterpane's 24x7 monitoring.

Farm9, Oakland, Calif., dove into managed security in 1999 and has seen business double each year since then, said George Milliken, CEO of Farm9.

The company, which has a staff of 20, offers monitoring services from its security operations center and managed vulnerability assessments.

Most of Farm9's 50 customers are midsize banking and financial services firms, which are beefing up security to comply with new federal guidelines, according to Milliken.

"These companies are no longer allowed to look the other way," he said, adding that a flat-fee-based pricing system has helped the firm win customers tired of the per-hour pricing model traditionally offered by consulting companies.