Hosted Security Answers The Call For Business Communications

To paraphrase the great Satchel Paige, don't look at your back end a whole lot of somethings might be gaining on you.

That's one message managed communications and content security providers want delivered to e-mail, Web, instant-messaging and Internet telephony users: Threats to business communications are getting bigger, the bad guys are getting smarter and chances are, you can't handle it on your own.

"We see 14,000 to 16,000 new e-mail and Web threats a day," said David Hahn, director of product management at MessageLabs, which offers hosted communications security through more than 800 channel partners as well as direct to enterprises and SMBs.

"We're actually seeing a decrease in e-mail virus volume, but the systems are getting so sophisticated that now malware writers do targeted attacks that, for example, might be intended to extract information about a particular project a client is working on. We see about five to seven such targeted attacks a week."

MessageLabs, along with its main competitor Postini, is banking on the appeal of an ultrathin hosted security and compliance solution for business communications. The vendor does its threat protection "out in the cloud," leaving VAR partners to bundle the service with their other MSP offerings, adjust the settings for a client site on the vendor's partner portal and let MessageLabs go to work blocking spam, malware and unsafe or inappropriate Web sites. "Hey, I'm betting my business on it," said Michael Maddox, president of Application Specialist Kompany (ASK), a solution provider in Mason, Mich.

ASK started out in the MessageLabs associate program, collecting referral fees of up to 15 percent of an annual contract value for passing along new business, before graduating to full partnership status and reselling the security service for recurring fees as an ASK solution to its small to midsize clients.

"We discovered there was more of a market need for managed e-mail security than we expected," Maddox said. "We've got one customer who said it's the first managed service he didn't have to manage himself."

Few doubt that the sophistication of threats, coupled with the growing need in the SMB market for enterprise-level security solutions and near-total communications uptime, points toward dramatic growth for managed solutions, whether vendor-hosted or installed and managed by solution providers.

How dramatic? Managed e-mail security could grow from its current 15 percent to 20 percent share of the e-mail security market to 40 percent by 2009, according to Gartner. Appliances, now at 25 percent to 30 percent, also would grow to 40 percent, with on-premise software getting squeezed from today's 55 percent down to just 20 percent.

Clouded House
In mid-April, Postini reported a "massive virus outbreak" that the vendor called "the largest attack on e-mail in more than a year." E-mail and the Web remain the media of choice for spreaders of malware and are duly the main focus of the companies that secure against it.

But many major messaging security vendors also offer instant-messaging protection of some sort, even while interest in such services remains slim. Meanwhile, VoIP, SMS and the communications free-for-all of Web 2.0 are potentially wide open as spaces where security solution providers could make hay.

As a result, vendors are ramping up their offerings. Smaller hosted e-mail security vendors such as Reflexion and Exchange Defender are vying for a piece of the market. Microsoft, with its purchase of hosted messaging service FrontBridge, now offers a Microsoft-hosted, Internet-based virus and spam-filtering option as part of Microsoft Exchange 2007.

Messaging security software vendor Marshal already offers a solution provider edition of its MailMarshal tool and is preparing to release an appliance. IronPort, the e-mail and Web security appliance vendor acquired by Cisco Systems, says it wants to help partners build end-to-end hosted communications security solutions using IronPort appliances on Cisco platforms.

Next: Thin clients, thinner margins?

There are also e-mail encryption vendors to consider, as well as leak-prevention specialists, small companies such as Vericept, Tablus and Vontu that secure outgoing e-mail. Factor in vendors like Symantec, Barracuda and even RSA—which told CRN it wants in on managed security services—and the landscape looks to be littered with options for VARs.

The question, though, is how they will be able to parlay those options into profitable relationships.

Thin Clients, Thinner Margins?

Tom MacArthur, president of Storbase, a Waltham, Mass.-based e-mail and Web security specialist, is leery of vendor-hosted services like MessageLabs and Postini.

"From the standpoint of the solution provider, the hosting thing makes me nervous. The margins are so thin," said MacArthur, a former Symantec client who now does "99 percent" of his business with IronPort.

"That said, it is a logical application, it's a nice one to outsource, and it makes a heck of a lot of sense if you're a do-it-all, mom-and-pop reseller," MacArthur said. "Maybe it rounds out a portfolio of offerings. It's not a big earner, maybe even a loss leader.

"But for the more sophisticated resellers and VARs, they're more interested in bigger margins," he said.

Others point to a couple of factors that might make a vendor-hosted messaging security solution attractive.

Amy Lubie, president of Mobitech, a Omaha, Neb.-based solution provider, bundles an e-mail security service hosted by Reflexion with her MSP offering. For Lubie, the manageability of the hosted filtering tool is as important as the margins.

"It's been fairly painless as far as getting the system to work the way we want it to. We've used other products, but this one's been the easiest to roll out and administer," Lubie said.

There's also no rule saying a vendor-hosted solution is the only one a VAR can offer, said Bill O'Brien, president of Commercium Technology, Rumson, N.J. . The managed security specialist, resells Postini's hosted solution, but it's just one of several solutions it offers to clients.

"We listen to the client's requirements for e-mail security," O'Brien said. "At a very high level, people sometimes have a preference for a hosted solution rather than something they're going to have to manage.

"The pain point can vary. If it's primarily a spam issue, we'd recommend Postini, because they filter spam very well. If the problem is more virus-based or worm-based, we might recommend something from Trend Micro," he said. And the margins?

"We're very pleased with the margins that Postini provides us," O'Brien said.