Antivirus Market Trends

Transcription

1 Markets, A. Hallawell Research Note 23 July 2003 Magic Quadrant for Enterprise Antivirus, 1H03 Enterprise antivirus vendors are being pressured to innovate, yet enterprises are still waiting for improvements. Best-of-breed functionality in related security areas is critical for success. Core Topic Security and Privacy: Security Tools, Technologies and Tactics Key Issue Which vendors will emerge as leaders in the information security domain? Note 1 Microsoft's Acquisition of GeCAD Microsoft's recent acquisition of GeCAD (see "Microsoft Must Transform, Not Threaten, the Antivirus Market") will profoundly affect the antivirus vendor landscape, although it did not affect vendor positions in this Magic Quadrant iteration. Antivirus vendors must show increasingly compelling value to enterprises (especially in remote-access support, centralized management and reporting) to avoid being squeezed out by Microsoft and best-ofbreed vendors in emerging areas. Enterprise antivirus vendors must focus on extinguishing enterprises' "pain points," as well as innovation for example, by making their antivirus engines more open to more effectively support other antivirus products that enterprises may use. Antivirus Market Trends The purchase and support of traditional, signature-based antivirus solutions constitute the largest portion of IT budgets allocated to information security. Antivirus vendors have capitalized on increased enterprise attention to security since the Sept. 11 terrorist attacks and the "Nimda" worm. Leading antivirus vendors have experienced strong growth rates for products, and product and maintenance price hikes have been largely tolerated by enterprises. The heyday that leading vendors have experienced in the past two years will not be repeated. Prior to Microsoft's acquisition of GeCAD Software (see Note 1), multivector worms such as Nimda and "SQL Slammer" exploited server-based vulnerabilities and simply bypassed antivirus products. Despite more regular (usually daily) signature updates, many viruses are spread so rapidly that enterprises are infected before the antivirus vendor can produce the signature, let alone allow time for enterprises to test and deploy signatures to the desktop. Peer-to-peer and Web services will make the situation even worse. Signature-based antivirus products are poised to become relegated to the detection of variants and other "routine noise" viruses. However, enterprises overwhelmingly expect antivirus vendors to deal with multifaceted threats, even if IT vulnerabilities are the primary cause of infection. Traditional antivirus vendors must battle on multiple fronts to retain or gain market share. The buying centers for antivirus products and the daily responsibility for virus management mainly have remained outside of the security organization and are decentralized, the domain of desktop and LAN groups, and network administrators. However, this decentralization is changing due to Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 Note 2 The Antivirus Markets There are four primary antivirus markets: Desktop antivirus, where automation and management, in addition to a growing need for support of personal firewalls, are required antivirus, where platform stability is key for Lotus and Exchange products, and best-of-breed anti-spam detection and management; content filtering and antivirus scanning are also required by e- mail administrators Antivirus scanning for HTTP/FTP and other firewall traffic, where network and network security administrators place a premium on high performance and, increasingly, operational efficiency with URL filtering and related content scanning SMB, where price, limited upkeep and operational efficiency are critical, and best-of-breed functionality in every discipline may not be required multifaceted threats such as Slammer, bringing antivirus as a discipline into the security mainstream. It is also becoming more pronounced, with the antivirus space segregated into four markets (see Note 2). Antivirus vendors must be prepared to provide best-of-breed technology in related areas to prevent being ousted by vendors that can integrate an antivirus signature-based engine into their products. Antivirus could become relegated to a secondary, commodity feature of platform-specific products, with much lower price points. However, antivirus vendors have failed to provide best-of-breed functionality for emerging enterprise needs, such as personal firewalls and anti-spam technology. In addition, as vendors have improved product stability and management capabilities, there is increasingly limited differentiation among traditional enterprise antivirus products. Magic Quadrant Criteria To be placed on the Magic Quadrant for Enterprise Antivirus, 1H03 (see Figure 1), a vendor must: Own its antivirus engine Provide products for the desktop, file servers, the SMTP gateway, and FTP and HTTP traffic Provide inherent management and distribution capabilities Sell and support its products to midsize and large enterprises worldwide 23 July

3 Figure 1 Magic Quadrant for Enterprise Antivirus, 1H03 Challengers Leaders Ability to Execute Computer Associates Symantec Network Associates (McAfee Security) Trend Micro Sophos F-Secure As of June 2003 Niche Players Source: Gartner Research (June 2003) Completeness of Vision Visionaries Significant weight is given to sales and channel capabilities to determine a vendor's ability to execute. Brand strength and good technology partnerships also are important. This weighting is a direct reflection of enterprises' preference for "known" enterprise antivirus solutions. Channel and partnership strengths help introduce emerging technologies to customers. Ability to execute criteria include: Financial stability, revenue growth and installed base Sales/channel capabilities Brand reputation and marketing strength Strong track record with technology partnerships Client feedback on product stability and quality of customer support The assessment of a vendor's future ability to serve a full spectrum of small to large, homogeneous and heterogeneous enterprise environments is weighted heavily to determine its completeness of vision. Criteria include: Strategic plan for its antivirus products 23 July

4 Client feedback on how product and feature functionality and quality of support meet customer requirements Track record in providing good quality and timely products, and features for emerging customer needs The vendor provides, or is planning to provide, best-of-breed functionality for personal firewalls, which should be integrated with antivirus, enterprise anti-spam functionality and content filtering Current and future strategies for dealing with new malicious code threats Current and planned management and administration capabilities for antivirus and related products Leaders Although Network Associates' McAfee Security has been increasingly dwarfed by Symantec's deft abilities in the channel, McAfee has worked to regain focus on its antivirus products in the past three years. In 2002, McAfee retained the largest share (34 percent) of the worldwide enterprise antivirus market. In 2001, the release of EPO, McAfee's management and administration tool, provided superior reporting a major need for large enterprises. McAfee's WebShield appliances also have been popular for midsize enterprises. After the fallout from its ambitious strategy during the mid-1990s, McAfee has been cautious in branching out of the antivirus area. However, in 2003, McAfee has been more adventurous and made acquisitions in anti-spam (Deersoft) and intrusion prevention (Entercept Security Technologies and IntruVert Networks). Entercept and IntruVert have good technology and performed well in early adopter settings. McAfee has yet to integrate the Deersoft technology into its SMTP/gateway products. Even when this is completed, the product will have to catch up to the best pure-play enterprise anti-spam products. McAfee's personal firewall still lags best-of-breed vendors, and we continue to hear negative customer comments about McAfee's GroupShield mail products. Trend Micro's core strengths are its and gateway products, especially its ability to serve current and emerging needs of larger enterprises. Trend recently segregated its Interscan product line into SMTP/messaging and HTTP/Web traffic to develop products and functionality for these different buying centers. Trend is leading innovation on these platforms. 23 July

5 Anti-spam fervor is hurting Trend's traditional dominance at the SMTP gateway. Trend's relationship with Postini (a leading antispam service provider) will allow customers to buy a product version of Postini from Trend. Trend also is starting to target remote-user requirements with its joint SMTP/HTTP appliances with NetScreen Technologies. Although Trend has strong centralized management and reporting capabilities, it has not made significant progress in the desktop antivirus market. In addition, Trend is hampered by the lack of an enterprise personal firewall (Trend's relationship with Zone Labs broke down in 2002), which will lead to an uncertain future in the desktop market. Symantec has gone from strength to strength in terms of its ability to execute in the enterprise antivirus channel. Symantec has experienced strong enterprise growth and high renewals, despite increased maintenance prices, and limited product and functionality improvements geared toward small or very large enterprises. Symantec's brand and reputation for customer support also is serving it well. Symantec's gateway products have not had best-of-breed functionality in related areas, such as URL blocking or anti-spam, or the performance needed by large enterprises (with the exception of the ICAP product). In addition, Symantec's personal firewall is not best or breed (similar to McAfee). High price points have failed to encourage adoption. Unlike Trend's and McAfee's antivirus management products, Symantec does not provide for reporting within a single product. The new Event Manager product must be installed for reporting, and enterprises must migrate from System Center to Event Manager by year-end Clients report that Symantec's recent enterprise licensing program changes, and product and maintenance prices have markedly increased the cost of Symantec's products. Higher prices and austere licensing practices (augmented by functionality in Event Manager) will not continue to be tolerated by customers without more focused attention on their antivirus needs. In addition, Symantec likely will be greatly affected by Microsoft's antivirus plans due to Symantec's strong presence in the consumer and small and midsize business (SMB) antivirus markets. Visionaries During the past two years, Sophos has emerged as the leading alternative to the "big three" antivirus vendors (Network 23 July

6 Associates, Symantec and Trend Micro). Sophos provides a topquality detection engine, superior customer service and broad platform support in the U.K. and Western European markets. Sophos has experienced strong growth in the past year in Europe and with its push into the U.S. market. Improvements in its management and administration, and new and SMTP products, also have increased its ability to win enterprise deals. Sophos' technology partnerships (where it provides its antivirus engine via original equipment manufacturer agreements) with best-of-breed vendors such as Sybari Software (for Exchange and Lotus Notes), Mirapoint, CipherTrust (anti-spam/security appliance) and FrontBridge Technologies (anti-spam service provider) also have gained it visibility with enterprises in the United States. Sophos' neutral position as a pure-play antivirus vendor and its successful partnership track record makes it a good partner candidate for best-of-breed and mainstream security vendors. Its key strengths are its desktop (and file server) products and its solely enterprise-focused customer service. Its challenges will be to gain greater brand awareness in the U.S. market, and to augment its desktop antivirus with personal firewall technology of its own or with a strong partnership. Niche Players F-Secure has a strong reputation for antivirus research, although consolidation in the antivirus market in the past five years has led to declining "mind share" and market share. F-Secure has branched out of antivirus with product offerings in encryption and network security. Most notably, F-Secure has developed strong offerings for wireless and handheld antivirus protection. However, there is minimal threat and, therefore, a minimal market for wireless antivirus protection, although F-Secure is strongly positioned with wireless manufacturers and service providers. F-Secure also has produced a passable personal firewall that can be bundled with its desktop antivirus product at a competitive price. It has supported other vendors' antivirus engines (including the Kasperksy Labs engine) in addition to its own for several years. Although Computer Associates (CA) is not a leader or a visionary in the enterprise antivirus market, changes to its pricing structure and CA's sales presence with chief information officers makes it an emerging contender, especially among SMBs. CA has made some basic improvements to its etrust antivirus product line, and it has relationships with Sybari (for antivirus on 23 July

7 Exchange and Notes) and Webwasher (for SMTP/URL content filtering). In March 2003, CA, recognizing that the leading vendors were increasing their products' prices, announced a pricing structure that made it appear cost-attractive. CA's modest perpetual license (and one-year maintenance) fee, which has an option to get the signatures for free (although maintenance is an aboveaverage 40 percent) has increased its visibility with enterprises. Vendors Not on the Magic Quadrant There are several vendors that have their own antivirus engines or, more typically, license and integrate an antivirus vendor engine into their products, that have not been placed on the Magic Quadrant. Because of the segmented buying centers for enterprise antivirus, as well as platform-specific requirements, many enterprises do not use an enterprise antivirus vendor for antivirus protection on internal servers or at the gateway. For example, Sybari has antivirus products for Lotus Notes and Exchange, and integrates in an antivirus engine from several vendors. content filtering or anti-spam vendors, such as ActiveState, Clearswift, CipherTrust, FrontBridge, MessageLabs, NetIQ/Marshall and Tumbleweed Communications, can integrate in or provide "hooks" to antivirus engines. More unusually, Fortinet has developed an antivirus engine to allow applicationspecific-integrated-circuit-based processing of SMTP and HTTP traffic within its appliance. Bottom Line: Enterprises should use a broader lens than they have traditionally used when evaluating antivirus and related products. They should examine how best-of-breed or platformspecific products may serve their requirements. Enterprises also should capitalize on recent competition tension in the enterprise antivirus market by demanding better functionality and services at lower prices during renewal and procurement negotiation. 23 July