ISS Bets Shop on Managed Security Partnerships -continued

Scaling To Meet Partner Demands
Dramatic growth raises serious questions about ability to scale to meet new demand. Doubling a partner base creates the potential for order-of-magnitude customer increase. "Part of the equation is how rapidly our partners will ramp up," said Hangen. "We've had experience partnering with carriers like BellSouth and Ameritech, and we know what it takes."

Hangen thinks that the managed security industry today is much like the automotive industry was 100 years ago. Many competitors, mostly job shops. In the end, only a few automotive companies survived -- those who were able to scale by creating factories to drive down costs and increase production.

Of the 68 competitors tracked by ISS, Hangen believes that most hit a wall when they reach 200 customers. "We support over 1,500 customers today," said Hangen. "We have 30 people who do nothing but monitor multivendor consoles in our security operations centers, 24x7. We have 10 people assigned to track new security threats."

In fact, ISS begins each partnership by discussing the value proposition behind outsourcing. "We explain the trials and tribulations, the lessons we've learned, and demonstrate why it's better to buy than build," said Hangen. "Many providers fall into the trap of thinking that [managed security] is just another NOC. They may not realize they need a custom console to manage multivendor platforms simultaneously. Or that at least two NOCs are required for redundancy and credibility."

ISS has already developed this kind of infrastructure, and is convinced that it can scale. Obviously, they have also convinced nine new partners. But the next year will be telling.

Helping Partners Sell Managed Security
Partner discounts are tied to order of capacity -- the partner assumes the sales risk, ISS shoulders the operational risk. According to Hangen, "Approximately 28 cents out of every dollar goes to alliance management: consulting with partners on go-to-market strategy, sales, training, billing integration, etc." ISS staff remains on-site today at BellSouth and Ameritech, working full-time with each partner's sales force to help close large deals.

Once a deal is closed, what about support? "In many cases, tier 1-3 support comes to us. Some partners -- for example, DimensionData -- insist on doing tier one, and we actually prefer this. Some problems may not turn out to be security after all, and triage by the partner may result in better customer service."

Of course, the objective of managed security is to prevent intrusion, loss of confidential information, and collateral damage. ISS backs its offerings with service level agreements (SLAs) that are among the strongest in the business. "But nobody can guarantee 100 percent protection, and anyone who does isn't being truthful," said Hangen.

To that end, ISS also offers an insurance program, providing up to $200M of protection in the event a customer network does get hacked. Partners will be able to offer insurance policies to their own customers, although the details have not yet been worked.

Market Shakeout
According to IDC, the market for information security services will grow to $16.5 billion by 2004, with security management services expected to be the fastest growing sector. By shifting its strategy from direct sales to resale through strategic partners, ISS has placed a high-stakes bet.

"I think this is going to be an oligopoly market," said Hangen. "A small number of large-scale managed security service providers will remain in the end, and we want to be one of those. Pure-play managed security will become a dinosaur."

—End

return to the top of this article