Software [In]security: Software Security Demand Rising

• By Gary McGraw
• Aug 11, 2008

From the author of
Software Security Library Boxed Set, The

The field of software security (also called application security by some) continues to grow and is beginning to move beyond early adopters and into a broader market. In my 2007 article Want Turns to Need, I provided some numbers for the space along with some commentary about its evolution. Gathering the numbers has become more of a challenge now that mainstream corporations are involved in software security, but after a slight delay here is what I have found. All told, the software security market for tools and services in 2007 was worth somewhere between $275-300 million. If you factor in application firewalls (probably accounting for $50 million), the number is even higher.

Tools

One of the most important developments in the software security market can be seen in the tools space which, combined, almost doubled to $150-180 million. Top of list are two major acquisitions that closed in 2007: Watchfire's purchase by IBM (somewhere in the range of $120-150 million on 2006 revenue of $26 million) and SPI Dynamics's purchase by HP (for around $100 million on 2006 revenue of $21.2 million). For more on these acquisitions, see Consolidate This. Both of these companies produce and deliver black box Web application security testing tools which I refer to as badnessometers.

The good thing about badnessometers is that they help people understand that even their own software can have security problems. Penetration testing and black box testing tools play an important role in the space, helping even the most reluctant companies accept the fact that it's not just other people's software that is broken.

The black box space was flat in 2007, with IBM/Watchfire checking in at $24.1 million and HP/SPI Dynamics earning $22.3 million. Smaller companies in the space, including Cenzic, Codenomicon, WhiteHat and the like had combined revenues around $12.5 million (a growth of 25%, though Cenzic grew 16% and WhiteHat 52%). Most of the growth "hiccup" in the black box market can be attributed to the serious challenges posed by any acquisition. So far 2008 looks to be back on track from a growth perspective in the black box testing space. The global reach that IBM and HP offer are already making a big difference.

On a more positive note, static analysis tools for code review grew at a healthy clip in 2007 into a $91.9 million dollar market. Fortify was up 83% to $29.2 million. Klocwork grew over 60% to $26 million. Coverity grew over 50% to $27.2 million. Ounce Labs tripled their revenue to $9.5 million.

This is a telling development. The source code analysis space is now larger than the black box testing tools space, showing that enterprises are spending money wisely and looking to fix problems, not just identify them from the operations side. Step one in solving software security problems (even when we're only talking bugs) is knowing exactly where in the code the problem exists. White box analysis is superior to black box analysis in that respect. Plus, the move to encompass source code of any sort is a very nice expansion of software security outside of the "strictly the Web" (port 80) thinking that somewhat hampered the first generation of tools.

Services

Services continue to be a critical part of any large scale software security initiative. Tools don't run themselves; any enterprise-level software security initiative is a long-term strategic undertaking involving technology adoption, training, and best practice development. The hard-to-track software security services space checks in around $100-140 million in 2007, with growth just shy of 20% over 2006. Services can be divided into three tracks: training (around $7 million), risk assessment ($45-60 million) and penetration testing ($50-75 million).

Many of the players in the services space, especially in California, are focused on penetration testing (at the application layer of course). Large consultancies and boutiques alike provide services in the penetration testing space, including IBM Global Services (through ISS), Verizon (through Cybertrust), Symantec, and Ernst & Young on the "big side," and iSec Partners, Leviathan, Gotham, NGSS, IOActive, and Independent Security Evaluators on the small side (all under $4 million). As in the tools area, penetration testing services are extremely useful because they force customers to confront their software security issues head on. (See the smoking app?) Penetration testing often leads to demand for more mature services and sometimes even leads to large-scale initiatives.

Midsize consultancies including McAfee (through Foundstone) and my company Cigital focus on getting into the code to identify bugs and flaws and then mitigate them. Together, these two firms represent 80% of the revenue in the code analysis space. Cigital's practice includes strategic services to help large multi-national corporations adopt software security in their SDLC in much the same way that Microsoft created its Secure Development Lifecycle. Smaller companies in the space focus most of their attention on training, and include Aspect, Security Innovation, and Denim Group.

The European market also began to develop in 2007, with a number of smaller players taking on software security. Companies to watch include Minded Security (Italy), Virtual Forge (Germany), Security Innovation (Amsterdam), and NGSS (U.K.). The European market may outstrip the US market from a growth perspective in 2008 as the US recession continues.

Get with the Program

Software security continues to make headway as a business necessity. However, getting started with an undertaking like a software security initiative can sometimes present a challenge. During the decade that we've been providing software security services at Cigital, we've identified four common ways to start (some better than others) which you can read about in Software Security Strategies.

The (r)evolution in security from reactive operations-based solutions to proactive security engineering continues. Looks like software security is with us to stay.