Software [In]security: Software Security Comes of Age
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Space Approaches $500M Threshold
Software security (sometimes called application security) continues to grow and thrive, even in the face of worldwide recession. The space as a whole approached an important threshold in 2008, accounting for over $450 million in US revenue. The $500 million number is important, because at that revenue range the technology analysts who drive the middle market begin to get involved. To wit, Gartner analyst Joseph Fieman published the first-ever magic quadrant for software security tools in February (see below). Software security has grown up, right under our noses!
Software Security as a Whole
Building secure software requires a combination of people, processes, and tools. By tracking revenue from both tools providers and services firms, we can get some idea of how quickly the market is growing, and which parts of the market are driving growth.
)
I have been tracking the software security market carefully since its inception and publishing the numbers I collect in a series of articles. Figure 1 above shows (in millions) how the space has grown since 2006 from roughly $300 million (including application firewalls) to $458 million in 2008. During 2007 and 2008 the market as a whole grew 18.8%, even into the strong headwinds of the worldwide recession.
Previous articles reporting revenue numbers for earlier years are: Want Turns to Need for 2006, and Software Security Demand Rising for 2007.
Tools: Code Scanning Trumps Web App Testing
The software security tools market segment continues to lead overall market growth. The tools market in 2008 grew 33% over 2007, from $150M to $201M. This total includes both black box Web application testing tools and white box code review tools (which are not limited to Web software).
)
In 2007, the white box code review companies’ combined revenue eclipsed the black box Web app testing tool vendors’ combined revenue. As Figure 2 above shows, this trend continues in 2008. I think this is a very healthy development, demonstrating that the market is becoming ever more interested in solving software security issues and not simply diagnosing them. Also note that in my view a myopic focus on Web applications alone is unhealthy. Though the Web application security space is an important one, software security is a much bigger issue (and will command a much larger market).
The black box Web app tools, which I term badnessometers, are now being sold by the major league players HP and IBM. After a slight hiccup caused by acquisition issues, both HP (selling SPI Dynamics technology) and IBM (selling Watchfire technology) are growing again. HP’s software security tool revenue grew 12% from $22.3 million to $25 million. IBM’s software security tool revenue grew 33% from $24.1 million to $32.1 million. Smaller companies in the space, including Cenzic, Codemonicon, and Whitehat, also grew to a combined $17 million, with Whitehat once again leading the charge.
The static analysis code review tools space continues to impress. Led by Fortify, who grew 40% from $29.2 million in 2007 to $41 million in 2008, the space grew a healthy 35% from $95.4 million to $126.9 million. Major growth was also experienced by Coverity (from $27.2 million to $35.36 million) and Klocwork (from $26 million to $36.4 million). Veracode, which focuses on binary analysis, expanded to $5 million in 2008. Ounce Labs ran flat year over year to end 2008 at $9.1 million.
All told, the tools market has grown enough to attract the attention of the technology analysts. Though Gartner has been covering the space in reports for at least two years, 2008 marks the first year that Gartner has produced a magic quadrant for the space. Other than Joseph Feiman of Gartner, software security analysts of note include Forrester’s Chenxi Wang, Burton Group’s Ramon Krikken, IDC’s Charles Kolodgy, and Bloor Research’s Nigel Stanley. Having these analysts involved should be a boon for market development and a sustained approach to the middle market.
Services: Pen Testing Still Dominates
Tracking services revenue in software security is much more of a challenge than tracking tools revenue. That’s because though there are many large services providers in security (IBM Global Services, Verizon/Cybertrust, Symantec, E&Y, and Booz Allen), determining how much of their work counts as software security can be difficult. Nonetheless, without a services component, getting a software security initiative off the ground is difficult at best, so it’s important to estimate how things are going.
)
Figure 3 above shows my estimate of services growth in software security since 2006. Last year the recession, which is often experienced in services firms before it spreads to other sectors of the economy, slowed overall growth to a modest 6.5%. Only pen testing and training experienced any interesting growth, with code review services and risk analysts and other strategic services running flat. All told, the services space revenue number for 2008 checks in around $197 million, up from $185 million in 2007.
Smaller players focusing primarily on application penetration testing experienced most of the growth in the software security services space, with IOActive (up 75%), Denim Group (up 32%), and Independent Security Evaluators (up 25%) all growing (though all remain under $7 million). Midsize firms Cigital (my firm) and Foundstone both ran flat in 2008 in the $15-16 million range. Cigital’s practice expanded on the strategic software security initiative front. Smaller firms providing software security initiative help, especially focused on training, include Security Innovation (down 10%), Aspect (flat), and iSEC partners (flat).
The European market continues slow growth on the services front, with small firms such as Minded Security (Italy), Virtual Forge (Germany), and Security Innovation (Amsterdam) providing advocacy for the space. One bright note in Europe was the acquisition of NGSS in 2008 by NCC for £5.2 million in cash plus a £10 million earnout. This bodes well for future transactions in the services space.
In the same way that services firms experienced the recession before the rest of the economy, we can also expect services firms to pull out of the recession earlier. From our perspective at Cigital, early results in 2009 bear this out.
Software Security Initiatives
I am aware of 35 large-scale software security initiatives currently underway. These initiatives include selecting and rolling out tools, training, performing analysis and testing, and other more strategic software security activities. The companies executing these initiatives come from a number of verticals: 18 financial services firms, 6 independent software vendors, 5 technology firms, 2 defense contractors, 3 retailers, and 1 behemoth (GE).
In March, we released the Building Security In Maturity Model (BSIMM) — a model built by observing and reporting the activities that nine leading firms carry out in their software security initiatives. Seven of the nine firms we studied include: Adobe, The Depository Trust & Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The BSIMM is likely to accelerate the evolution and adoption of software security by unifying an otherwise piecemeal approach into a coherent, strategic whole.
As the global recession ends, software security is likely to accelerate at an even faster clip. 2009 is likely to be another banner year for software security.