Information security managers prove they know which vendors to get excited about

Results from N.Y.-based analyst firm TheInfoPro's periodic surveys of information security managers at Fortune 1000 companies show the clear upward trajectory for new security solutions entering the market.

"Every six months we ask them to identify the most interesting new technologies they've seen in the last year—not necessarily having bought them," says Henry Nissenbaum, managing director for information security research, adding, "and more and more vendors get mentioned."

The number of vendors actually grew 50 percent between the last round of surveys to a total of 92. TheInfoPro says Cisco is garnering the most interest.

"Cisco has grown from being the dominant network company to being the leading network security company," explains Nissenbaum, adding that Symantec also is hot. "Symantec bought a number of vendors that previously showed up in surveys," he says, while also pointing to Microsoft, which is gaining security-systems favor among the Fortune 1000.

TheInfoPro calls these vendors "exciting" in that they comprise a mix of large, well-established vendors and newer, smaller ventures. It's common, Nissenbaum says, for many of the smaller vendors to be acquired within several months of being identified as "exciting." For example, Whole Security, Zygote, and Bind View appeared on the TheInfoPro "Wave"—a rolling survey—findings one year ago, and are now part of Symantec.

The market seems to hold no strong preference against small, exciting vendors being acquired by larger companies as long as they're acquired by the "right" company.

"Companies don't mind them getting acquired," says Nissenbaum, "but they prefer that they be acquired by a company they already have a relationship with," he says.

In the latest Wave interviews, end-point authentication was cited as the hottest technology.

"The core of it is authenticating the physical device connecting to the network," say Nissenbaum. "This means ensuring that it is sanctioned to be on the network, that it complies with policies, has the right patch levels, and the right antivirus software. End-point authentication controls the level of access each device has to the network."

Nissenbaum cites another new system category that shows great promise: outbound content compliance. "In this latest Wave," says Nissenbaum, "it started out very aggressive, and it has the mark of developing quickly. It provides intellectual property management, and it protects against information getting pushed out that shouldn't get out."

Vontu, Vericept, and Verdasys are vendors deemed exciting in the outbound content compliance space.

"This fits with a shift from focusing exclusively on protecting against external vulnerabilities to that of internal security vulnerability," says Nissenbaum. "A trusted individual needs access to customer records, but he shouldn't be taking several hundred of them home at night."

Multiple-vendor portfolios are standard with most companies. "No one is looking to use 40 vendors, but they are looking for the best vendor in each area," Nissenbaum says, reflecting the reality that security vulnerabilities are broad in scope, and companies want the best protection at every point.