Good news, bad news for security management

First, the good news. Security management deals are expanding.

What used to be a small, tactical security event management implementation is evolving into a much bigger opportunity. As enterprise organizations collect log and network flow data, they want to provide it to the network operations, compliance management, system administrators, lines of businesses and security for all kinds of analysis. In geeky technical terms, what was a security-focused data mart is turning into an enterprise IT data warehouse for all kinds of data analysis, event monitoring and reporting.

Now, the bad news. This transition changes the rules of the game.

All of a sudden, tactical products need to be able to scale for enterprise needs. This means a lot more event traffic, processing, data collection, storage, etc. This also requires a distributed data architecture that provides the ability to view and query distributed data from centralized locations. Trust me, this ain't easy--guys like Microsoft, Oracle, IBM and Sybase have spent years working through this problem.

To service all of these enterprise needs, tactical security products must be re-architected to scale or cease to exist.

When tactical point tools evolve into enterprise solutions, the big guys get interested quickly. Why did EMC buy Network Intelligence, IBM grab the GuardedNet assets in the Micromuse acquisition, and Novell open its wallet for e-Security? You guessed it: security management has become an enterprise opportunity and enterprise deals can generate millions of dollars in product and services revenue.

Who wins? Acquired start-ups and their investors certainly do. As this market continues to evolve, so do the big guys who build and sell professional services and honking security and log management products. Users also win as big vendors like EMC, IBM and Symantec throw resources at this market.

Who loses? It's too early to say. Obviously the start-ups that don't get bought are in a tough position, but there is still a lot of buying to be done. We'll absolutely be able to identify the losers 12 months from now.