No-shows at the security and log management feast

In my last blog, I wrote about the ArcSight IPO and its significance to the marketplace. I pointed to the fact that ArcSight revenue jumped from just less than $40 million to a hair less than $70 million year-over-year, a metric illustrating just how hot the security management market is. Ditto for closely related log management. According to ESG research, nearly half of all enterprise companies collect at least a terabyte of log data each month, and this capacity continues to grow as more log data is collected from more devices and left online for longer periods of time. In this case, growth equals vendor opportunity.

With numbers like these, it certainly seems like security and log management are great businesses to be. Surely, EMC, IBM, Hewlett-Packard, and Novell think so--each of these firms either acquired or partnered to enter this space. With all of this writing on the wall, however, a few vendors that should be in the security and log management space remain on the sideline--an absolute mystery to me. Which companies? How about:

1. McAfee. McAfee claims to be the biggest pure-play security vendor, yet it doesn't sell a security information management solution. This would be like entering the fast food burger market to compete with McDonald's and not selling French fries. McAfee recognizes this weakness and says it is developing its own product in-house--the old day late and dollar short strategy at work.

2. Check Point Software Technologies. In fairness, Check Point does have some security management products but the company tends to focus on managing its own devices. Yes, Check Point does have its OpSec partners and integration tools but the company that distinguished itself with wonderful software functionality has steadily avoided the standalone security software management market. Check Point is still wildly profitable but security and log management could be its ticket to topping a billion dollars in revenue over time.

3. Microsoft. Eventually, Microsoft will tie security and log management together with Windows Server 2008, Microsoft System Center, and SQL Server, amongs others. As of today however, Redmond is a no-show.

4. The management crowd. I'm thinking about companies like BMC and Compuware. Security may be a stretch but log management is a foundational piece of compliance management, IT governance, and IT operations. As such, these firms should be in this marketplace.

I realize that technology vendors can't diversify willy-nilly but jumping into security and log management is not a stretch for any of the aforementioned firms. ArcSight could have fit into any of these companies' strategy. I just don't get it.