I Spy Integration

When it comes to security technologies, spyware removal is definitely hot. Just look at last year, when sales of antispyware software reached $565 million--a 175 percent jump from 2004, according to the IDC global market forecast.

"Antispyware business right now is crazy. We don't have to do a lot of marketing around it," says Doug Ford, president of IT Pros, an IT-outsourcing firm that serves 25-to-100-node networks in the San Diego area. "It used to be virus defense, but over the past 12 to 18 months, we've focused most of our installations on spyware defense. It's not a difficult sell. Everyone knows what spyware is and what it does to their networks. Everyone's got a spyware story to tell."

Antispyware solutions have been so hot, in fact, that the installed base had reached 84 percent by the end of last year, according to IDC. But the market, which IDC predicts will grow 35 percent this year, has by no means leveled off yet. IDC forecasts 22 percent growth in 2007 and smaller increases until 2010, when sales are expected to level off at $565 million. (The Radicati Group puts that number much higher, at $1.4 billion.)

With the initial sales rush behind them, security VARs stand to make sales in the next two years if they can do a good job of navigating a market that's shaking out over best-of-breed applications vs. software suites, appliances vs. client-server, and features vs. functions. Success hinges on the ability to map client needs to the options available going forward, industry observers say.

"Smaller companies are scared, and they want to turn to their trusted advisers, not someone just to fill orders," says Sam Curry, vice president of security management at CA. "Companies of all sizes want their resellers to understand the impact on their business, why [antispyware] is important for business continuity, how business and security is being managed and how risk is actually impacted."

By understanding client needs as threats and technology change, opportunities for upsell, add-ons and outright swapping are ripe for the picking, say VARs and analysts.

"The really great thing about antispyware is it's something that people need," says Richard Stiennon, chief research analyst and founder of the Birmingham, Mich.-based market-analytics firm IT-Harvest. "So the opportunity for upsell at the moment is to use antispyware as a lead-in to everything else--desktop management, patch management, assessments and more."

NEXT: Manageability: A Central Issue

Up to this point, the best-selling antispyware tools have been standalone products from market-leading vendors CA, McAfee and Webroot, according to IDC. The majority of those sold were from Webroot, which led the worldwide antispyware market in 2005 with $70 million in revenue and 24 percent market share, according to IDC.

In smaller organizations, there's been a lot of mixing and matching of security technologies, and spyware protection is an integral component. For customers in the 25-to-100 seat range, IT Pros configures Webroot's best-of-breed antispyware with Symantec's enterprise security suite and SonicWall's gateway appliance that's bundled with McAfee antivirus.

Ford disagrees with those who argue that dedicated antispyware products aren't centrally manageable. For his managed-service clients, Ford has no trouble tying these disparate tools together and centrally managing them. And because it focuses only on spyware, Webroot is the most effective detection-and-removal tool on the market, he says. As such, he uses Webroot's reputation as a selling point to replace other, less effective antispyware removal tools.

"Our major goal is centralized administration, and Webroot meets that goal," Ford says. "We use only Webroot for spyware protection. If our customers are running something else, we rip out the antispyware piece and run Webroot."

Last Ford checked, McAfee, Symantec and Trend Micro were too heavy for his clients.

True, large suites such as the ones McAfee and Symantec offer can be heavier, slower and more reactive than a dedicated antispyware product, admits Randy Cochran, Symantec's vice president of channel sales for the Americas. But none of the antispyware products captures all instances of spyware regardless of whether they're suite or standalone, he adds.

"The real problem is the bad guys and the ever-changing threat landscape they present," Cochran says.

VARs serving midmarket companies and enterprises are enjoying the most growth selling integrated antivirus, secure-messaging, antispyware, firewall and access-control systems, according to analyst reports.

IDC analysts say sales of integrated suites will accelerate in 2007, while standalone sales remain flat. Integrated anti-malware system sales will surpass standalone sales in 2008 and reach $400 million in 2010. Most of this growth will be due to enterprise purchases of suites.

"It used to be that I needed separate antivirus, filtering and antispyware solutions," says Todd O'Bert, president of Productive Online, a CA partner in Minneapolis. "That market has matured. I'm looking at it more as overall threat management, and antispyware is part of that."

So far, only 30 percent of CA's clients use the combined eTrust PestPatrol antispyware and antivirus product, according to Curry. The remaining 70 percent use a different vendor for their antivirus software--integrated with PestPatrol. But once licensing contracts come up for renewal, he expects more enterprises to migrate toward the CA suite.

"The best-of-breed-vs.-suites debate will swing over to suites," Curry says. "It's a false trade-off because [customers] may not get the best antispyware or best antivirus. So they need to be educated on the benefits of moving to a suite."

The most important benefits, say antispyware vendors and resellers, are deployment, modularity and the ability to centrally manage and add security products as new threats evolve.

"At first, our customers didn't want to rip out their antivirus infrastructures so we developed a standalone antispyware product based on our integrated module," says Ed Metcalfe, product-marketing manager at McAfee. "Then our customers started asking for the ability to manage antivirus and antispyware [programs] from one central console and report on those together."

NEXT: Next Step: Integration

McAfee's standalone solution, continues Metcalfe, was an attempt to go after users of Webroot's Spy Sweeper and other standalone products who didn't want to replace their antivirus programs.

"[Antispyware] is the foot in the door that our reseller partners need for acquiring new business," Metcalfe adds. "Once they've deployed our antispyware, customers could easily use the same engine for antivirus."

Currently, most end users--75 percent--are buying standalone antispyware applications. The increasing sophistication of spyware and volume of network traffic are prompting customers to ask--and solution providers to deliver--integrated anti-malware solutions.

Integrated suites are in themselves problematic, particularly from the whole buy-vs.-build approach to integration. Of all the suite vendors, Symantec, which chose a buy approach for its many security products, has fared the worst in this department. Its reputation for poor integration of acquired technologies and being spread too thin has placed Symantec far behind all the other integrated-solution vendors, according to IDC.

Prior to Version 10 (the current version), Symantec's integrated security solutions weren't integrated enough for Matt Scherocman, vice president of consulting services for the PCMS IT Advisor Group in Cincinnati. Once Version 10 got the kinks worked out, he quickly migrated his clients to Symantec for central manageability.

"[Now] we like Symantec because they're channel-friendly, and you can use their same central-management console for antivirus[as you can] to manage your antispyware," he says. That's not to mention the bundling potential with any number of Symantec's managed and self-managed security tools, appliances and services, he adds.

Every time you present a new bundle and increase functionality, you're creating a natural reason to upgrade, notes O'Bert, who sees the immediate opportunities in the $5,000 to $10,000 antispyware-sales range for his midmarket customers.

Patch management, vulnerability assessments, messaging security (particularly for instant messaging) and VoIP protections are natural add-ons for software suites that include antispyware, O'Bert says. VARs are also asking for additional defense functions, such as protection against rootkits, which are increasingly being used to load or hide spyware, according to vendor and analyst studies. Earlier this year, McAfee reported that the use of rootkits for hiding spyware has grown 600 percent in the last three years to include 2,300 Windows-based stealth components. Meanwhile, rootkit complexity has grown by more than 900 percent, according to the report.

Antispyware vendors claim to defend against rootkits the way they defend against spyware--pattern and behavior recognition, blocking of executable programs, etc. Because they run beneath the Windows API or in memory and hide their activities, rootkits can't be found through most traditional anti-malware technology.

"Our clients are sophisticated enough to know that with rootkits, [conventional] protection technologies don't always work as advertised," O'Bert says. "So this is an area that vendors can improve on and where VARs can bring added security value to their clients."

Future Antispyware Fortunes

Ultimately, the integrated spyware-protection leader could wind up being Microsoft, which is woefully behind the market and not even listed in IDC's antispyware forecast.

Microsoft's spyware-detection tool, Windows Defender, is "actually a decent product," says Scherocman, whose company is an award-winning Microsoft partner. "Right now, it's standalone and unmanageable. But once they integrate their antispyware into the new Vista operating system, Microsoft could move to the top of the chart."

It's possible, but doubtful. Microsoft's integrated antivirus software has had little impact on the overall commercial antivirus market.

The fact remains that antispyware--at least for the next few years--will still be a top concern for SMB and enterprise clients. And that, experts say, spells opportunity for resellers, service providers and integrators.

"Because spyware itself tends to be multilayered, there are opportunities for resellers at the gateway, server, session and desktop levels," says Ed English, chief technical officer of Trend Micro's antispyware, Venus Spy Trap, division. "The main pain point for your clients is spyware. So it's an in for whatever security [VARs are] selling."