Security

sector

The average gross margin for network security was 18.4 percent in the 2007 CRN Profitability Study, off 1 percentage point from a revised 2006 average of 19.5 percent. Meanwhile, the average for client/desktop security was 14.6 percent, off 5 percentage points from the revised 2006 average.

"There is no longer the margin there was a year ago," said Steve Barone, CEO of Creative Breakthroughs, a $16 million solution provider in Shelby Township, Mich. "You have to earn that money back in integration."

While the average deal size for network security rose to $25,100 from $17,500 year over year, the average deal for client/desktop security, which many solution providers concede has become a commodity sale, slipped to $7,200 from $10,600.

Still, other metrics illustrate solution providers are able to recoup their investment in a security practice more quickly than in the past, although this finding was disputed anecdotally by at least one of the solution providers interviewed.

The study shows it typically takes 5.4 months to recoup training costs in network security, while the time frame for client/desktop security is 3.8 months. The median sales cycle for network security is three months, the same as a year ago, while it takes a mere two months to close client/desktop security deals—the shortest time for the 13 practices evaluated in the profitability report.

Next: A look at the security profitability numbers

"If you sit down with a client and you expect him to give you his network and everything with it, your first responsibility is to secure the network," said Bill Beyer, president of Business Equipment Center of Atlanta, a $5 million solution provider.

Gene Gliniecki, director of network and telecommunications at Infinity Technology in Green Bay, Wis., said customer interest in network security is quite high, but understanding is quite low. Indeed, the percentage of solution providers that report network security is of at least moderate importance to their customers rose to 82 percent in 2007. This was the highest percentage across the entire survey.

With product margins shrinking, especially on the client side, Gliniecki said the focus of his company's security engineers has been on developing network analysis and security audit services that make it easier for a prospect or an existing account to understand their vulnerabilities as part of their network strategy. "It's education, trying to get folks to understand," he said.

The potential for contract-based audit services has grown, he said, because threats change every day. The introduction of VoIP applications, for example, another fast-growing area, introduces new network vulnerabilities and points of exploitation. "We can charge a premium for scans," Gliniecki said.

Tracy Butler, president of Acropolis Technology Group, Wood River, Ill., said his company has addressed the morphing security dynamic by including it as part of its core network contracts. Almost 90 percent of his company's contracts are now fixed-fee-based and a majority of them include a managed services component. "We don't get granular on the invoice with the model numbers, so they can't shop things around," he said. Acropolis runs at 50 percent to 60 percent margins across all of its services, he said.

The 2007 CRN Profitability Study shows solution providers earn a median of $3 in services for every dollar of network security product sold. The ratio for the client/desktop area is $2:$1.

Butler admitted corporate procurement policies are making Acropolis' fixed-fee approach harder and some of his best clients are starting to ask for invoice breakdowns. So, when this interview was conducted, he was evaluating a plan for Acropolis to create purchasing portals tailored to specific clients that would provide them a discount for purchasing online and according to certain terms.

"We will charge more for things we have to handle or if the client needs terms," Butler said.