Tactical Maneuvers

Why? Because Corsa considered Check Point to be overdistributed and could get higher margins from NetScreen, said Kevin Jackson, Corsa's vice president of sales. The solution provider saw Check Point as an an older vendor resting on its laurels, while NetScreen, which makes ASIC-based firewall/VPN appliances, was a hungry, young vendor taking off with compelling technology at a better price.

However, Check Point President Jerry Ungerman said his company provides high-quality products at prices that benefit its top partners by providing higher margins. "Check Point is the premium solution in the marketplace, and as such, the competitors have only one option, and that's to price their solutions lower," he said. "This is about security. It's not about price; it's not about getting the cheapest thing that gets by."

Still, there are plenty of signs that more solution providers are coming to the same conclusion as Corsa.

After about a half-dozen years of phenomenal growth, Israel-based Check Point, which has U.S. headquarters in Redwood City, Calif., saw its revenue drop more than $100 million last year, to $427 million in 2002 from $528 million in 2001. In contrast, NetScreen, which celebrated the first anniversary of its IPO in December, has enjoyed growing sales. Even during the down economy, NetScreen's revenue jumped 62 percent, with the company posting $138.5 million in revenue for its fiscal-year 2002, compared with $85.6 million in 2001.

In fact, NetScreen in 2002 grew faster than any of the established players in the market, said Jeff Wilson, analyst at Infonetics Research. Although it trailed Cisco Systems, Check Point and Nortel Networks in the worldwide firewall/VPN appliance market last year, NetScreen saw its share shoot up to 9.3 percent in the fourth quarter from 6.6 percent in the first quarter, according to Infonetics.

"NetScreen has definitely been on the upswing," Wilson said.

Of course, Check Point remains virtually synonymous with firewalls and dominates the software firewall/VPN market with 68.1 percent share as of last year. Yet solution providers say other security vendors such as WatchGuard Technologies and SonicWall are very successful in the small- and midsize-business firewall/VPN market, and NetScreen has made the most significant strides in what has traditionally been Check Point's primary target market,the enterprise.

While many solution providers hotly disagree with the assessment of Check Point offered by Corsa's Jackson, it is clear to many others that NetScreen's meteoric rise exposes a number of chinks in Check Point's armor as it battles to maintain its pre-eminent position in an increasingly competitive market. "A year or two years ago, when we talked about NetScreen, we had to explain what it was," said Tom Gobeille, president and CEO of Network Computing Architects, a Bellevue, Wash.-based integrator. "Nowadays it's rare we have to explain who NetScreen is."

Dan McCall, executive vice president at Guardent, Waltham, Mass., said he can also see evidence of NetScreen's growth among Guardent's managed security customers. "We probably manage as many NetScreen firewalls as we do Check Point," said McCall. "That's up from being mostly Check Point. NetScreen definitely is coming and taking market share from Check Point, especially in new installations."

And NetScreen offerings incur lower operational costs than Check Point's, McCall said. "It's just easier to install and maintain," he said. "NetScreen has done a great job of simplifying the firewall problem."

Increasing interest in the firewall/VPN appliance model also is building momentum for NetScreen, said McCall and other security solution providers. Check Point has partnerships with several hardware vendors to provide appliances, but NetScreen is attracting customers by providing "a one-stop shop for a security system," said Jim Tiller, chief security officer at International Network Services, a network consulting firm based in Santa Clara, Calif.

NetScreen also appears to be capitalizing on what some solution providers see as weaknesses in Check Point's channel model. "NetScreen is really trying to appeal to the channel," said Paul Rohmeyer, COO of Icons, a North Brunswick, N.J.-based security consulting firm that sells both NetScreen and Check Point. "Overwhelmingly, you get the sense from NetScreen that they're trying to play off of Check Point's weakness, which is [being] not too channel-friendly, particularly to small VARs."

Mark Smith, vice president of worldwide sales at NetScreen, said the vendor's strategy is one of underdistribution and direct touch with its solution providers. NetScreen counts about 500 partners in North America, which is down from about 700 a few quarters ago after the vendor thinned out its ranks. It has a limited agreement with distributor Ingram Micro to service small consultants, he said. Roughly 90 percent of NetScreen's business goes through the channel.

"You'll make good margins because we're not going to have thousands of partners," said Smith. "Secondly, you're going to have a direct relationship with us from a support, sales and engineering perspective."

Overdistribution of Check Point products is a common complaint among security solution providers. Network Computing Architect's Gobeille said his company winds up competing with many solution providers for Check Point sales, including ones that aren't qualified. "There's just no money in selling it," he said.

Not true at all, said Check Point President Jerry Ungerman. "On a global basis, I generally find that we are under-represented in the market," he said. "If I did a revenue-per-partner [comparison], I think ours is probably the highest revenue per partner than anybody today."

Often when solution providers complain that there are too many Check Point partners, Ungerman said he finds that they're calling on the same accounts as one another, adding that the company continually tries to balance which partners are calling large accounts vs. small accounts or particular vertical markets.

Check Point, which prides itself on selling 100 percent indirect and counts more than 1,100 channel partners in the Western Hemisphere, is always refining its channel programs, he said. To that end, the company plans soon to launch a new level and designation for partners that have built their businesses on Check Point, Ungerman said. The program is under development but will include leads, product access, support and marketing activities, he said.

"The more commitment they've made to Check Point and our OPSEC partners, the more benefits and rewards they will get," he said of solution providers.

Check Point's Open Platform for Security (OPSEC) certifies interoperability between its products and those of more than 300 vendor partners.

What's more, the company last week rolled out a channel program tailored for solution providers serving small businesses as part of an effort to branch out beyond its enterprise focus. Partners in the program will only be able to sell Check Point's products for small businesses.

Sean Stenovitch, president of Future Com, a North Richland Hills, Texas-based solution provider, said Check Point is on track with its plan to reward committed partners. His firm already enjoys a strong relationship with the vendor, he said.

Added Mark Miller, vice president of sales at Future Com: "We've had good success with them. They've been very proactive with us and very helpful in going into accounts with us. They've been extremely aggressive in trying to make us successful."

Mike Volk, president and COO of True North Solutions, a Herndon, Va.-based Check Point premier partner, said the vendor has a "ton of VARs," which puts downward pressure on margins. "That's somewhat of a concern, but there's still a fair amount of services you can wrap around Check Point to put a comprehensive solution together," he added.

Services such as integration and support are key, said Greg Hanchin, principal at Centennial, Colo.-based solution provider DirSec, adding that the investment his company made in Check Point has paid off profitably. "Those who complain about margins aren't providing value," he said.

But even Volk noted that it would be helpful if Check Point had more control over discounts, which he said are decided at the distribution level and create situations in which many solution providers vie for the same large accounts. Discounts need to be tiered by partner level, he said. Check Point sells its products through distributors Ingram Micro, Tech Data, GE Access and Westcon.

Ungerman said the vendor does tier discounts for partners with which it deals directly but hears complaints from larger partners that small partners can get roughly the same discount from distribution. "That's not a Check Point issue," he said.

However, pricing is an issue for Check Point, some solution providers said. In a tough economy, it's hard to sell customers on a premium-priced Check Point solution, particularly with lower-priced alternatives from NetScreen, Cisco and others, they said. "Business is tight, margins are smaller," said one Check Point partner who spoke on the condition of anonymity. The vendor could help by lowering prices, he said.

Pricing for the enterprise version of Check Point's VPN-1/FireWall-1 ranges from $2,500 for 25 IP addresses to $9,500 for an unlimited number of IP addresses. Pricing for the SmallOffice edition ranges from $400 to $3,750. Check Point also offers Safe@ solutions for small businesses and home offices through its SofaWare subsidiary. Those products are offered on appliances and are priced starting at $399.

NetScreen's prices range from $495 for its low-end appliances to $9,995 for its high-end devices.

Michelle Drolet, CEO of security solution provider Conqwest, Holliston, Mass., said NetScreen provides easy-to-manage technology at a good price but added that her firm earns higher margins on a Check Point sale. And, Check Point is reaching out more to partners, she said.

But another Check Point partner complained privately that the vendor has "a holier-than-thou attitude," which, combined with its high prices, is making it tough for him to remain loyal.

Some solution providers said NetScreen's purchase last year of OneSecure increased its chances of success in the security market. "We see a rich technology future around the NetScreen platform," said Guardent's McCall. "They've done a great job of getting into markets that logically belong in the firewall, like the intrusion-prevention software platform they bought from OneSecure."

Check Point last year unveiled SmartDefense, a technology integrated into FireWall-1 that detects and prevents attacks. Executives stop short of calling SmartDefense intrusion-detection technology, saying instead that it complements third-party intrusion-detection products. Still, some partners have said that Check Point's marketing of the technology has been confusing.

While some solution providers would like Check Point to be more aggressive in acquiring technology, DirSec's Hanchin said he's pleased with the company's development plans and said it has "exciting products coming up."

Clearly, though, Check Point has challenges ahead, including convincing some partners that its new channel efforts are on the mark. "Check Point has gone through some machinations [with its channel programs] recently," said Robert Cohen, president and CEO of CG Atlantic, a New York systems integrator. "I'm anxious to see the ramifications to VARs and the customers we represent, because installing, upgrading and maintaining firewall products is key to our business and our customers' businesses. I really hope Check Point knows what it's doing. If it isn't on target with this, there are alternatives."

But that isn't to say that NetScreen doesn't have its work cut out for it too. In addition to integrating OneSecure's technology, the vendor must work to retain partner confidence. "They still have a 'the more VARs the better' attitude," said one NetScreen partner, while another made note of a promising newcomer on the horizon: Fortinet, a maker of ASIC-based antivirus firewalls headed up by none other than Ken Xie, NetScreen's founder and former CEO.