Make Room Managed XDR, Here Come Managed Security Services

Cloud and AI are propelling security spending, 42% of which is going towards the fast evolving security services sector

Against recessionary headwinds, AI has supercharged big tech earnings (Microsoft +13.3% YTD, Google +27.3%)* and semiconductor stocks (NVIDIA +91.99%, TMSC +49.39%) ‒ rewarding investors who held or bought through a bumpy post-COVID ride. The same trend played out at the RSA Conference, where for the second year in a row, an AI security company, Reality Defender, won RSAC’s Innovation Sandbox competition. AI has become the next big act for tech companies since cloud, and the cybersecurity supply chain stands to benefit.    

AI, Cloud Drive Security Services Spending  

According to leading analyst firm Gartner, cloud and GenAI adoption are significant tailwinds driving global security and risk management spending to $215 billion as companies defend against malicious actors (security) and demonstrate adequate protection to regulators (compliance). The biggest growth segment for this market is security services ‒ defined as consulting, IT outsourcing, implementation, and hardware support ‒ which is forecasted to account for 42% of spend this year. 

From EDR to XDR to Managed Security Services     

The MSSP (managed security services provider) space is undergoing a sea change as vendors evolve to meet demand. Customers face a chronic security talent shortage, supply chain collateral damage as geopolitical tensions rise, and an unrelenting barrage of ransomware and cyber scams. In this environment, endpoint detection and response (EDR) are table stakes. To bolster defenses, organizations are turning to trusted partners to provide skilled experts and a broader suite of managed technologies that extend in-house capabilities.  

Companies are also grappling with more compliance regulations from the SEC’s updated incident disclosure rules to CISA’s incident reporting proposal. VP of Research Chris Steffen and Research Director Ken Buckler noted in Enterprise Management Associates (EMA)’s RSAC timed Vendor Vision Report 2024: “As global regulators tighten definitions for information security and privacy, the future of cybersecurity lies in the expansion of managed security service providers (MSSPs). This evolution extends beyond traditional definitions like XDR, integrating cybersecurity and compliance due to emerging security considerations.” 

A Fuller Suite Of Managed Security Services

Navigating these security threats and compliance complexities requires a fuller breadth of managed security services. “The continuous adoption of cloud, continuous hybrid workforce, rapid emergence and use of generative AI (Gen AI), and the evolving regulatory environment are forcing security and risk management (SRM) leaders to enhance their security and risk management spending,” said Shailendra Upadhyay, Senior Research Principal at Gartner. 

This broad classification of Security Services resonates at IDC. Analysts there cite a broad swatch of managed and professional services companies as brands to watch from pure play security providers like Qualys (QLYS -23.33%) and Trend Micro (TMICY -9.33%) to tech conglomerates like Cisco (CSCO -4.63%) and Oracle (ORCL +18.68%) to internet players like Verisign (VRSN -15.25%) and Verizon (VZ +3.03%) and global consultancies like InfoSys (INFY -.95%) and Wipro (WIT -1.46%).

Jonathan Ong, a Senior Analyst at Omdia, identified security operations centers (SOC), IoT, and OT as areas ripe for managed security expansion. This makes sense as GenAI lowers the barriers for malware coding knowledge, accelerating malware proliferation, which creates more signals for SOC investigations. On the IoT/OT side, “security service providers come in to bridge that IT-OT gap between security teams and floor managers to secure what are often legacy systems within acceptable timeframes.”  

Bobby Wolfe, the co-head of Houlihan Lokey’s Cybersecurity practice, noted the seismic impact of remote work in expanding attack surfaces and driving demand for a whole spectrum of cybersecurity services. “Customers today seek solutions beyond traditional managed security services. From pen testing and compliance to MDR and incident response, this dynamic market demands constant innovation to defend against the ever-growing threats."

MSSP Expansion Is A Bright Spot For The Tech Sector

Despite quantitative tightening, VC firms have steadfastly invested in AI and DevOps cybersecurity, making it a rare bright spot in stingy times. Both these areas are building blocks for MSSPs to scale detection and response. With MSSPs projected to account for $90 billion of cybersecurity spending this year, this space is poised to deliver more good news for investors navigating a layoff and inflation challenged market. 

*Quotes reflect May 17, 2024 stock prices at market close.