Security Information And Event Management (SIEM) Market - Outlook ( )

Transcription

1 Security Information And Event Management (SIEM) Market - Outlook ( ) explore@researchfox.com

2 ResearchFox Consulting is an Indian market research and consulting firm based in Bangalore. We strive to provide our clients with research data and reports which they can trust and analyze. Insights gleaned from our detailed and comprehensive research reports helps our clients stay ahead of trends. ResearchFox serves clients with services from data collection to analysis and reports. ResearchFox has extensive sector expertise and its consultants are abreast of global trends and issues across industries. Our areas of expertise include Manufacturing, IT, FMCG, Healthcare, Automotive, Government Sector and NGO, BFSI and Retail. Disclaimer : This report is furnished to the recipient for information purposes only. Each recipient should conduct their own investigation and analysis of any such information contained in this report. No recipient is entitled to rely on the work of ResearchFox Consulting Pvt.Ltd. contained in this report for any purpose. ResearchFox Consulting Pvt. Ltd. makes no representations or warranties regarding the accuracy or completeness of such information and expressly disclaims any and all liabilities based on such information or on omissions therefrom. The recipient must not reproduce, disclose or distribute the information contained herein without the express prior written consent of ResearchFox Consulting Pvt.Ltd. Copyright ResearchFox Consulting Private Limited 2

3 Table of Contents 1. Introduction 1.1. Report Description 1.2. Objective 1.3. Scope of the Research 1.4. Regions Covered 1.5. Key Takeaways 1.6. Key Stakeholders 1.7. Key Terminologies 1.8. List of Abbreviations 2. Executive Summary 2.1. Executive Overview 3. Research and Forecasting 3.1. Research Methodology 3.2. Forecasting Methodology 4. Industry Landscape 4.1. Market Size and Growth 4.2. Competitive Landscape 4.3. Market Share 4.4. Company Classification 4.5. Region Outlook 4.6. Market Metrics 4.7. Porter's Five Forces Model 4.8. Key Drivers Analysis 4.9. Key Constraints Analysis Key Opportunities Identified Key Challenges Identified 5. Market Segmentation 5.1. Region North America Europe APAC South America ROW 5.2. End User Enterprise Mid Size Small Business 5.3. Deployment Cloud On-Premise Hybrid 5.4. Industry Financial Services IT & Telecommunication Government Retail Healthcare Education Others 6. List of Tables 7. List of Charts 3

4 List of Tables Table 1: Market Estimation and Forecast Methodology, 2015 Table 2: Significance and Importance of the Market Forecast, 2015 Table 3: Market Size and Forecasting, Table 4: Market Share, 2014 Table 5: Classification By Company Headquarters Table 6: Classification By Headcount of the company Table 7: Market Metrics Table 8: Competitive Landscape, 2014 Table 9: Market Drivers Ranked in Order of Impact, Table 10: Impact of Top Industry Drivers on Business Functions, Table 11: Market Constraints Ranked in Order of Impact, Table 12: Impact of Top Industry Constraints on Business Functions, Table 13: Market Opportunities Ranked in Order of Impact, Table 14: Impact of Top Industry Opportunities on Business Functions, Table 15: Market Challenges Ranked in Order of Impact, Table 16: Impact of Top Industry Challenges on Business Functions, Table 17: Market Size & Forecasting of North America By Region, Table 18: Market Size & Forecasting of Europe By Region, Table 19: Market Size & Forecasting of APAC By Region, Table 20: Market Size & Forecasting of South America By Region, Table 21: Market Size & Forecasting of ROW By Region, Table 22: Market Size & Forecasting of Enterprise By End User, Table 23: Market Size & Forecasting of Mid Size By End User, Table 24: Market Size & Forecasting of Small Business By End User, Table 25: Market Size & Forecasting of Cloud By Deployment, Table 26: Market Size & Forecasting of On-Premise By Deployment, Table 27: Market Size & Forecasting of Hybrid By Deployment, Table 28: Market Size & Forecasting of Financial Services By Industry, Table 29: Market Size & Forecasting of IT & Telecommunication By Industry, Table 30: Market Size & Forecasting of Government By Industry, Table 31: Market Size & Forecasting of Retail By Industry, Table 32: Market Size & Forecasting of Healthcare By Industry, Table 33: Market Size & Forecasting of Education By Industry, Table 34: Market Size & Forecasting of Others By Industry,

5 List of Charts Chart 1: Market Size and Forecasting, Chart 2: Region Outlook, 2014 Chart 3: Market Size & Forecasting of North America By Region, Chart 4: Market Size & Forecasting of Europe By Region, Chart 5: Market Size & Forecasting of APAC By Region, Chart 6: Market Size & Forecasting of South America By Region, Chart 7: Market Size & Forecasting of ROW By Region, Chart 8: Market Size & Forecasting of Enterprise By End User, Chart 9: Market Size & Forecasting of Mid Size By End User, Chart 10: Market Size & Forecasting of Small Business By End User, Chart 11: Market Size & Forecasting of Cloud By Deployment, Chart 12: Market Size & Forecasting of On-Premise By Deployment, Chart 13: Market Size & Forecasting of Hybrid By Deployment, Chart 14: Market Size & Forecasting of Financial Services By Industry, Chart 15: Market Size & Forecasting of IT & Telecommunication By Industry, Chart 16: Market Size & Forecasting of Government By Industry, Chart 17: Market Size & Forecasting of Retail By Industry, Chart 18: Market Size & Forecasting of Healthcare By Industry, Chart 19: Market Size & Forecasting of Education By Industry, Chart 20: Market Size & Forecasting of Others By Industry,

6 dfgfd dfgfdh dfgfh dfhgf Introduction 01 6

7 1. Introduction 1.1. Report Description With growing usage of Internet, businesses across the globe are using web based applications in their dayto-day operations. Increasing number of employees and other stakeholders access the company's digital assets regularly. It becomes next to impossible for the in-house incident response team to keep a track on who is accessing what content and at which point of time. With growing traffic on the network, they would also fail to keep a track on the network related activities and these lapses could invite trouble to company's digital assets in the form of cyber threats or attacks. Keeping a tab on these things manually is proving a painful activity to the personnel. And, as this process involves sensitive issues like the data security of the company, any kind of delays to respond to suspicious activities may prove costly to the company both financially and from the reputation point-of view. To counter these, businesses, especially large enterprises have started implementing Security Information and Event Management (SIEM) solutions that automatically monitor and store the log and activity information which can be used by the company to negate any kind of cyber threats. The growing incidents of sophisticated attacks where businesses are being targeted irrespective of their geographical presence and despite of having all necessary IT infrastructure in place is worrying the businesses. This, along with the existing strong compliance policies of the countries are proving to be catalyst in the growth of IT security solutions like SIEM. Because businesses are now realizing that it is better safe than sorry. The market for Security Information and Event Management (SIEM) solution is catching up and this report provides deep insights on how the market is expected to fare in the next five years. It also presents interpretative and easy-to-understand facts on how the current SIEM market is segmented based on the deployment type, the major verticals that have been implementing these, the end-user group of these SIEM solutions and also based on the geographic regions Objective 1. To understand the Security Information and Event Management (SIEM) market across the globe by addressing the challenges faced by the industry with regards to the adoption of Enterprise SIEM solutions. 2. To estimate the size of present global Security Information and Event Management (SIEM) market and to forecast its future values Scope of the Research Scope of the research was limited to understanding the market share across segments. Key drivers, constraints and challenges along with their impact on various business functions in both short term and long term were addressed. Segmentations and forecasting were done based on: 1. End-User 2. Verticals 3. Deployment Type (On-premise vs Cloud vs Hybrid) 4. Region Based Segmentation 7

8 1.4. Regions Covered 1. North America (US, Canada and Mexico and other countries) 2. Europe (United Kingdom, France, Germany, Italy, Spain and other countries) 3. APAC (Australia, India, China, Japan, Singapore and others) 4. South America (Brazil, Argentina and others) 5. RoW (Middle East and Africa, South America, Russia and other countries) 1.5. Key Takeaways 1. North America is growing at a much higher rate than other geographies in terms of adoption and the revenue generated from this region is highest. Europe and APAC are far behind in this race of adoption. 2. The market for Security Information and Event Management was USD million in 2014 and is expected to grow at a CAGR of close to 12.85% till Deployment wise, traditional on-premise SIEM solutions have the highest market share but Cloud based SIEM and Hybrid SIEM solutions are slowly eating up this market share and are experiencing greater adoption rate than on-premise SIEM solutions. 4. Enterprise level businesses still remain the major consumers of these solutions and even the small and medium level businesses are also catching up in the race of adoption. 5. Financial institutions, Government organizations, IT & Telecom, Retail, Education and Healthcare companies have emerged as the major users. This is because, usage of Internet among these companies is rising and hence would require proper security solutions in place to protect the network infrastructure Key Stakeholders 1. Enterprise Security Information and Event Management solution and product providers: Enterprise SIEM solution providers will be able to gauge the market more accurately as this will assist them in better decision making. Also, the product developers would be able to develop products according to the requirement of the customers. 2. End-User companies: Report will provide the end-users, a more clear picture on the solution provider demographics so that they can choose among the best. 3. Global Investors: Those investors who look to fund new and budding cloud based SIEM solution provider start-ups, will get clear picture about the market and its trends. 4. Industry Watchers: Industry and trend watchers are always referred to as trusted advisors who follow markets. The report would add to their knowledge repository, creating value for their know-how. 8

9 1.7. Key Terminologies 1. APAC: Mainly includes Australia, India, China, Japan, Singapore and other nations in the region 2. Europe: Mainly includes United Kingdom, France, Germany, Spain and other European nations 3. MEA: Mainly includes Israel, South Africa, UAE and other nations 4. North America: Mainly includes United States of America, Canada, Mexico and other North American nations 5. South America: Mainly includes Brazil and Argentina and other South American nations 6. Enterprise: Companies with an employee headcount above Mid-Size: Companies with an employee headcount between Small-Business: Companies with an employee up to BYOD (Bring Your Own Device): Bring Your Own Device refers to the policy of permitting employees to bring their own devices, such as laptops, smart phones and tablets to their workplace. 10. Security Information and Event Management (SIEM): A security management approach that help companies to identify and prevent security breaches early. 11. Health Insurance Portability and Accountability Act (HIPAA): A federal act that makes easier for people to uphold the confidentiality of their healthcare information or data. 9

10 1.8. List of Abbreviations 1. BYOD: Bring-Your-Own-Device 2. USD: United States Dollar 3. CAGR: Compound Annual Growth Rate 4. USA: United States of America 5. APAC: Asia-Pacific 6. IT: Information Technology 7. RoW: Rest of the World 8. UK: United Kingdom 9. R&D: Research and Development 10. SMB: Small and Medium Businesses 11. HITECH: Health Information Technology for Economic and Clinical Health Act 12. GLBA: The Gramm-Leach-Bliley Act 12. MASSIF: Management of Security information and events in Service Infrastructures 13. NIA: National Investigation Agency 14. UAE: United Arab Emirates 15. SIEM: Security Information and Event Management 16. FFIEC: The Federal Financial Institutions Examination Council 17. PCI DSS: The Payment Card Industry Data Security Standard 18. SSN: Social Security Number 10

11 dfgfd dfgfdh dfgfh dfhgf Executive Summary 02 11

12 2. Executive Summary 2.1 Executive Overview Internet is turning out to be a major facilitator for many of the operations of the businesses. Many of the departments like sales and marketing, research & development, operations have been using internet to improve their efficiency. Growing use of Internet means, multiple users accessing the company's digital assets at the same time. On a positive note, this would improve the efficiency of the entire company, but growing network activity would also mean, need for more monitoring and management of events across the company's digital assets. The incident response team of the company come under immense pressure and this would hamper quality of their work. This would also invite risk of data breaches as the manual detection of suspicious activities would amount to lapse of crucial time that would otherwise save the company from cyber-attacks. Use of manual processes are generally time consuming and would not be as accurate as the automated processes. And any delay in timely detection of cyber threats would result the data thefts and other related security breaches. To counter these issues, many of the enterprises these days are actively adopting necessary IT security solutions which includes Security Information and Event Management (SIEM). The demand for SIEM solutions are steadily increasing, thanks to the growing security threats. Also, the existing compliance regulations are prompting many of the businesses to adopt these solutions voluntarily in order to avoid hefty fines. Security Information and Event Management is a combination of Security Information Management (SIM) and Security Event Management (SEM). While SIM is responsible for collection of login information and other related data and generate an automated report for further analysis, SEM draws some analysis and trends from the information events that has occurred. Combined together, SIEM provides a comprehensive real time analysis of on-going activities and report these activities to the company personnel automatically so that the company can initiate any preventive measures in case of detection of any suspicious activities or cyber-attacks. Implementation of Security Information and Event Management solutions is happening among enterprises to adhere to certain compliance standards. In countries like the USA and UK, the existing compliance standards makes it mandatory for companies to have certain IT security solutions which includes SIEM as well. Several of the IT product based companies, Network Security companies, IT security companies and cloud service provider companies dominate the service provider market and many of the new start-up companies are also entering the arena by introduction of cloud based SIEM solutions. Security Information and Event Management Market Growing Steadily With growing frequency of attacks, security monitoring solutions like SIEM is expected to flourish further. The Global Security Information and Event Management Market - Outlook ( ) report suggests that the overall market was valued at USD million in 2014 and is expected to grow at a steady CAGR of 12.85% till The introduction of cloud based SIEM solutions and also the Hybrid SIEM solutions would also add to the growing market. North America - Highest Revenue Contributor with Highest Adoption Rate; Europe and APAC - A "yet-to- 12

13 grow" Market. As always, North America, especially countries like the USA and Canada have been the top adopters of this technology and the region contributes the most in terms of revenue. The main reason being, that businesses here are vulnerable to attacks and the frequency of attacks is way too high when compared to other regions. Europe and Asia-Pacific market have limited adoption and the revenue generated from them is comparably low. Europe, in particular is showing some positive signs of growth but the revenue generation is still less. Asia-Pacific market, on the other hand is a mixed bag, where businesses of developed countries like Japan and Singapore are adopting the solutions, but growth still lags in countries like India and China. Going forward, as the business related activities here heats up, the rate of adoption is expected to go up. On-Premise SIEM solutions losing its market share to Cloud and Hybrid SIEM. No doubt on-premise SIEM solutions contribute the most to the overall SIEM market. But, due to the complexities involved in terms of adoption, high initial investment costs and introduction of cloud based and hybrid SIEM solutions is driving businesses away from on-premise deployment model. The adoption rate of cloud and hybrid SIEM solutions is higher and is expected to grow further. This is because, going forward, all those enterprise level businesses who earlier adopted on-premise SIEM solutions would also start partially adopting cloud based solutions. Along with this, small and medium businesses across the globe are also expected to start adopting these solutions. Enterprises are the major consumers, Financial Services are the top adopters. Enterprises are the major consumers of these solutions as they are the most frequently targeted end-user segment of all. These businesses also consists of large number of employees who use Internet to reach out to their customers. This has prompted them to adopt SIEM solutions which can reduce the manual tasks and automatically detect the risks or any other abnormal events. Among the verticals, Financial Services companies have emerged as the major users of these solution. Many of banking, insurance and other finance related companies across the globe are facing innumerable attacks every day-in and day-out. To counter these, many of these businesses have been implementing these solutions. Businesses in this vertical are known to seek advanced forms of Security Information and Event Management solutions as well. The Underlying Challenges One of the greatest challenge for growth of SIEM market is the complexities involved in implementation of SIEM solutions, the skilled workforce required to effectively manage them and the high initial investment costs. A majority of these issues is now being addressed by the introduction of cloud and hybrid SIEM solution. But the user base of SIEM solutions now require more effective solutions which can counter the sophisticated attempts of attacks by early detection and reporting. Another notable issue is to educate the customers about the effectiveness of such solutions especially in the emerging markets. Most of these markets having limited technological exposure and do not dedicatedly use them in their operations. Convincing the customer about the necessity of such solutions would be another major challenge that provider companies have to concentrate upon. 13

14 With introduction of cloud based SIEM solutions and with making the existing solutions customer friendly, most of these challenges can be successfully addressed by the provider companies. The R&D teams of the solution providers have to constantly enhance their product features in order to deliver what the customer actually wants. 14

15 dfgfd dfgfdh dfgfh dfhgf Research and Forecasting 03 15

16 3.1. Research Methodology Base Year: 2014 Forecasting Period: Sampling The leading suppliers of each end-user product categories that were chosen to provide a larger representative sample. Purposive unit sampling was adopted for every service segment such as verticals, regions, end-users and others. This was resorted to, in order to elicit the appropriate inputs with regard to the qualitative growth aspects of the market Secondary Research The research methodology that was carried out was desk research through various journals, association reports, and in house database to build a knowledge base on various market service segments, product categories and industry trends. Various fact based data was analyzed. Some of the sources included: a. ResearchFox Knowledge Base: Previous data on the market has been put through a rigorous and comprehensive analysis to analyze the current state. b. Desk Research: Industry reports, annual reports, press releases, webinars, journals and publication, independent rating agencies and government statistics Primary Research Primary interviews were conducted among various stakeholders: Product and service companies Members of associations and alliances Subject Matter Experts and Evangelists Consultants and Strategists 16

17 Industry Information It was essential to understand the current industry landscape, market dynamics, security ecosystem and competitor metrics. To estimate the global market, Chief Experience Officers (CXOs), Marketing Heads, Sales Managers and product stakeholders were interviewed Technical Information In addition to the interviews with leading participants for industry-related information, ResearchFox conducted interviews with Research and Development (R&D) and Design and Development teams to understand the current usage of the products by service type and also to find out the emerging trends. Finally, interviews with suppliers were conducted to cross check the validity of information and also to understand the emerging trends in the end-user segment. The detailed methodology for primary research is outlined below Primary Interview Questionnaire Design ResearchFox developed a detailed questionnaire, which was used by the analysts as a guide for their discussions. This process ensured the collection of all necessary data. The questionnaire was designed to elicit unbiased industry level data (market size, production, sales, and others), that had check points (questions such as company level information and their position in the industry acted as check points) to ensure accuracy of the data. The questionnaire included the following sections: 1. Industry level information 2. Characteristics and Dynamics 3. Company-specific information 4. Market segmentation data Interview Questionnaire Test and Validation Following the design of the questionnaire, ResearchFox carried out some initial interviews to verify that the appropriate market and technology data was generated. After the final design of the questionnaire, ResearchFox began full scale primary research. Specific companies targeted for primary research interviews were selected based upon market participation. Higher was the entity's profile, more attractive was the entity. 17

18 Interview Process As participants respond in the course of an interview, ResearchFox analysts are trained to move from lower priority and/ or sensitive topics to increasingly key and/or sensitive topics in response to the interviewee's behavior. This responsive and reflective interview process, combined with the analysts' ability to discuss the industry and technical issues in an open and sharing environment, allows ResearchFox to probe for key data, operations, and competitive information. Multiple contacts within a single organization and with an individual are often planned and/or staged in order to optimize and complete the information gathering process Research Validation At a point, when 20 percent of the research interviews and/or data collection had been completed, ResearchFox consultants evaluated the preliminary findings to assure that up-to-date results are in line with project objectives. The analyst team analyzed the information from the interviews and information was validated through a combination of the following validation techniques: Cross checking with other primary data and previously developed in-house research Review of secondary information, such as trade journals, annual reports and industry directories 18

19 3.2. Forecasting Methodology Step-by-Step Methodology for Market Estimation and Forecasting Table 1: Market Estimation and Forecast Methodology, 2015 Step 1 Method Understand the market mechanism for the market through structured, systematic and theoretically established norms of analyzing, designing, introducing and quality assurance of the market estimation 2 Measuring the various market drivers, constraints, opportunities and challenges at regular intervals of time 3 Integrate expert-opinion of discussions in consultation with the ResearchFox Analyst team 4 Market estimation and forecast calculation 5 Delphi method and Causal Analysis used as and when required 6 Rigorous quality check with heads of Research Team, Subject Matter Experts and Consultants before final publication Source: ResearchFox Table 2: Significance and Importance of the Market Forecast, 2015 Sr. No. Significance and Importance 1 Helps revisit on the company's R&D investments 2 Keeps the Sales and Marketing team posted on the market prospects 3 Strategize investment and expansion plans 4 Improve business planning 5 Helps create business aims and set sales figures within the company 6 Aware of the current market competition 7 Support plans for Merger and Acquisition (M&A) Source: ResearchFox 19

20 dfgfd dfgfdh dfgfh dfhgf Industry Landscape 04 20

21 4. Industry Landscape 4.1. Market Size and Growth Market Size Global market size of Security Information and Event Management was USD million in 2014 and is expected to reach USD million in IT security software providers are the major providers of these solutions and until now, enterprise level business have been the major consumers of this solution. Going forward, as the Cloud based and Hybrid SIEM solutions become affordable and as their popularity grows, even the small and medium businesses are expected to start the adoption. Growth Rate Global Security Information and Event Management market was estimated to be worth USD million in 2014 and is expected to reach USD million by 2019 growing at a CAGR of 12.85%. Among the regions, North America and Europe contribute the most to the overall market revenue and North America continues to maintain a higher growth rate compared to other geographies. Increase in incidents related to network infrastructure attacks or growing breaches in the networks are forcing businesses across the geographies to closely monitor their digital assets. Manual monitoring of the network activities is becoming a cumbersome process due to increased activities on the network. Also, with increased cyber threats and attacks, the management is becoming even tougher. This has prompted many of the businesses to look for solutions that would automatically intimate companies about the ongoing network activities and also record and report any kind of suspicious activities. To address most of these issues, several IT security related watchdog institutions and country's intelligence organizations encourage every companies to implement security monitoring tools like SIEM. However, with growing sophistication of attacks, miscreants are also coming up with new tactics to breach company's digital assets. This again, has increased the demand for need of better and advanced SIEM solutions. Also, the introduction of new cloud based and hybrid SIEM solutions are helping those companies which earlier could not afford traditional on-premise SIEM solutions. The market for SIEM solution is expected to grow and the forecasted future market values are as shown in the table below. 21

22 Revenue and Forecasting Table 3: Market Size and Forecasting, Year Revenue (USD Million) Revenue Growth Rate , , % , % , % , % , % CAGR: 12.85% Source: ResearchFox Chart 1: Market Size and Forecasting, Market Size (in USD Million) Growth Rate (%) 22

23 4.2. Competitive Landscape Table below suggests the competitive demography of the SIEM Market Table 4: Competitive Landscape, 2014 Parameters Details Number of Companies in the Market 70 Types of Competitors Distribution Structure Tiers of Competition Notable Acquisitions, Mergers Key End-User Groups Competitive Factors Computer and Network Security Software providers IT & Telecom software and service providers IT Security providers 68% - Direct Sales Channel 32%- Indirect Sales Channel (Resellers, VAR's, Distributors) Tier 1: Well established companies with Market grip on IT security products Tier 2: Large and Midsized companies that are seeing growth Tier 3: Companies with less market share IBM acquired CrossIdeas, a provider of security software that governs user access to applications LogLogic acquired by TIBCO Q1 Labs acquired by IBM Enterprises Mid-size business Small business Enables companies to adhere to certain security compliance standards Automates IT infrastructure monitoring with lease human intervention Allows companies to initiate necessary actions to avoid cyber threats or attacks Source:ResearchFox 23

24 4.3. Market Share The top 6 companies listed below consists of a combination of IT software provider, Network security companies, and Pure IT security software provider companies. This shows that the service provider demography is a mixture of various types of companies. The other prominent players who reflect in the top 10 list as per the market share include, TripWire, TIBCO, Logrhythm, Dell SecureWorks and others. Table 5: Market Share, 2014 Company Market Share Hewlett Packard 19% EMC 14% IBM 14% Splunk 8% McAfee 7% Juniper Networks 3% Others* 35% Source:ResearchFox * Tripwire, TIBCO, Logrythm, NetIQ, Dell Secureworks & Others 24

25 4.4. Company Classification By Company Headquarters It is evident that more than 60% of the overall Security Information and Event Management solution vendors originate from North America and this is due to the fact that most of the cyber-attacks happens in these regions evidently which has prompted businesses here to adopt SIEM solutions pro-actively. Hence most of the solution providers are based out of this region as it is easy to reach to their customers. Table 6: Company Headquarters Category No. of Vendors North America 45 Europe 12 APAC 9 Other regions (includes South America, Israel and others) 4 Source:ResearchFox By Headcount of the company The vendor landscape is mainly dominated by the enterprise level companies that consists of more than 1000 employees. This is due to the requirement of high level of R&D costs involved which is affordable by the large companies. However, the number of small and medium companies offering these solutions is also expected to increase in the future due to introduction of solutions like cloud based SIEM. Table 7: Headcount of the company Category No. of Vendors Source:ResearchFox 25

26 4.5. Region Outlook Chart 2: Region Outlook, 2014 * Market Size in USD Million ROW Market Size :42.15 USD million Market Share :2.31% CAGR : 3.85% 26

27 4.6. Market Metrics Table 8: Market Metrics Parameters Measurement Trend Market Age Growth Phase - Base year revenue (2014) USD million Increasing Potential revenue (2019) USD million Increasing Base year market growth rate (2014) 11.01% NA Compound Annual Growth Rate ( ) 12.85% NA Price sensitivity 5 Increasing Competitors (active market competitors in base year) 70 Increasing Degree of competition 7 Increasing Customer satisfaction 5 Increasing Customer loyalty 4 Increasing * On a scale of 1 to 10; 1:very low, 10: very high Source: ResearchFox 27

28 4.7. Porter's Five Forces Model Threat of new entrants The threat from new entrants is high. The SIEM market is witnessing entry of players like the pure IT security providers, Network Security companies, small start-ups, large IT companies and many more. Thus, the market is now filled with large enterprises, mid-level companies and also the small emerging players. Hence once can clearly say that competition is expected to heat up in the solution provider market. Intensity of Competition The solution provider landscape is growing with new players entering the competing arena. The solution providers consists of large enterprises as well as small start-ups. Also, the players vary from being a pure cloud based SIEM providers, IT software product providers, IT security vendors and network security vendors. Hence, one can say that the intensity of competition is High. Threat of substitute products or services Threat of substitute products can be said to be Medium. This is because, there have been attempts made to bring out the alternatives to SIEM solutions as, in many instances, these solutions have failed to deliver anticipated results. Enhanced SIEM solutions like cloud based and Hybrid SIEM solutions are expected to replace traditional SIEM solutions. Hence the threat can be termed to be Medium. Bargaining Power of Customers The presence of various kinds of solution providers and with the introduction of cost effective cloud based SIEM solutions, one can easily say that the customers have various alternative companies to choose from. This gives customers a greater liberty to switch from one provider to other. Hence, we can say that 28

29 bargaining power of customers is High. Bargaining Power of Suppliers Bargaining power of suppliers is Low, as the market is flooded with small and large solution providers. There is no scope for any kind of vendor lock-in and the suppliers are governed and driven by customer's requirements. So, once can say that the solution providers have very less say in deciding the trend of the SIEM market. 29

30 4.8. Key Drivers Analysis Over the last few years cyber-crime has increased drastically. Research suggests that it has increased over 10% in 2014 from that of the previous year. USA alone has lost USD million in FY 2014 through cybercrimes followed by Germany USD 8.13 million and Japan by USD 6.91 million. In order to prevent cybercrime, a thorough real-time monitoring is required. Use of SIEM solution could help counter such attacks through improved security intelligence and analytics. The table given below suggests the various drivers ranked in order of impact for SIEM market. Table 9: Market Drivers Ranked in Order of Impact, Rank Drivers 1-2 Years 3-5 Years 1 Growing compliance & Regularity Mandates Medium High 2 Rising level of sophistication of cybercrimes High High 3 Improving security and efficiency Medium High Source:ResearchFox The table given below suggests the impact of various drivers on business functions. Table 10: Impact of Top Industry Drivers on Business Functions, Rank Drivers Sales Marketing R&D Bus. Dev. and Corp. Mgmt. 1 2 Growing compliance & Regularity Mandates Rising level of sophistication of cybercrimes Medium High High Medium High Very High High Medium 3 Improving security and efficiency Medium High High Medium Source:ResearchFox 30

31 4.9. Key Constraints Analysis Customers are still much unaware of the special security tools like SIEM. They believe that using a standalone security software is more than enough to fight cyber-security threats. Customer education is needed in such cases and consultative sales approach is expected to work better. The table given below suggests the various constraints ranked in order of impact for SIEM market. Table 11: Constraints Ranked in Order of Impact, Rank Constraints 1-2 Years 3-5 Years 1 Unavailability of resources to investigate effectively High Medium 2 Lack of awareness in understanding and selecting SIEM/Log Management Platform High Medium Source: ResearchFox The table given below suggests the impact of various constraints on business functions. Table 12: Impact of Top Industry Constraints on Business Functions, Rank Constraints Sales Marketing R&D Bus. Dev. and Corp. Mgmt. 1 2 Unavailability of resources to investigate effectively Lack of awareness in understanding and selecting SIEM/Log Management Platform Low Medium Medium Medium Low Medium Medium Medium Source: ResearchFox 31

32 4.10. Key Opportunities Identified Currently, the state of the SIEM industry suggests that the providers largely target enterprise customers given the limited opportunities they see across mid-market and small businesses. Going ahead this opportunity needed to be explored with special focus on the mid-market segment. This segment currently looks dynamic with high cash flow. The table given below suggests the various opportunities ranked in order of impact for SIEM market. Table 13: Opportunities Ranked in Order of Impact, Rank Opportunities 1-2 Years 3-5 Years 1 Penetration in the mid-market business segment Medium High 2 Offering cost effective cloud SIEM solutions Low High 3 Marketing SIEM solutions through consultative sales approach Low Medium Source: ResearchFox The table given below suggests the impact of various opportunities on business functions. Table 14: Impact of Top Industry Opportunities on Business Functions, Rank Opportunities Sales Marketing R&D Bus. Dev. and Corp. Mgmt Penetration in the mid-market business segment Offering cost effective cloud SIEM solutions Marketing SIEM solutions through consultative sales approach Low Medium Low Medium Low Medium Low Medium Low Medium Low Medium Source:ResearchFox 32

33 4.11. Key Challenges Identified A big challenge most of the security providers face is the fact that they are unable to catch-up with the advanced security attacks that hackers and cyber-miscreants rage against consumers. This remains a main challenge for security service providers as their solutions are at times in-capable of delivering upon their expectations. The table given below suggests the various opportunities ranked in order of impact for SIEM market. Table 15: Impact of Top Industry Challenges, Rank Challenges 1-2 Years 3-5 Years 1 Ever changing advanced methods of security threats Very High Very High 2 Inconsistency in security mandates across regions and industry verticals High Medium Source: ResearchFox The table given below suggests the impact of various opportunities on business functions. Table 16: Impact of Top Industry Challenges on Business Functions, Rank Challenges Sales Marketing R&D Bus. Dev. and Corp. Mgmt. 1 Ever changing advanced methods of security threats High High High High 2 Inconsistency in security mandates across regions and industry verticals No Impact No Impact No Impact No Impact Source: ResearchFox 33

34 Market Segmentation 05 34

35 5.1. Region North America Market Size and Forecasting North America, especially countries like the USA and Canada are the biggest contributor to the Security Information and Event Management (SIEM) market. The rate of adoption is much higher among the businesses of this part of the world. Both the provider market and the consumer market are biggest in the region. Many IT security software providers originate from North America and have a large pool of customers who are also majorly from North America. In 2014, more than 45% of the overall SIEM revenue was realized from North America businesses. Going forward, in 2018, this revenue contribution is expected to be more than 51%. With growing incidents of cyber-attacks in the region, the demand is expected to grow even more in the years to come. The table given below suggests that the SIEM market in North America generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 15.39%. In other words we can interpret that the market share for this region would increase from 46.18% in 2014 to 51.62% in The probable reasons for growth of SIEM market in North America include: 1. Growing incidents of cyber-attacks in the region due to increased identity thefts and unauthorized access into a company's digital assets. 2. To adhere to the compliance standards set by the governing authorities. Many of the policies and Acts governing the Healthcare and Financial industry in USA like the HIPAA, HITECH, Sarbanes Oxley and GLBA makes it mandatory to have SIEM solutions to monitor security events in the businesses. 3. Log and security information management becoming a complex task due to increased activities of employees who access digital resources of company more often. Table 17: Market Size and Forecasting of North America, Year Revenue (USD (Million)) Revenue Growth Rate % , % , % , % , % CAGR: 15.39% Source: ResearchFox Chart 3: Market Size and Forecasting of North America,

36 Market Size (in USD Million) Growth Rate (%) 36

37 Europe Market Size and Forecasting Programs backed by European Commission's FP7 ICT works such as MASSIF (Management of Security information and events in Service Infrastructures) has enabled the advancement of technologies like SIEM in the region. Thus, this has increased the adoption of SIEM solutions across different verticals thereby enabling the growth of market. In a combined effort involving the leading SIEM solution providers, support from government bodies and the leading educational universities of the region, MASSIF is intended to provide various techniques that would help in early detection of upcoming threats and provide early counter measures. Thus, the market for SIEM is flourishing in the region. In 2014, more than 25% of the overall revenue for SIEM was realized from this region. The table given below suggests that the SIEM market in Europe generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 12.94%. In other words we can interpret that the market share for this region would increase from 26.45% in 2014 to 26.56% in The probable reasons for growth of SIEM market in Europe include: 1. Technological advancement especially in the big five countries of the region, i.e., the UK, France, Germany, Italy and Spain as a part of their Eurovision has increased the demand for solutions like SIEM. 2. European countries have one of the toughest data privacy laws on the globe which makes it mandatory for businesses to have solutions like SIEM in order address any kinds of cyber-attacks. 3. Increased frequency of cyber-attacks in the region. Table 18: Market Size and Forecasting of Europe, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 12.95% Source: ResearchFox Chart 4: Market Size and Forecasting of Europe,

38 Market Size (in USD Million) Growth Rate (%) 38

39 APAC Market Size and Forecasting Market for SIEM mainly revolves around the technology oriented countries like Japan, Singapore, Australia, China and India. Most of the revenue contribution in the region mainly comes from the businesses located in these countries. Compared to North America and Europe, Asia-Pacific regions lag in terms of adoption. The main reasons attributed for this are the lack of technology understanding among companies of the region, the complexities involved in implementing these solutions and the scarcity of quality workforce who can manage these solutions. A mere 20% of the revenue was generated in 2014 by this solution in the region in But, on the optimistic note, the market is growing at a slower rate compared to that in North America or Europe. The table given below suggests that the SIEM market in APAC generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 8.59%. In other words we can interpret that the market share for this region would decrease from 21.50% in 2014 to 17.74% in The probable reasons for growth of SIEM market in Asia-Pacific include: 1. Growing users accessing company's digital information via web thereby resulting in increase in the log events related information. 2. Businesses in the region moving from old, traditional, less effective manual processes towards automation especially with the use of IT solutions. 3. Growing incidents of identity thefts in the region thereby requiring more security monitoring and identification of threats before they strike. 4. Stronger compliance related policies by the governments making it mandatory for businesses to possess these solutions. Table 19: Market Size and Forecasting of APAC, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 8.59% Source: ResearchFox Chart 5: Market Size and Forecasting of APAC,

40 Market Size (in USD Million) Growth Rate (%) 40

41 South America Market Size and Forecasting Revenue contribution from South America towards SIEM was less than 4% in The market in this part of the world is still new. Only few technology oriented countries like Brazil and Argentina have been adopting these solutions. Few of the global IT companies who have their presence here, have been offering Security Information and Event Management Solutions. As the market here is still new, solution providers have the opportunity to view this market as a great potential going forward. The table given below suggests that the SIEM market in South America generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 5.65%. In other words we can interpret that the market share for this region would decrease from 3.56% in 2014 to 2.56% in The probable reasons for growth of SIEM market in South America include: 1. Improving knowledge among the businesses about the importance of analyzing and monitoring their log events. 2. Growing number of users accessing the digital content of businesses using usernames and passwords. 3. Increasing incidents of data and identity thefts among businesses of the region. 4. Government authorities trying to implement certain compliance policies to businesses who possess their customer data. Table 20: Market Size and Forecasting of South America, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 5.65% Source: ResearchFox Chart 6: Market Size and Forecasting of South America,

42 Market Size (in USD Million) Growth Rate (%) 42

43 ROW Market Size and Forecasting Most of the businesses in other parts of the world are least aware of these technologies and hence have been not able to adopt these solutions. Also, generally, most of the SIEM solutions are complex to implement and management and would also require high initial investments. All these factors have deterred companies from implementing SIEM. But, some of the companies in Middle East and Africa have slowly started progressing in terms of adoption. As of now, this has enabled some growth of the market. In 2014, the contribution from this geographic market towards global SIEM market was just above 2%. The table given below suggests that the SIEM market in RoW generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 3.85%. In other words we can interpret that the market share for this region would decrease from 2.31% in 2014 to 1.52% in The probable reasons for growth of SIEM market in RoW include: 1. Growing knowledge about the importance of having proper IT security solutions supporting business operations. 2. Increased incidents of cyber-attacks and identity thefts in the region. Table 21: Market Size and Forecasting of ROW, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 3.85% Source: ResearchFox Chart 7: Market Size and Forecasting of ROW,

44 Market Size (in USD Million) Growth Rate (%) 44

45 5.2. End User Enterprise Market Size and Forecasting Bigger business houses often deal with more complex user cases as compared with the smaller firms. While interacting with stakeholders in the enterprises, we have noted five major pain areas around SIEM which includes securing big data usage, real-time incident reporting, situational awareness, deployment flexibility and lack of integrated security solution. With a large number of providers still offering traditional SIEM solutions, the bigger players in the market has started to extend their support in developing SIEM products capable of handling complex security infringements. The table given below suggests that the enterprise segment of SIEM market generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 13.10%. In other words we can interpret that the market share for this segment would increase from 57.97% in 2014 to 58.56% in The probable reasons for growth of Global SIEM market in Enterprise segment include: 1. Complex nature of cyber-attacks on larger enterprises 2. Insider attacks (employees) being conducted 3. Employee mobility and use BYOD concepts 4. Real-time incidence reporting 5. Growing compliance & Regularity Mandates Table 22: Market Size and Forecasting of Enterprise, Year Revenue (USD (Million)) Revenue Growth Rate , , % , % , % , % , % CAGR: 13.08% Source: ResearchFox Chart 8: Market Size and Forecasting of Enterprise,

46 Market Size (in USD Million) Growth Rate (%) 46

47 Mid Size Market Size and Forecasting The mid-size or mid-market companies has the second largest share of SIEM users among other sections of the end-user segment. Large mid-market companies remain serious on adopting SIEM solutions given the level of intrinsic data this set of companies deal with. This in a way offers an option for service providers to pitch through and convince in buying such security products. The table given below suggests that the mid-size segment of SIEM market generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 12.70%. In other words we can interpret that the market share for this segment would decrease from 26.47% in 2014 to 26.28% in The probable reasons for growth of Global SIEM market in mid-size segment include: 1. Complex nature of cyber-attacks on larger mid-market companies 2. Sensitive nature of data handling 3. Insider attacks (employees) being conducted 4. Employee mobility and use BYOD concepts 5. Need for real-time incidence reporting 6. Growing compliance & Regularity Mandates Table 23: Market Size and Forecasting of Mid Size, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 12.68% Source: ResearchFox Chart 9: Market Size and Forecasting of Mid Size,

48 Market Size (in USD Million) Growth Rate (%) 48

49 Small Business Market Size and Forecasting Small businesses mostly run on shoe string budgets, not enough to afford advanced technological equipment. This goes even for security software. The larger pie of these companies use basic version of software in order to fight security threats. Hence SIEM finds itself in poor state among this set of companies. The table given below suggests that the small business segment of SIEM market generated revenue of USD million in 2014 and would be USD million in 2019 growing at a CAGR of 12.30%. In other words we can interpret that the market share for this segment would decrease from 15.56% in 2014 to 15.16% in The probable reasons for growth of Global SIEM market in small business segment include: 1. Sensitive nature of data handling 2. Insider attacks (employees) being conducted 3. Employee mobility and use BYOD concepts 4. Growing compliance & Regularity Mandates Table 24: Market Size and Forecasting of Small Business, Year Revenue (USD (Million)) Revenue Growth Rate % % % % % CAGR: 12.27% Source: ResearchFox Chart 10: Market Size and Forecasting of Small Business,

50 Market Size (in USD Million) Growth Rate (%) 50