IDC MarketScape: Asia/Pacific Managed Security Services 2020 Vendor Assessment

As industries make rapid progress in their digital transformation journey on the back of growing regulatory pressure and an increasingly sophisticated threat landscape, many organizations are facing difficulties in maintaining a robust security posture. Perhaps more importantly, with the rising significance and impact of cybersecurity, it is no longer viewed as an exclusively technical or compliance issue, but a business and strategic issue that deserves deliberations in the boardroom. Insufficient awareness about the organization’s response plan or lack of preparedness could severely impact business operations and the organization’s reputation.

Accordingly, more and more CISOs or heads of IT security are now summoned to boardroom meetings to present the company’s security strategy, communicate the value of security investment, and provide cyber risk updates, and so forth. The elevation of security from an add-on element to the strategic imperative status in many organizations have also increased the demand for security services such as managed detection and response, and managed threat intelligence. This increase in demand, in turn, helps drive the growth and evolution of the regional security market, where newer players seek to expand in the area, while traditional market leaders continue to enhance their offerings. Against the backdrop of these new developments, the Asia/Pacific managed security services (MSS) market is shaping up to be highly competitive and vibrant, from which organizations in the region could benefit immensely.

Using the IDC MarketScape model, IDC evaluated 19 organizations between 2019 and 2020 that offer MSS in the region. The assessment reviews the organizations against a broad set of parameters that define current market demand and expectation of MSS buyers. These include breadth of MSS offerings, portfolio benefits, threat life-cycle capabilities, cloud security, delivery model, cost management, market execution, geographic presence, thought leadership, innovation, customer satisfaction, and customer advocacy. Through primary research, in-depth interviews of vendors, and their customer references, IDC evaluated the service providers (SPs) to identify their strengths, and their challenges in the market. Some of the notable themes found in the study are:

• Varying maturity, varying objectives. The Asia/Pacific market is arguably the most heterogenous in nature, and as such, there is a high degree of variation in digital maturity among different organization and industries within the region. The objectives and motivations in engaging with an MSS provider also vastly differ according to the maturity levels across the market. IDC found that more mature customers, mainly those belonging in the highly regulated industries, look to vendors to augment their in-house security teams with the provider’s expertise, IP, frameworks, or processes that are contextualized to the organization, or industries. In contrast, the less mature customers prefer to outsource most, if not all, of the security and compliance responsibilities to these MSS providers. Thus, vendors with end-to-end, comprehensive portfolio and vertical expertise would have an upper hand in winning accounts from both categories of customers.
• Customer centricity, the common denominator. Despite the differences in motivation and objectives, one thing in common between these two customer groups is the need to be customer-centric when it comes to services design, onboarding, and delivery. Customer centricity is reflected by managed security SPs’ flexible delivery models, such as MSS-as-a-service option. Having this adaptive and cloudified option is especially important for clients when a growing number of workloads are moving to multiple public and private cloud. Complexity has never been greater as organizations often find themselves with unused, partially installed, and poorly configured security tools that they have accumulated over time.
• There is a need for managed security SPs to address complexities, de-risk the cloud migration process, and, more importantly, optimize the cloud investment, including those embedded security tools as part of an infrastructure-as-a-service (IaaS) subscription and/or leveraged cloud security tools from security vendors. IDC observes that a vast number of participating firms could leverage on-premise security information and event management (SIEM), cloud SIEM, and a hybrid of these to offer flexibility and customer-oriented value propositions.
• Cloud takes center stage. Many organizations have, at this point, adopted cloud-based security services, and also progressed on the cloud security front, which is an indication of the improving proficiency of managed security SPs’ cloud security capabilities. For instance, cloud monitoring, cloud access security brokers (CASB) support (mainly for protection of software as a service, or SaaS) are experiencing growing momentum in the region. Some of the managed security SPs with telecommunication providers offer their own security embedded cloud offerings that automate and orchestrate many security functions for threat detection and reporting. Furthermore, many of the participating firms in the study have enhanced their native cloud security capabilities and push offerings such as DevSecOps services.
• Innovative user interface (UI), enhanced user experience (UX). Customer centricity also underlies innovation at the interface level. Some of the identified leaders clearly lead the way in terms of user experience features that closely mirror social media, where app-like and Uber-style mechanisms assign available analysts to incidents and shows a stream of threat investigations, alerts, and updates. Moreover, the interface will be enabled with potential voice-controlled digital assistants.