Cybersecurity Isn’t Crowded: Security Engineering and the 5,000 Vendor Problem
Jan 10, 2025
auto_awesome
Ross Haleliuk, author of "Cybersecurity for Builders" and creator of the Venture in Security blog, dives into the complex world of cybersecurity. He discusses why the industry is less crowded than it appears and the critical divide between in-house security and vendor reliance. Ross also emphasizes the importance of balancing business needs with security engineering, sharing insights on addressing market problems for startups. The conversation highlights the ongoing need for knowledge sharing and innovation in this ever-evolving tech landscape.
The cybersecurity market is less crowded than perceived, with about 5,000 vendors, highlighting the unique challenges faced by security engineers.
Founders of cybersecurity startups must prioritize understanding market needs and avoid biases from their own experiences to innovate effectively.
Security engineering, recognized as essential today, is unevenly distributed across sectors, leading to ongoing reliance on third-party vendors for security solutions.
Deep dives
The Landscape of Cybersecurity Vendors
The number of vendors in the cybersecurity space is significantly fewer than in other tech sectors, with around 5,000 compared to 50,000 in fintech. This suggests that while cybersecurity is often touted as a universal concern, the actual market is not overwhelmingly crowded. Companies that typically need security the most often lack incentives to invest in it, creating a challenging environment for security engineers and vendors. This dichotomy indicates that while attackers continue to utilize established methods, the need for innovation in security products remains critical.
Cybersecurity Challenges for Startups
For those interested in founding a cybersecurity startup, the discussion emphasizes the importance of understanding market needs and biases in the development process. Many individuals entering this space often struggle with the misconception that security engineering will be the driving force for their future products, which may not always be the case. The conversation highlights that security solutions must effectively address specific business problems and not merely perpetuate the biases inherent in the founders' experiences. Recognizing the existing gaps and addressing unique issues can foster innovation while creating sustainable products.
The Future of Security Engineering
The perception that security engineering is the future is discussed alongside the notion that it is, in fact, the present, though not equitably distributed across industries. Many markets lack the incentive to hire dedicated security professionals or engineers, primarily reflecting a divide between tech-forward companies and those in traditional sectors. The conversation predicts this divide will persist, if not grow, meaning that companies will increasingly seek out security solutions from third-party vendors rather than build internal capabilities. This trend may hinder the maturation of comprehensive security engineering roles across industries far removed from the tech sector.
Trends in Cybersecurity
Despite the evolving landscape, fundamental challenges in cybersecurity remain largely consistent over time, such as email security, identity management, and cloud security. As outlined, effective attackers are likely to persist with proven methods unless compelled to change by significant new tactics or technologies. Security practitioners must stay vigilant about these consistent themes while also recognizing the necessity of continually adapting to emerging threats. As cybersecurity evolves, the fundamental areas of concern from today's perspective will likely remain relevant in the near future.
The Importance of Proper Evaluation in Security Purchases
When evaluating cybersecurity solutions, practitioners often find themselves overwhelmed by marketing claims and the complexities of product offerings. The problem is exacerbated by a tendency to overlook the full scope of one's own security needs, leading to dissatisfaction with new tools due to inadequately assessed capabilities. Different organizations have distinct security requirements, and decisions based on default settings can yield misleading results. A systematic and thorough evaluation process, including understanding past experiences with existing tools, is vital to ensure effective adoption and utilization.
In this episode our host Ashish Rajan sat down with Ross Haleliuk, author of Cybersecurity for Builders and creator of the Venture in Security blog, to explore the current state and future of the cybersecurity industry. From understanding the challenges of building a cybersecurity startup to the dynamics of security engineering and market trends for 2025. Ross and Ashish explore why the cybersecurity industry isn’t as crowded as it seems and the divide between companies that build in-house security and those that rely on vendors.
Ross also unpacks why sales and marketing aren’t “dirty words” in cybersecurity, why security engineering is “the present,” and how practitioners can balance business needs with technical aspirations.