Why there are so many cybersecurity vendors and where do we go from here

Post by kyboren » Thu, Jul 06, 2023, 10:50 PM UTC

   A lemon market will be produced by the following:
    
   1.    Asymmetry of information, in which no buyers can accurately assess the value of a product through examination before sale is made and all sellers can more accurately assess the value of a product prior to sale
   2.    An incentive exists for the seller to pass off a low-quality product as a higher-quality one
   3.    Sellers have no credible disclosure technology (sellers with a great car have no way to disclose this credibly to buyers)
   4.    Either a continuum of seller qualities exists or the average seller type is sufficiently low (buyers are sufficiently pessimistic about the seller's quality)
   5.    Deficiency of effective public quality assurances (by reputation or regulation and/or of effective guarantees/warranties)

Post by marcus0x62 » Thu, Jul 06, 2023, 10:56 PM UTC

alephnerd wrote: post #29

marcus0x62 wrote: post #27

Earlier quoted context omitted.

That's not far off from a pew pew map[0]. Maybe you could start the first pure-play, best-in-breed security visualization company with AI-enabled[1] executive dashboards[2] 0 - https://www.csoonline.com/article/562681/8-top-cyber-attack-... 1 - disclaimer: not actually AI enabled 2 - pew pew map

It's called Cyber Ranges. SafeBreach, SimSpace, and Cymulate do similar stuff. That said, there is value to this (testing security policies before pushing to enforcement)

Post by JohnFen » Thu, Jul 06, 2023, 11:02 PM UTC

alephnerd wrote: post #23

PakG1 wrote: post #18

Earlier quoted context omitted.

Sure, but there are SOME that aren't selling snake oil. I'm invested in one of them. But yeah, most are. I guess the interesting question for me is how long does it take for the real wheat to stand out from the chaff.

Honestly, I think the wheat becomes chaff. You might have an amazing product that solves a relevant security issue but Enterprise sales cycles and checkbox driven procurement force you to incorporate half baked features in order to capture the next fad. Look at the XDR hype train 3 years ago, ZTNA 2 years ago, and the whole CNAPP/CASB/CSPM buzzword BS Tbf, I am being a bit dramatic about it, but I feel the split pers…

Post by sylens » Thu, Jul 06, 2023, 11:03 PM UTC

ChuckNorris89 wrote: post #13

sylens wrote: post #6

Earlier quoted context omitted.

Most times, you would get ten times the value by taking the money you would spend on these tools, hiring a security engineering department, and letting them build you tools backed by open source software.

What logic did you use to come up with that statement? Tools like Nessus and Burpsuite Pro cost around 6-8k/year. Good luck hiring a security engineering department on a 8k/year budget that will build and maintain you tools of similar quality lol.

Post by alephnerd » Thu, Jul 06, 2023, 11:06 PM UTC

JohnFen wrote: post #35

alephnerd wrote: post #23

Earlier quoted context omitted.

Honestly, I think the wheat becomes chaff. You might have an amazing product that solves a relevant security issue but Enterprise sales cycles and checkbox driven procurement force you to incorporate half baked features in order to capture the next fad. Look at the XDR hype train 3 years ago, ZTNA 2 years ago, and the whole CNAPP/CASB/CSPM buzzword BS Tbf, I am being a bit dramatic about it, but I feel the split pers…

Such is as it's always been. A few years ago, I worked for a B2B enterprise data security firm. We didn't sell snake oil at all -- but our customers were so used to hearing snake oil salesmen talk that they had very odd demands that didn't improve their security. And in some cases, reduced it. Dealing with those expectations was always an issue.