Cloud-based security solutions from MSPs will capture a growing share of SMBs’ spend in North America

Small (0–99 employees) and medium-sized (100–999 employees) businesses (SMBs) in North America spent over USD16 billion on cyber-security solutions in 2019. This represents one third of the total worldwide spend. Analysys Mason forecasts that SMB spending on cyber security in North America will reach USD28 billion by 2024, driven by organisations’ increasing reliance on technology and the need to protect assets. The growing importance of data security and the rising number of end users play a role in the increase in SMB spending on cyber security, but the adoption of new and more-advanced cloud solutions is the single biggest driver of this growth.

Not only are SMBs spending more on cyber security, but they are also shifting away from traditional channel partners. The proliferation of cloud solutions and the growing complexity of security infrastructure, coupled with a shortage of cyber-security specialists, means that firms are looking to providers for ongoing, managed support to maintain and administer their data security. As a result, SMBs are shifting an increasing share of their security spend from local resellers to managed service providers (MSPs) and hosters.

SMBs’ expenditure for cloud-based security services will increasingly exceed that for on-premises solutions

SMBs’ investments in cloud-based solutions are driving the growth in security spending. Currently, just over half of all security expenditure is on solutions that are cloud-based, rather than on-premises, and the gap is expected to widen (Figure 1). 7 out of every 10 dollars spent on data security will be for cloud-based solutions by 2024.

Figure 1: SMB security spending, split by on-premises and cloud-based solutions, North America, 2019–2024

Source: Analysys Mason, 2020

SMBs’ increasing prioritisation of more-advanced cloud-based security solutions and their digital transformation plans are driving growth in spending on cloud-based solutions, particularly for hosted security software, cloud-based mobile security and remotely managed security services. Spending on other security products, such as hardware, will continue to grow, but at a much slower rate.

Spending on hosted security software is projected to grow from 17% of the total spend (USD2.7 billion) in 2019 to 25% of the total spend (USD7.0 billion) by 2024. Spending on mobile security is expected to double over the same period, fuelled by a growing installed base.

The growth in spending on legacy technologies such as on-premises endpoint and network security, security hardware and product support services is expected to be slower. The penetration of such technologies is also projected to grow slowly (at about half the rate of that of cloud-based solutions). For example, the number of firms deploying dedicated appliances is expected to grow at a CAGR of less than 1% because firms will shift to using unified threat management (UTM) appliances that are capable of handling multiple security functions in a single device. We also expect that the prices for on-premises solutions (such as firewalls and dedicated appliances) will fall.

SMBs are shifting away from traditional channel partners due to cloud migration and digital transformation

SMBs’ ongoing cloud migration, digital transformation and rapid adoption of remotely managed services are leading to a shift from using traditional channel partners (such as local value-added resellers) to managed service providers and hosters (Figure 2).

Figure 2: SMB security spending, by routes to market, North America, 2019–2024

Source: Analysys Mason, 2020

Traditional channel partners’ (CPs’) share of security revenue will decline from 36% in 2019 to 26% by 2024. MSPs, hosters and service providers (SPs) will win an increasing share of the SMB market during the same period. We anticipate that the security-related revenue for these players will grow at a CAGR of over 15% over the 5 years to 2024.

Much of the change in the revenue split is due to the strong growth in the adoption of remotely managed security services. The shift to managed services is being driven by the lack of security specialists within SMBs and the growing need for help in managing existing security solutions. Spending on security support services (traditionally provided by CPs and vendors) is expected to remain flat, because ad-hoc, on-premises and phone-based support will give way to more-cost-effective, ongoing managed solutions.

Vendors’ direct share of security spending will decline slightly over the forecast period, despite the strong growth predicted for security revenue overall. Security vendors’ offerings that are sold directly to SMBs do not provide an adequate level of service, support and ongoing management.

SMBs value simple security solutions that are scalable and easy to install and use

Security value propositions that resonate well with SMBs include cloud-based products that are scalable and simple to install and maintain. Successful offerings should include a service component that covers both initial installations and on-boarding. Solutions that provide ongoing, remote maintenance of new and existing security infrastructure will also be in high demand.