Because I’m into that kind of thing, I usually start off the day by reading the press releases from security (and other IT) vendors. Usually, this stuff isn’t very exciting (there’s a lot of bluster and hot-air on the wire), but today I found an interesting one – or at least one that made me think.
This morning, Webroot announced their addition to CRN magazine’s 2006 Emerging Technology vendor list. Alright, that in and of itself is not that interesting – but what *is* interesting is reading between the lines to
speculate how Webroot is faring over all based on this announcement.  As you know, Webroot is privately-held, so we don’t get
the same kind of insight into their economics as we do with their publically-held
competitors.  So any clue that we can get is a good one.

Now, before getting into this, I want to go on record as saying this is
entirely speculation and I am not doing down Webroot;
I actually happen to like Webroot.  In addition, I reserve the right to be
totally wrong, so this could all just be hot-air.  However, if you'll
indulge me in a bit of speculation, this announcement does not appear to me as
if it bodes well for Webroot's long-term health. What? It’s true – it looks
good on the surface, but even though the announcement sounds positive, I don’t think it is.
Let's break it down, and I think you'll start to see why I say that:

Non-dominant market share: If you take a look at the criteria for how CRN chooses emerging vendors, you’ll notice that
market share is the number one most important criteria – but not in the way
you'd probably expect; to make this list, you have to not be the market leader in your space. More specifically, according to CRN, “1. In established markets/product categories, the vendor could not be a dominant market-share player.”
Last year. Webroot was

dominant in the spyware space; as a result, they would have been ineligible for inclusion in this
particular directory. So last year they had the market and now they don’t?
Woah Nelly, that's not a good sign… particularly in an industry that tends to favor the market leader.

Direct vs. Channel Sales: Number four criteria for inclusion in the list is, “4. The company had to demonstrate that its direct-sales mix was trending down, as evidenced by the company’s revenue history.” Now, we know that Webroot’s long term goal is to be 100% channel by 2007, so in-and-of-itself, this is not a warning sign. Where I think the warning sign is, however,
is why they want to be 100% channel; more specifically, what does the
100% channel model imply about the makeup of the Webroot customer base? We know that channel sales
are a very effective SMB sales tool, but
we also know that they're not as effective a tool for the large enterprise. Reading between the lines, I interpret Webroot’s strategy as moving toward concentration in the SMB
while moving away from larger enterprises. Now, that's not to do down SMB – there’s a market there to service for sure – but I had thought the Webroot direction was toward the larger enterprise.
The growth curve usually encompasses SMB first and then branching out to larger
and larger firms – the reverse, moving from larger to smaller, is usually a sign
of decline in the marketplace.  Additionally, I'm wondering about the
investment they've already made.  The large enterprise play is certainly marketed by them and discussed by analysts – -
clearly they've invested heavily.  If so, why are they backing off?

Comparison with other vendors: The complete list of other emerging security vendors at CRN is as follows: 8e6 Technologies, Application Security, Array Networks, BioPassword, Bit9, Bradford Networks, ConSentry Networks, FireEye , Lightspeed Systems, MX Logic, Network Management Group, Palisade Systems, Passlogix, Port Authority Technologies, Red Condor, Senforce Technologies, Solutionary, TrustELI.
Now, trust me, I am *not* about to do-down these other vendors… There are some great players in that list
and a number of firms that I watch closely and strongly support. However, what I would point out is the
discrepancy between the funding received by Webroot (for example, the 108 million dollar influx of last year) and the funding received by the other vendors on the list. 
For example, Senforce and MXLogic (their peers according to CRN) received
12 million dollars
and
26 million
respectively…  not the same ballpark. Recall Webroot’s competition: Symantec, CA, McAfee, Trend, and Microsoft…
If it was me, I’d be pretty scared if two of the top five largest software companies in the world were my competitors,
and more scared to peered with firms with 1/10th my backing. 

Now, I reserve the right to be totally wrong, and I certainly mean no disrespect
to folks over at Webroot.  But I'm not sure this is good press for them; I
question why they would concentrate their marketing dollars here. 
Yesterday, I probably would have speculated that Webroot's in good health. 
Today, I'm not so sure. 

Have
you seen the ads for the "Truth
in Software Commission" hearings over at BigFix.  If you haven’t seen
it, I highly recommend checking it out.  Their satirical content is
absolutely hilarious and it’s very much worth the trip (trust me, it’s long on
laughs and short on the hard-sell for their products.)  Not to wax verbose
on this, but even their logo is laugh-out-loud funny (provided they don’t move
it anytime soon, you can see it on the right of this entry.)  The tagline,
"Duc Ergo Sum", could be roughly translated to "You build [it] therefore I am". 
Classics humor… not something you see in infosec very often.

All very interesting, and I found it somewhat ironic that the article I saw it
on (the article on which I saw the advertisement) was one of the original
"post-retraction" articles where Microsoft president Jim Allchin was paraphrased
as saying that Windows Vista is so secure

it won’t require AV.  Now, before you
get
all worked up like I did when I first heard that, take a moment and look at

his response to all the hubbub…  it turns out that he said something
a bit more reasonable than how it was originally portrayed – what he really
said was hubris-free, unlike how it was originally spun.  And as of now,
we’re pretty much back to where we started – except with a bunch of
retractions,

clarifications, and general

backtrackery in the industry press. 

So all-in-all, we’re net-zero after the "Allchin Incident".  Now you might
be wondering – if we’re net-zero, why am I bringing it up?  Because of an
interesting lesson in all this…  Now, on the surface, there’s the obvious
lesson of "don’t believe everything you read", but that’s not the lesson I’m
talking about… misquotes and misinterpretations of statements happen, so I
don’t think we should expect that they won’t (or shouldn’t).  Instead, the
lesson I’m talking about is the willingness on the part of the public and the
part of the journalist community to expect hubris on the part
of Microsoft and damn them for it when it happens.  Now, that’s OK, but
what I think is unfair is piling on the big M while simultaneously ignoring (or
encouraging) the same type of hubris from other firms.  Here’s what I
mean…  This thing with Allchin was a pig-pile, right?  I mean, it
was the same kind of journalistic feeding-frenzy you see in post-midterm
Whitehouse press briefings… brutal.  But compare that frenzy with the
reaction of the press to statements made by Oracle VP Hasan Rizv’s comments
earlier this year:

In an IT environment there are lots of complexities and if you look at
the Oracle software, people have to apply the patches… Our customers are
so used to high security that when there is a vulnerability they don’t apply
the fix because they are not used to it, which is an interesting position to
be in.

Now, I blogged
about this because the hubris of that statement (not to mention it’s
inaccuracy) seriously got under my skin, but there was pretty much no response
from the mainstream industry press… other that is than the sound of crickets
all around.  Or remember when Larry Ellison went on record saying that
Oracle hasn’t
had a security problem in twenty years? Where was the pig-pile then? 
Ellison’s statement was inaccurate, misleading, and dangerous.  But still
the crickets won the day.

Or take Apple… who has unrelentingly pushed the "no malware" message in
absence of provability and contrary to empirical evidence.  I’ve
griped about
that plenty in the past, so I won’t go through it again. But guess what? 
When Apple makes a statement like this – not only does it not hit the press (at
least as something negative,) but humble bloggers who dare to criticize it get
their email boxes filled with hostility.  So here’s my question: clearly,
we’re more eager to tear Microsoft down for doing this than other firms. Why is
that?  Shouldn’t we hold other firms to the same standard?  Isn’t it
just as offensive when a Oracle makes a statement like this (and really means
it)?  Shouldn’t it be?  I’m not going to say we should tolerate hubris
from Microsoft.  Clearly, we should react in the way that we did and call
them on it.  But why do we continue to tolerate this from everybody else?

Wow, all this news about Symantec’s Security 2.0: it was covered in the Register, in news.com, in Information Week and so on. Apparently calling the malware problem “solved”, John “we’re more than antivirus” Thompson is apparently moving the firm in an entirely new direction (for them) – a direction that has them concentrating on transactional elements of information security rather than platform aspects; a strategy of trust rather than a strategy of fear. Interesting. But what’s more interesting than that, in my opinion, is the change to the way that Symantec typically does business.

In past, for example, we’ve seen a typical pattern emerge in the way that Symantec approaches building the enterprise portfolio – we’ve seen them buy products to round out the portfolio like Veritas or BindView and we’ve seen them buy service companies like @stake. However, this new strategy of partnership with service companies in combination with development (rather than purchase) of new products is a new one. I’ll be curious to see if it works the way Thompson is hoping. I’m also interested to see what type of marketing dollars Symantec is willing to spend to get the kind of adoption that they need for the products to be a success. I guess we’ll have to wait and see…

Hey, are you reading RiskAnalysis.is? You should be. Even if you don’t read it on a regular basis, go and read Fear and Loathing in OS X Security Land; and then when you’re done, read it again. Check out some of the awesome stuff:

Never take a magazine rating at face value. In fact, tell magazine reviewers that they need to put a metric up