The time is right to start new companies

In an ironic twist during a down economy, the upcoming months are great times to launch a new company ... assuming entrepreneurs can find capital. It seems counter-intuitive - CIOs and CSOs in every vertical are hunkering down delaying new projects and ruthlessly cutting costs; VC's are loathe to put money in play because they are not confident about picking winners; employees may be averse to the employment risk of a small company. However, this is also the time when enterprises will spend time actively nurturing companies developing better approaches and challenging traditional ways of deploying security, public companies tend to cut back on new ventures to protect revenue-generating product lines, talented visionaries in public companies cannot envision their stock options rising above water in their natural lifetimes, and nobody is going to miss an explosive up-market within the next couple of years. I am convinced that entrepreneurial creativity, changing the way some tasks get done, is more critical than ever in setting the foundation for the next expansion.

Security for security sake is going to be a tough sell. Security products are destined to be a part of a more comprehensive business solution, so there better be clear benefits to the non-security side of IT. For instance, businesses will prioritize projects for revenue generation and solvency over compliance expenses every time. If a vendor must have a heavy compliance story, it had better be on how to drive out the costs and be able to articulate the returns. "Gotta have to be compliant" is a dog that won't hunt in 2008/2009.

• Challenge the status quo for an existing category. It is very difficult to displace incumbent solutions, unless the contending solution can magically produce sustainable 10x improvements in performance and server cost savings. Look instead to modernize the category to align with business needs. For instance, firewalls are more valuable as networking devices necessary to connect the business to the Internet than they are as security devices blocking users from the business. You will be more likely to find success by adding acceleration and business intelligence features than you will by bundling commoditized security features into an uber-UTM. I think Citrix Netscaler, Microsoft's IAG, and Cisco's transition from Pix to ASA are good examples here.
• Avoid capital expenditures. Not only is security in the cloud inevitable, most enterprises today use this approach for email security and anti-spam. It is increasingly futile to force fit perimeter-oriented approaches into a world that is largely Internet-oriented. Security will have to be strong in the cloud because that is where the action is. From a go-to-market standpoint, these approaches lend themselves well to subscription pricing models with minimal upfront investment - a good approach to penetrate cost conscious customers when money is tight. Why own and operate security products when a security service in the cloud will do the job? Interesting ideas for services can be found at Symplified, Zscaler, PureWire, MokaFive and more.
• Look to change how businesses get the job done. Cleverly solving, or bypassing, security issues can lead to truly disruptive approaches. End-to-end virtualization allows IT to encourage sharing of home computers and mobile devices for business and pleasure. Endpoint security is a lot easier if the endpoint neither installs application code nor stores sensitive data. MerchantWarehouse's service stores and processes credit card data so their retail customers don't have to - this approach to securing credit card information means retail customers can avoid having to spend outrageous sums of money on PCI compliance.

When the high tech bubble burst earlier this decade, VC's reacted very conservatively by deciding not to venture capital on new deals. This was especially true around Boston, where VC's got spooked by the downturn and absence of IPO exits. Investment in high tech literally dried up overnight in favor of bio-tech, healthcare, and energy. I would guess that they will hold back this time around, too. That would be a shame, as the climate is right for disruptive ideas and the ability to make those dreams real. Let's hope we'll have a different experience from the investor community this time around.