InfoSecPodcast.com

For several years now I have been involved with security industry analyst firms like Gartner, Forrester, Yankee and Tolly Group. These firms sell their opinions and analyses of products to companies looking to purchase technology products. They also provide market analysis / forecasts, trade shows and sometimes product “guidance” to vendors, all for a fee. Some people question their objectivity. There are some firms who are looked at as Hired Guns, they will publish what you pay them to publish. I’m not going to get into any of that. You can draw your own conclusions from your own experiences. Instead I wanted to share a conversation I had with a mid-market customer looking to purchase a security device, an IPS in this case. Then my thoughts on why mid-market companies should be careful how much they use the Magic Quadrant or any analyst research as their basis for buying. I am not singling out Gartner, they just happen to be the only analyst mentioned during my conversation.

For those that are not aware Gartner analyses different products and plots them on a graph split into 4 sections called the Magic Quadrant. The further right you are the more visionary your product is. The further up you are the better your ability to execute is. So naturally the upper right is the promise land. The exact formula to Gartner’s MQ is known only to them. It’s an enigma that keeps vendors from trying to artificially improve rankings. Think of it as trying to increase your Google Page Rank by knowing what the Google algorithm is. Gartner does tell you that things like winning enterprise customers and consistently being on those enterprise customers short lists of products to evaluate are important.

A friend of mine is VP of IT for a New England bank with 40 or so branches. They have IPSec VPN’s from each branch back to the main branch. All Internet connectivity was through two T-1’s at the main branch. They wanted to purchase a network IPS. The security guys will say it was to improve security. The person who cut the check will tell you it was to help with regulatory compliance issues. This friend called me and asked my opinion. Of the 3 vendors I thought he should look at none were in the upper right on the MQ. This seemed to be an issue for him. Then I asked him if he was a Gartner client. He said something like it was too much money for them. I asked him if he knew what information Gartner used to determine positioning. He did not, and therein lies what I see as an issue when non-enterprise customers use information like this for buying decisions. Gartner uses information from their own clients to help determine a vendor’s ability to execute. If you show up on Gartner size clients (which tend to be enterprise because of cost) lists that’s a good thing for a vendors positioning. This doesn’t however translate to a better product.

Does a product that sells like crazy in the enterprise have the same appeal or applicability in the mid-market? In my experience the answer is no. Just because a product is in the upper right that doesn’t mean it is a better product. There is a lot of good technology and products in the other 3 quadrants as well. It’s all about fitting the solution to the need and the budget. Analysts are there to guide, not to make up your mind for you. Use analyst information as one of many tools available; don’t make it the single decision point. Think of it as defense in depth for purchasing. This is coming from someone who has been on both sides of the analyst fence but never worked for them. No danger of that now…

–Chris

Technorati Tags: Gartner, Magic Quadrant, analysts