Were I to boil all the nuanced things Omdia analysts said at this year’s Canalys Forum down to two simple thoughts, they would be that 1) we live in complex times and that 2) complexity has both positive and negative implications for the channel.
Hard to imagine anyone arguing with 1. A world in which a glory-seeking security researcher can bring down a major RMM by dumping 30 critical vulnerabilities on the internet without a word of warning and supermarket freezer cases have become attack surface is an undeniably complex one.
“A year ago, autonomous AI attacks were just a prediction,” said Matthew Ball (pictured), Omdia’s chief analyst for security, during a keynote presentation. “By mid-year, rogue agents had broken into Hugging Face, accessed data in the Australian health industry, and interfered with U.S. government websites all by themselves.” Once, Ball observed, AI gave threat actors speed, scale, and skills they previously lacked.
“Now, AI is the threat actor.”
To further complicate matters, the potential victims of that digital threat actor are rolling out inscrutable, machine-speed agents.
“When you put those two shifts together, both sides of the risk equation have moved,” Ball said. “The threat side has gotten bigger and cheaper. The exposure side has also gotten wider, because every agent your customers deploy is now a new way in.” Risk, therefore, isn’t merely rising.
“It’s compounding,” Ball said.
Which is why cyber complexity is breeding cyber opportunity. “This is a market where demand is structural, not cyclical,” said Ball, noting that security spending in North America will rise 15% to $164 billion this year, with technology accounting for about a third and services for the rest.
Partners intent on capturing some of that opportunity, however, will need to rethink their role and relationship with clients. Selecting, running, and orchestrating security agents, governing their activity, and keeping their costs under control will be the new table stakes. Differentiation will come, if it does, from the intimate understanding of a client’s hopes, wishes, and pains that partners possess and agents never will.
“Agents will supply the labor, but partners will provide the context, and that’s going to be the new division of value,” Ball said.
Both sides of that split, he noted in a later conversation with Channelholic, will need to adjust where they spend time and money, though. At the moment, Ball notes, partners and vendors generally emphasize the right-of-boom side of the threat lifecycle. The customer need, though, is on the left-of-boom side where frontier models find weaknesses faster than defenders can patch them.
“Where partners should really start focusing more is being able to advise customers in terms of what’s vulnerable, what needs protecting, and what needs fixing,” Ball says.