SaaS Also Rules In Security

An IDC report published in October of last year projects that the Web security market will grow at a 12% compounded rate to reach $2.5 billion in 2013, up from $1.4 billion in 2008. The biggest growth for the industry is expected to come from the SaaS segment, which is projected to grow at a compounded annual rate of 46%. Compare that with projected growth of 4% for software and 20% for applications.

Websense (NASDAQ:WBSN), a key player in the industry, is focusing on tapping the Security SaaS market. Websense captured 26.2% of the 2008 worldwide market for Web security software and grew 96.3% in the SaaS Web security segment. In the recently reported Q4 results, revenues climbed 2.2% over the year to $79.7 million. EPS for the quarter fell from $0.30 a year ago to $0.26. Net billings grew 12% over the year to $118.3 million with international billings growing 13% to $61.5 million. The market was expecting revenues of $82.5 million with EPS of $0.32.

The key driver of growth during the quarter was the Web Security Gateway, where incremental contribution grew 236% over the year. Total WSG sales, including the renewal portion of upgrades, grew 163% over the year, contributing 19% of total billings. Data loss prevention sales grew 61% over the year and Web and email solutions 71%.

Websense recorded annual revenues of $313.7 million, an increase of 9% over the year. However, EPS fell by $0.10 to $1.19. Net billings for the year were a record $352 million, growing 3% over the year.

The company recently launched a unified solution called Triton, which embeds DLP functionality in the Web Security Gateway. The product combines Web, data, and email security technologies onto a single platform to deliver a unified, cost- effective solution to help protect organizations from blended threats and targeted attacks. The TRITON true hybrid solution secures organizations through a system that integrates both SaaS cloud-based and on-premise delivery mechanisms through a single management console, in effect, requiring a single policy for all users. Websense is the first and at present the only vendor to offer such a unified solution.

It is thus no surprise that both Garnter and Forrester see Websense as leaders in Web security, DLP (data loss prevention), and integration. Yet, the outlook for the year fell short of analysts’ expectations. Q1 revenues are projected at $81 million to $83 million with EPS of $0.24 to $0.28 compared with the Street’s expected revenues of $84 million and EPS of $0.32. For the year, the company projects revenues of $338 million to $346 million with EPS of $1.16 to $1.23 compared with the Street’s expectations of $341.9 million and $1.27 respectively.

Earlier last week, the stock reached a 52-week high of $21.52. It is currently trading at $21.46 with a market capitalization of $938 million.

IDC also projects the security and vulnerability management market to grow 19.0% to $115.44 million in 2010. The secure content and threat management market is expected to grow 18.4% to $1.13 billion and the identity and access management market 15.2% to $326.38 million in the year.

Against the backdrop of such projections, McAfee’s (NYSE:MFE) Q4 performance was encouraging. Revenues of $525.7 million grew 24% over the year. EPS of $0.64 was also in line with the market’s expectation.

McAfee is continuing to expand its product portfolio and recently announced an alliance with Brocade, a networking solutions provider. The two will work towards incorporating McAfee’s security measures into Brocade’s networking products. McAfee also announced a worldwide agreement with HP to provide pre-installed Total Protection Service on HP StorageWorks X500 Data Vault series storage devices. This is in addition to the agreement with HP ProCurve to build data center solutions together that will combine McAfee’s network security products with HP ProCurve’s data center switching products. Besides investing in strategic relationships, McAfee is also looking at acquiring three to four small and mid-sized technology companies each year to drive growth.

McAfee projects Q1 revenues of $500 million to $520 million with EPS of $0.60 to $0.64, in line with analysts’ expected revenues of $507.3 million and EPS of $0.63.

The stock is currently trading at $39.76 with a market capitalization of $6.3 billion. It has recovered significantly from last year’s low of $26.65.

McAfee’s rival, Symantec (NASDAQ:SYMC), had weaker Q3 growth. Revenues of $1.55 billion were up a modest 2% over the year but exceeded the market’s $1.51 billion target. EPS of $0.37 was lower than previous year’s $0.40 but was in line with the market’s expectations.

The Consumer segment contributed 31% of total revenues and grew 7% over the year. The Security and Compliance segment contributed 24% of total revenues and grew 3% over the year while the Storage and Server Management segment represented 38% revenues after declining 4% over the year. Services revenues remained flat over the year and were 7% of the total quarter’s revenue.

By region, International revenues were 51% of total revenues and grew 3% over the year. Europe, the Middle East, and Africa contributed 32% of revenues and grew 1% over the year. Asia Pacific/Japan contributed 15% revenues and grew 11% over the year while the Americas represented 53% of revenues and fell 2% over the year.

The competition between McAfee and Symantec is heating up. Symantec’s existing agreement to provide preloaded security solutions to HP personal computers, worth an estimated $200 million annual revenue, is set to expire this year. Analysts believe that McAfee will replace Symantec owing to its cheaper product options. Symantec, meanwhile, recently replaced McAfee as the security solutions provider to Comcast’s high-speed Internet users.

Symantec’s product portfolio continued to expand with the launch of Backup Exec 2010, which helps protect data for mid-sized businesses while using less storage. The solution offers fully integrated data deduplication and archiving technologies.

Symantec is also driving hard into the SaaS segment. During the quarter, the company made record bookings for its hosted services unit. It launched a healthcare-vertical-focused SaaS solution to address the growing need of hospitals to store medical images. To further expand reach and product range, Symatec acquired Softscan, a Danish software firm, which develops hosted security solutions for email.

The company projects revenues of $1.51 billion to $1.52 billion with EPS of $0.36 to $0.37. The market was looking for revenues of $1.52 billion with EPS of $0.37.

The stock is trading at $16.60 with a market capitalization of $13.4 billion. It touched a 52-week high of $19.16 last month.

With players like McAfee looking to acquire, it will be interesting to see how the market consolidates. I would rate  Qualys as a good target for any of these companies, given that it is a leading provider of on-demand vulnerability management and policy compliance solutions that helps organizations discover vulnerabilities, ensure regulatory compliance and prioritize remediation according to business risk.

Additionally, as business and retail consumers switch more of their data to handheld devices and migrate to virtualized cloud environments, the services being offered by the security players are being put to the test. Managing security in these devices is a “nightmare” for the security solutions provider. But it is a market they need to address and capture.