How Many Cybersecurity Products Are There?

This article is a follow-on from an update sent to everyone who signed up for updates on the Analyst Dashboard. You can get those by filling in this form.

When we set out to build the Analyst Dashboard two years ago our goal was to create a platform for researching the entire cybersecurity industry. We had been using a massive Google Sheet to track vendors, category, sub-category, address, and quarterly headcount, which was the source for the Directory in Security Yearbook.

With that spreadsheet in front of me I could take GLG and other consulting calls and sound like a genius. I had all the players in any segment in front of me as I talked. I remember telling Maximillian: "Build an app that is better than a Google Sheet." Within a month of launching I had weaned myself from that spreadsheet forever.

The Dashboard is the only platform for researching the entire cybersecurity industry. Getting answers to questions that were impossible before has become easy. Today somebody asked me how many cybersecurity vendors were Series A, B, C. I used these funding ranges to get:

Series A $6-24 million, there are 814 vendors.

B $25-60  million.  346 vendors

C  $61-150 million   229

D-F  $151+ million  200

But the universe of people who absolutely need all the data on 3,671 cybersecurity vendors is relatively small. True, there are 5,222 investors in cybersecurity, including angels. If you add in the 200 or so industry analysts who live and breathe cybersecurity you still have a small number. We are also discovering that there is a strong use case for those that sell to cybersecurity companies. This includes PR firms, agencies, head hunters, and event organizers.

We already have a platform with separate databases for:

1. Vendors

2. Investors

3. Key contacts at vendors

What if we could build a complete database of every cybersecurity product? That would change the trajectory and go-to-market for IT-Harvest dramatically.

We started building that product database three weeks ago, starting with the top 100 vendors by size. We have had product descriptions for each vendor's primary product for over a year, but getting all the products was complicated. Maximillian had a breakthrough three weeks ago and figured out how to combine on-demand screen scrapers with OpenAI's GPT-4 API to build a process to systematically collect and ingest all products from a vendor website. As of today we have collected about 4,800 cybersecurity products.

As an aside, vendor product descriptions are a thousand times better than vendor company descriptions to work with. Nobody describes their product as "a Zero Trust enabler." They have to give it a name that usually reflects what it is (FortiSIEM for example) and its features are explicitly defined.

Here is what the product page for Fortinet now looks like:

We have harvested 35 FortiProducts. You can scroll down and select a product to jump to the description which includes an itemized feature set. Scroll a little further and...

What??? Yes, Maximillian has figured out how to map each product to the matching MITRE ATT&CK Technique.

You can see how disruptive this is going to be to IT-Harvest's trajectory. A database of all cybersecurity products will be of tremendous value to security teams. They can create complete lists of products and winnow them down to a short-list to evaluate. Or they could create a customized list of the products they currently use. They may find that they have a lot of overlap in capability for one ATT&CK Technique but have little or no coverage for another.

When we are done ingesting ALL the products we will issue a press release. But before then we are starting to talk to CISOs and their teams to get feedback on what features to build. One I want to see right away is a way to list the products for each MITRE ATT&CK Technique. How about a graph of Technique versus number of products that address that technique?

If you have a use case for this product database reach out to talk about it!

So how many products do you think we will harvest? My guess is close to 18,000. What do you think?