Source: ALM Vanguard: Cybersecurity Consulting (c) 2019; used by licensing permisssions Buyer Ratings Guide The ALM Vanguard: Cybersecurity Consulting 2019 October 2019 Source: ALM Vanguard: Cybersecurity Consulting (c) 2019; used by licensing permisssions Buyer Ratings Guide Contents Overview 3 ALM Vanguard of Cybersecurity Consulting Providers 6 Competitive Landscape 7 Provider Capability Rankings 9 Rating Level Summaries 10 Leader Assessments 11 Provider Capability Ratings 12 Best in Class Providers 13 Provider Briefs 14 Definitions 16 Methodology 19 About ALM Intelligence 20 Author Laura Becker Analyst, Management Consulting Research T +1 212-457-9179 [email protected] For more information, visit the ALM Intelligence website at www.alm.com/intelligence/industries-we-serve/consulting-industry/ © 2019 ALM Media Properties, LLC 2 Source: ALM Vanguard: Cybersecurity Consulting (c) 2019; used by licensing permisssions Buyer Ratings Guide Overview Capability Drivers Cybersecurity consulting capabilities and go-to-market strategies are evolving at a rapid pace. In fact, the speed of change over the last year is simply incredible with many major consulting firms re-branding their approach to meet the changing market dynamics. There has been a recognition across the board that there is no way to prevent a cyber attack and that the only hope is to minimize cyber risks. In addition, as organizations employ emerging technologies that increase connectivity both internally and with their external customers, the need for confidence in data protection is at the front of their minds. If end-user customer data is breached, an organization’s brand reputation is affected greatly. Therefore, both building cyber resilience (cyber risk management) and designing for digital trust (protection of data) are at the core of thinking and necessary capabilities for consulting firms, who seek to provide their clients with deep capabilities in these areas. Cyber is now viewed as a business enabler, moving from complying with various regulations (i.e., GDPR, California Consumer Privacy Act, China Cybersecurity Law, NY DFS among others) to the current complexity driven by the digital economy. Trust in identity, products and services continue to gain importance for all organizations with new risks being generated by the increased value of data and disruptive technologies with unknown security and privacy impacts. Cybersecurity must become part of the integrated fabric of every client organization, embedded in all business strategies from consumers, supply chains, third party partners, brand management, M&A and more. Trust in identity and in products and services will continue to gain in importance for executing safe and reliable business as new producers, consumers, and new enterprise stewards of data and commerce experience emerge. New risks are being generated by the increased value of data, and new and disruptive technologies are being tested with unknown security and privacy ramifications. Cybersecurity must fully evolve away from its legacy technology and operations function to become part of the fabric of integrated, enterprise risk management and create strategic risk and value-add business outcomes. The fabric of cybersecurity and privacy must be embedded in all business strategies – from supply chain and partner strategies, to digital marketing and brand management, acquisitions and divestitures and legal affairs. Many of the leading consulting firms have reorganized their approaches to rely more on process and less on tools. Technology is by all accounts only about 20% of the cybersecurity game. People, process and technology (having talent, agility, and the right solutions) and cultural change, training and digital upskilling are essential ingredients for security success. Leading providers have developed approaches that are intended to reach stakeholders from the Board/C-suite, the CISO and CMO, CDO, CRO, CIO and other business function leaders who all need to participate to create a cyber resilient organization. Innovative approaches now include co-development with clients to create the right approach for the clients’ business needs and those that will add the most value-added outcomes. Additionally, leading providers are creating partner ecosystems on the technology side to bring in the best tools necessary without using their own time and resources to reinvent the wheel. The consulting firms can apply API layers on top of existing tools to customize for their clients. There is an efficiency in the ecosystem concept that was not there before. The leading consulting firms also see that the market for cybersecurity providers is highly fragmented, including the Big Four, Managed Security Service Providers (MSSPs), Technology Global Service Providers, boutique firms and other new entrants with some going downstream with service offerings and others going upstream; some providers focus on business strategy embedding cybersecurity to enhance outcomes, while others focus on security strategy to create value-added business outcomes. © 2019 ALM Media Properties, LLC 3 Source: ALM Vanguard: Cybersecurity Consulting (c) 2019; used by licensing permisssions Buyer Ratings Guide Overview Capability Drivers There is a bubble of technology tool providers at the moment due to explosive growth in this space. There may be a vendor consolidation and tool rationalization in the near future that will affect the market. The larger firms are already making significant acquisitions and alliances. The evolution of the consulting firms’ approach is being driven by external market forces, and the leading providers are shaping their service delivery models to account for these major market impacts to effectively guide clients. The leading consulting firms continue to develop innovative methodologies, frameworks, approaches, products and services given the capability drivers affecting client demand. Ability to refresh service offerings frequently with a sprint approach.Leading consulting firms realize that consulting is changing because of disruptions from digital technology. Reactivity and point solutions are no longer the answer. Consulting providers must go in with a proactive approach to instill cyber resilience and digital trust across the enterprise and throughout its culture. Many consulting firms, just over the last year, have changed their service profiles. Traditionally, consulting offerings might be viable for 10 years. That is no longer the case, with leading providers refreshing their service portfolios every 18-24 months to differentiate themselves from the competition. In addition, agility and speed to market are essential, as is the shortened time frame for project completion. What might have been a two-to-three year engagement must now be completed in 18 months. Some leading consulting firms are going to market with almost pre-packaged IP and technology solutions through ecosystem partners that can be customized to the client’s specific needs in order to create change quickly and efficiently. In addition, to the service portfolio, many leading providers have also revised their pricing models focusing more on subscriptions, retainers, outcome-based, as-a-service and other options in addition to the more traditional fixed fee and time and materials models. Ability to understand and shape the role of the modern CISO. The modern CISO must view cyber as a business enabler and step out of the technology function role as a standalone entity. With technology embedded throughout the enterprise, CISOs must have extensive technical knowledge, risk management knowledge, governance knowledge and communicate training and awareness across the organization, including the C-suite and Board, all the way down to the lowest level employee and customers (endpoint security). In many cases, the CMO, CIO, CFO or CDO is involved in the cybersecurity work as well and the CISO needs to co-exist with all business leaders and drive the process. Consulting firms are finding that larger clients have CISOs in place (many with these skills), but other organizations are finding it difficult to find the right talent for this role. Consulting firms are offering a virtual CISO (vCISO) or data protection officer for staff augmentation purposes as well as working on training and upskilling for the role internally as necessary. Ability to provide cybersecurity upskilling to address skill gaps and talent shortages. Leading consulting firms are well aware of skill shortages that are both driving client demand for services and leading them to develop in-house talent to ensure a sufficient talent pipeline for client projects. There are several ways that leading providers are doing this. One is to enter into academic partnerships with leading universities to build the next generation of diverse cybersecurity skills and talent. The other method is to create diversity and inclusion programs to garner new talent. PwC, for instance, is a founder © 2019 ALM Media Properties, LLC 4 Source: ALM Vanguard: Cybersecurity Consulting (c) 2019; used by licensing permisssions Buyer Ratings Guide Overview Capability Drivers of the CEO Action for Diversity and Inclusion. KPMG has a Women of Risk community and many leading firms are hiring top level talent from government agencies. Ability to assist clients with OT/ICS exposure – the next “big thing.” Many leading consulting providers see OT (operational technology) and ICS (Industrial Control Systems) as the next big attack surface for potential cybersecurity