IMPROVING SECURITY SOLUTIONS COULD GROW THE INTERNET OF THINGS CYBERSECURITY MARKET BY $9-$11 BILLION

New Bain & Company research identifies four steps IoT device vendors can take to address security concerns that are holding back further growth in this market

New York – May 30, 2018 – Security concerns are a significant roadblock to investment in the Internet of Things (IoT). According to a new Bain & Company report, Cybersecurity is the Key to Unlocking Demand in IoT, 45 percent of IoT buyers say concerns about security remain a significant barrier and are hindering the adoption of IoT devices.

If vendors could provide better security, enterprise customers surveyed say they would be willing to buy, on average, at least 70 percent more IoT devices. In addition, 93 percent of executives said they would pay more for devices with better security – about 22 percent more on average. Taken together, Bain & Company estimates that improving security solutions for these devices could grow the IoT cybersecurity market by $9-$11 billion. For IoT device vendors – companies that make IoT devices as well as those that provide related solutions – the message is clear: improve security to gain a competitive edge and grow your market.

These are among Bain & Company’s findings over the last three years and new, recently completed research on IoT security.

“We expect growth in the markets that comprise the IoT to continue full steam ahead, but issues around security concerns could derail that progress,” said Ann Bosche, a partner in Bain & Company’s Telcom, Media and Technology Practice. “Enterprise customers are moving cautiously until they can gain some reasonable assurance of the security of their data and operations, which increasingly rely on devices, sensors and the Internet of Things.”

The Bain & Company survey found most executives (60 percent) said they were very concerned about the risks IoT devices pose to their companies – not surprising, given the damage that an IoT security breach can cause to operations, revenues and safety.

In determining solutions to guard against attacks, IoT device vendors can segment their target customers by levels of cybersecurity capability maturity. The research finds that customers at the least-advanced end of the spectrum are more likely to seek out simplified and integrated security solutions, whereas those with more advanced capabilities prefer to invest in best-of-breed or customized point solutions.

Further, across segments, nearly all executives – 90 percent – said that IoT devices pose a moderate or significant risk to their organizations, and executives in companies with greater cybersecurity sophistication see more risk than those in less sophisticated companies.

The research also found that executives in some industries see themselves at greater risk than others. Those in durable goods, building and construction, energy and utilities, financial services, and technology were most likely to express a significant level of concern.

In response to these risks, executives who manage security said that, as customers, they want solutions that are highly effective, easy to integrate, and flexible to deploy.

Companies take a range of approaches to meet their security needs, based on their capabilities and the availability of marketplace solutions from vendors. Only about a third of IoT cybersecurity solutions used today are from IoT device vendors, indicating that vendors are either not offering holistic, high quality, solutions that meet consumer needs or they are not promoting them well enough. Bain & Company found that companies with the most advanced cybersecurity capabilities rely more on internally developed security solutions, not only because they may have more complex needs but because they are more likely to have the talent and capabilities to develop their own solutions. Companies with ad hoc security capabilities have the most gaps across all IoT layers tested.

The research also looked at how companies deploy solutions by layer of security and found ample opportunity for IoT device vendors at every layer of the stack. The access interface layer has the greatest level of protection, whether developed internally or provided by a manufacturer or third party. Other layers of the stack were protected by more internal solutions – or, in some cases, none at all. Customers’ preference for internal solutions may be partially explained by considering the specific conditions of each layer. For example, data security solutions typically require more computing and power resources than are currently available on basic IoT devices.

“Most enterprises want a cohesive set of tools and a unified overview of the security posture of their devices, but few IoT device makers understand their customers’ operations well enough to provide that kind of solution,” said Syed Ali, a cybersecurity expert in Bain & Company’s IT Practice. “Lacking well-designed IoT cybersecurity products and services, customers are devising their own solutions, foregoing them altogether, or failing to implement IOT solutions until vendors can fill the gap.”

All IoT device vendors will need to pay more attention to security in the design, development and deployment of devices. Four steps can help executives frame their task:

1. Understand how customers are using devices. Staying current by refreshing their understanding of customer use cases every 12 to 18 months will allow them to stay on top of evolving security requirements, and help identify unmet needs. Ascertaining the average cybersecurity maturity level of their customers will help manufacturers invest in the right out-of-the-box and add-on solutions.
2. Provide cybersecurity capabilities on the device and, where possible, partner with trusted cybersecurity vendors to provide additional solutions. Engineering teams should embed secure development practices in the software and hardware components of the device, and provide inherent solutions for the access interface, apps, data and device layers. Taking these measures can mitigate common vulnerabilities in IoT devices today such as default or embedded passwords, lack of data security for credentials and network communications, and weak safeguards for ensuring system integrity.
3. Meet quality assurance thresholds and be able to certify that their IoT devices are free from known vulnerabilities. This would mitigate a major pain point for customers who sometimes install new devices without realizing they contain vulnerabilities. Deploying a more methodical process to identify and remove vulnerabilities across layers or engaging third-party vulnerability scanning and or penetration test firms can help manufacturers meet this bar.
4. Fulfill their obligations during the warranty period by continuously testing for new vulnerabilities, providing software and firmware updates, as well as feature and functionality upgrades for out-of-box and aftermarket solutions. Delivering updates to firmware, operating systems and applications in response to newly discovered security vulnerabilities should remain a top priority through the warranty period.

“IoT device vendors and ecosystem players that move quickly to improve the security around IoT devices are likely to reap rewards not only from their ability to earn a premium, but also from an expanded market,” said Frank Ford, a partner in Bain & Company’s IT Practice. “These four steps are a start, though by no means, the whole of what it will take to begin to address the security concerns that are holding back growth of the IoT.”

Editor's Note: To arrange an interview, contact Dan Pinkney at dan.pinkney@bain.com or +1 646 562 8102

# # #