Vista's impact on security markets - You don't care

Seems the folks over at Yankee Group are making some waves today by hypothesizing that the emergence of Vista will "dramatically" affect the Windows security product market. CNET's coverage is here. I will admit to being the master of the obvious at times, but I want to remind everyone that regardless of whether this projection is right or wrong - YOU DON'T CARE.

We all know that nothing happens overnight in this business. Vista will be out at some point (you don't care about that either) and it will have some embedded security capabilities that will overlap with some commercial products. So what? Are you going to shut off all the ZoneAlarm, Webroot, and Safeboot stuff you've been buying? Of course not, you are at risk TODAY and Vista is not going to be there for another 300-450 tomorrows (depending on your threshold for pain). So you better keep on keeping on. That's the only choice you have.

Let's look at the situation from a historical perspective because we've seen this moving before. Windows XP SP2 was supposed to kill the personal firewall market. I actually thought the timing was interesting that Check Point had acquired Zone Labs about 2 weeks before Microsoft announced they were bundling the XP firewall for free. Did that kill the personal FW market? A resounding NO.

Actually some of the personal firewall markets got a bit enterprising (like Sygate) and started morphing their "endpoint" security capabilities into a piece of a larger Network Access Control environment. Senforce is moving towards this vision as well, integrating StillSecure's NAC technology in. Microsoft did that too, right? Isn't that what NAP is about? Well, if you get in your time machine and step out in 2008 when Longhorn is there too, then the answer would be yes. But not today.

We'll see similar evolution in spyware and full disk encryption. Microsoft will offer a lowest common denominator and existing vendors better have a very clean, very crisp value proposition on top of that. If they don't, then these 3rd party vendors deserve to get steamrolled by the Vista juggernaut.

I also take issue with some of Yankee's comments about when to deploy Vista. They seem to think that because the user experience is different and the additional security may cause some users to get grumpy, it's OK to wait until 2008 to upgrade. My opinion is that it's OK to wait until 2008, but do it because you aren't refreshing your PC's until then or you've got other priorities, NOT because you don't want to impact the user experience. That's a stupid reason to do nothing.

Windows XP SP2 is not secure enough. We are reminded of this every day. If you are committed to Windows (like 80% of the world), then you'll want to upgrade to Vista when practical. As a security administrator, you have a choice - spend some time training your users about Vista's user account protection or continue cleaning up the mess of Windows XP.

So I applaud the Yankee Group's PR savvy, since I saw a lot of pick-up for this story today, but feel compelled to remind folks that Vista is still practically a year away and you've got a lot of work to do between now and then.