Analyst Business

Is being an analyst a "way-station" to a job at a vendor, as Thomas posits in this post? Are all of us analyst types just "marketers in training?" I can't speak for everyone, but I've already been the senior marketing exec for $50-70 million dollar vendors, so there is no training involved. I pretty much hated doing marketing for a living, so that's where I'm at.

But let me provide a bit of context as to what analysts do when they decide to grow up. Back in the old days, you know - 1998, there were basically two paths for an analyst to take once established:

1. Wall Street - This was when being a Wall Street analyst was cool. Write some research, glad hand with some vendors preparing for their IPO, talk to some investors - walk away with 7 figures a year. Those were the good old days, that's for sure. But this was definitely one of the places to go for an industry analyst. I danced with that devil many times. This isn't really the case anymore because there's been a huge amount of consolidation at the i-banks and being a Wall Street analyst may be more thankless than being a CSO.
   
   
2. Vendor-land - Lots of analysts (yours truly) ended up starting companies back in the late 90's during the Bubble. Board seats, big titles like EVP, it was cool. A few years earlier ('92-'97), analysts would predominately be product managers or maybe product marketing. It was very hard for an analyst to get a VP title, especially if they hadn't ever had an operational job. The late 90's changed that, but only for a few years.

So what does a guy like me do next? Thomas is right, it's mostly go to vendors. Some take marketing roles (like Stiennon), others take CTO or strategy roles (like Amrit), others are product managers/marketers (like my old META colleagues David Thompson and Chris King). Very few go the route of the user, that's pretty hard work and the money is pretty crappy (relative to the dream of vendor equity anyway).

But I'm not really answering the question, now am I? is it just a breeding ground for marketers? I guess for some. The skills you develop as an analyst are pretty leveragable as a vendor. Folks at the G (and formerly at META and maybe even Forrester) learn to think like a user. That's pretty helpful. They also learn about positioning and telling a compelling story. They are very comfortable in front of people, both speaking and advising. They have lots of contacts with end users (for the end user oriented analysts anyway). And they also have an "air" of credibility. For the first week they work for a vendor anyway.

Yet, analysts with no operational experience get WAY over their head very quickly if they own the entire marketing job. What the hell does an analyst know about lead generation or advertising or working with the channel or the cost of sales of building a product? Not a hell of a lot, that's what. I had to learn a lot (A LOT) on the job. Thankfully I worked with a friend and mentor that taught me and was cool that I basically didn't know anything.

Former analysts also lose their credibility incredibly quickly as well. You are not objective by any stretch of the imagination if a vendor is paying your salary. Even if you are brought in to "advise" a user, your answer better be to roll out lots of whatever the company you work for sells.

Most CEO's don't get that when they hire an analyst into a marketing role. They figure they'll just do marketing and the end users will think they are great and buy whatever it is they say. Not so much. That's why being a vendor turns out to be a nightmare for lots of ex-analystas. They are just unprepared to do the job and end up hating many of the mind-numbingly tedious parts of marketing.

But lots of them need to learn this the hard way. I know I did. Analysts leave what is admittedly a pretty cushy job because they want to do something else. They can't envision themselves as an analyst lifer. They want to "do something" and take an active role in creating markets. And the idea of a C or VP in their title is very compelling.

Yet, I don't think any analyst goes into the job with the clear intention to join a vendor sooner rather than later. They say about M&A, "company's are bought, not sold." Well, the same goes for analysts. Only if they are good and become fairly well known do the vendors fawn over them and basically offer them jobs all the time. It still happens to me (even though I make it clear that I'm not interested). But this does not happen just because you have a G on your business card.

Since it's pretty unlikely that successful analysts are looking to be picked up by a vendor, how is this a conflict of interest? I don't understand that part of Thomas' argument. Basically, if you whore for one vendor, you better hope they pick you up - because you aren't going to have a lot of friends at the other vendors. If these analysts whore for all the vendors, then they are just whores and getting out of bed presents a conflict of interest for them. That is the same regardless of whether they are looking for a job or not.

My position is pretty clear. I work on behalf of users and have absolutely no intention of going back into vendor-land. I can't say I'll be a security analyst for the rest of my working life, but I can tell you it's very very very very very very unlikely that I'd ever be a VP Marketing again.

Is that clear enough Thomas?

 

The media business has always been pretty easy to understand. They generate content and package it either for offline or online use. Advertisers pay the freight (for the most part) and it's pretty simple. It's mostly been branding oriented advertising. But it's changing. Advertisers are spending more on pay per click and other internet-based direct response advertising and less on traditional print media or banner ads. Direct response is increasing in value and some of the media companies have evolved to offer white paper programs, webcasts, and other lead generation types of activities.

But it's still not enough. You've seen a lot of consolidation in the space, as folks like CMP, IDG and CNET have acquired many niche properties to increase their heft and provide a more compelling platform to meet the needs of their increasingly large advertisers. Big is the new small in media as well - though that's not really novel. It's been happening for quite a while.

Still it's not enough, so inevitably the big tech media players are going to need to diversify their revenue streams. They can no longer just depend on the advertisers (I mean vendors) to pay the freight. They are going to need to increasingly go to the buyer and offer something of value and figure out how to charge for it.

We're seeing this already. Light Reading (which was acquired by CMP about a year ago) has been doing this since they were founded. They offer a service called the "Insider" for each of their properties that provides for-pay research reports. Subscriptions run about $1500 annually for an individual and you get either monthly or bi-monthly reports. Dark Reading, their security site, has an Insider offering. You can check it out here. I haven't seen any of the reports, but I did write a few for Light Reading back in 2002. There is more there there than a trade pub blurb (or even overview) and provides a good primer on many of the markets that are important to end users.

CMP is not done either. They've also introduced a for-pay offering under the Network Computing brand called Network Computing Analytics (here). These reports are based around a user survey and some value-add analysis. The reports cost $499. I've got no idea how well these reports sell, but CMP is rolling out more rather than less - so that is some indication of early traction.

CSO Magazine also has a research offering called the CSO Executive Council (here), which is more of a syndicated research offering (like Gartner, META, Forrester) and priced accordingly (I believe membership is like $20,000 a year). They do group research and have a conference and networking events and the like.

IDG, CNET and TechTarget will be getting into the paid reports business. It's not an if, it's a when. They may even look to hire some outside talent to build these offerings because these are not traditional media businesses, magazine publishers are not really well suited to run these businesses. It'll be a shock to the system for them because research is a fundamentally different business, with different pay scales, different sales models, different editorial expectations and different value propositions. It's media, but it's not.

I get that Security Incite is a media business. Not quite yet, but I'm heading in that direction. I'm new media (Media 2.0), but media nonetheless. I welcome the eventual competition with big tech media. That will force differentiation and focus my efforts. Competition is good. Bring 'em on.

 

I read a lot of spy novels. Why? Because I'm not smart enough to really understand good science fiction, I find most non-fiction boring, and I really enjoy the mystery, intrigue and strategy of many of these thrillers. Being exposed to interesting techniques for spycraft and violence also lets me indulge those interests without risking bodily harm or jail time.

One of the most fascinating characters is the double agent. Someone who can play both sides against the middle. Of course, the mere presence of the CONCEPT of a double agent makes you scrutinize and question the intelligence that you get from every source.

I'm sure you're wondering what I'm talking about by now. I just saw about the availability of a new Forrester report (yours for the bargain basement price of $249) here that attempts to help AR professionals profile analysts. That's kind of interesting. I know there are some former analysts (like KCG) that help to advise on AR. But a practicing analyst telling other folks how to deal with analysts? Is this a double agent at work?

They categorize analysts into three buckets: advocates, product strategists, and evangelists. Now I'm really confused. How can any good analyst not be all three of those? Now, to be clear, I haven't read the report - so I could be talking out of my ass. But speculation is fun, so let's play a bit more.

Good analysts need to be advocates. We are working on behalf of someone, preferably an end user. What value does an analyst provide that cannot weigh in and provide opinion about strategy? And analysts are always evangelizing whatever it is they are working on. If they don't have some big idea, what's the use?

What am I missing here? Folks that are only evangelists tend to be viewed as whores (here). Those that can only do strategizing are product management consultants, not analysts.

Ross Brown of eEye did a nice piece about different kind of analysts here. That's much better. I also profiled contrarians (here) because I think the best analysts have many of these traits. Clearly there was some double agentry going on when I wrote the piece. By giving you a feel for the kinds of analysts I see out there, I'm hopeful that you'll get a better perspective on what I'm trying to do and how it's best to deal with me.

But the point of this post is that I'm not sure Forrester or even I am best suited to profile analysts. We are all "unique." HA. That's a laugh.

 

 

As an analyst, talking to vendors goes with the territory. They are trying to pitch me on why they are great, and I'm always looking for additional data points to keep me in touch with the market and validate the information I'm getting from the end user side.

Most of these discussions are interesting, some even enjoyable. But then there are the ones where I want to slit my wrists halfway through and wish I had become more adept at gracefully bowing out and moving on to my next thing. I had one of those meetings this morning, and it made me think about 5 things that vendors do that consistently piss me off. This joker made every single one of these mistakes.

1. Be enamored with your technology - This guy today was in the authentication business. And he proceeded to launch into why his technology was great before telling me why customers care about what they do. Before you tell me about bells and whistles, you are better off making sure I understand that there is a need and that I agree with that.
   
   
2. Show me a meaningless demo - Once I couldn't get my arms around why his technology was different, he figured he'd launch the demo. Bad move. Besides the fact that the demo was crappy, I still didn't understand his differentiation. Any demo should map both the user and administrator experience. Show differentiation, make it clear how the stuff works and how it is integrated into a customer's environment.
   
   
3. Name dropping - There is a high likelihood that I know more people than you do. So dropping names just annoys me. I don't care if a Fortune 10 bank stopped by your booth and is "very interested" in the technology. Half the time I don't even care about folks that have WRITTEN YOU A CHECK. And if you sell an enterprise product, don't make your customer references about podunk hospital of Topeka. I'm only interested in references after I get a feel for your value.
   
   
4. Talking at me, not with me - I've been doing this a long time. You probably aren't going to tell me much I haven't seen before. Leave the PPT at home unless you are unable to tell your story (and then you should be looking for another job, no?). I like to have conversations, not listen to 30 minutes of you showing me crappy, incoherent slides and waxing poetically about how great you are.
   
   
5. Not taking feedback well - I appreciate that a vendor takes time out of their day and talks to me. So I try to add a little value and provide some constructive feedback on positioning, pricing, messaging, etc. I've sat where you are sitting and I've pretty much screwed everything up twice. So maybe I can make a suggestion that will help. You may not agree with me and that's fine, but at least listen and be respectful. Let me make my points, you may even learn something. Ultimately, you may think I'm an idiot and disregard everything I say. I'm OK with that. But I will remember if you are rude about it.

Now those 5 things are pretty consistent. But what made my meeting this morning unique was the sheer lack of class this guy showed. At one point he questioned my integrity when I disagreed with him, basically asking if I was on retainer with one of his competitors. I'm not, though I do consider some folks with the competitor personal friends.

And then he had the gall to ask if what he was telling me was going to go straight back to the competitor. To be clear, an analyst with a big mouth that doesn't know how to keep a secret is not going to be in this business for very long. At this point, I said goodbye because there were too many potential weapons within grasping distance.

But that wasn't enough for this ass. He had given me a white paper early in the meeting. Then this guy storms up to me as I'm talking to someone else across the room and asks for it back. It's pretty rare that I am speechless, but this was one of those times. I was happy to give it back because it was going to be filed in the circular bin anyway. And any other response would have probably landed me in jail. But still, to interrupt another conversation I'm having to do something petty like that was the straw that broke the camel's back.

So the wonderful thing about having a blog is that I get to share these stories. And hopefully you can learn from my pain. Now I'm going to go enjoy my weekend since I've gotten this off my chest. I hope you do the same.

 

Since I don't really have time to write War and Peace today while I'm on the road, I'm taking on a few smaller posts. In this post from Mark Shavlik, he puts up a survey to gain some direction on future directions for the product. This is a great idea because customers can tell you what problems they have and if you see the same issue enough time there is likely a market.

But he also mentions that he's talking to some of the Big Research folks and this is kind of a quandry. If you are doing point releases to existing products, then that is fine. The analysts (the good one's anyway) talk to customers and can aggregate some of that information for a vendor.

Yet, if you are looking for a new idea or innovation - not so much. It turns out that most of the analysts will not be useful. I remember back when I was at META and we had some VC clients that would ask about some of the ideas they were thinking of finding. Almost always, I came back saying there was no market RIGHT NOW for that. I wasn't getting client inquiries. They got frustrated and I thought they were stupid since there was no market for what they were funding.

Many of them are not working anymore (or have bought winerys and airplanes). I am. Who is the stupid one now?

But that's the point. Analysts are good at telling you what's going on now. It's the rare analyst (I won't be so arrogant to say I'm one of them, even though I am :-) that can think 4-5 years out, even conceptually. They just aren't getting those kind of questions from customers, so they don't have any perspective.

As Clayton Christenson details in the classic "The Innovator's Dilemma" your customers will eventually send you down a rathole. So vendors need to understand if they are trying to innovate or maintain. They need to structure their market research accordingly.

 

I'm a pretty honest guy, most would say blunt. I definitely respect others who don't waste my time and don't try to misrepresent their intentions or what they want from me. I also appreciate folks who understand what their role in life is and make no bones about it.

Like the Quote Whore (here), who is basically a publicist that will right something nice on his blog about pretty much anything. And pricing starts at $15. Can't beat that with a stick. Thanks to BL Ochman for pointing this site out (here).

So what? Basically there are a lot of folks in this business that are really quote whores. They probably don't see it that way, but that's what it is. They don't understand what their role is and they get offended when you actually call them out.

But they provide a needed service, since vendors do press releases every couple of weeks and they need 3rd party "validation" for whatever nonsensical drivel they are sending over the wires. The quote whores do their thing and make a point release sound like the cure for cancer. Uninitiated readers actually think there may be some merit in the announcement.

Those of you in the trade are laughing now (or crying if this hits a bit too close to home). Those that aren't are appalled. But this stuff really happens. When I was on the vendor side, I had my favorite neighborhood Aberdeen Group analyst call me and literally ask for $2500 for their "vendor support" service. Basically it was to provide quotes, a one page write-up of a product, and all the briefings we could eat. I got them down to $1000 and went for it because you need a stable of quote whores lest anyone think that you are getting too close to any one analyst.

I've heard Aberdeen has been trying to change their business model and probably don't engage in this behavior anymore. But I don't know for sure because both of their security analysts left. Guess it was too hard to actually have to do real research and take real positions.

And it wasn't just Aberdeen. Let's just say there were lots of folks that were only too happy to provide a quote for my press releases and mention my product in very glowing terms. As long as I subscribed to their service, that is. And I can't remember even once being asked if the product actually worked or whether they could talk to a reference to verify the information. You could spin these folks like a top.

The folks from Gartner and META had it right the entire time. They never mention the vendor or product in a quote and they only talk about a problem from the perspective of user requirements. That's my policy as well.

You can call me a lot of things, but quote whore is not one of them.

 

While I've got my analysts analyst hat on, let me discuss a bit about how research has changed in the 8 years that I was wasting my time chasing the dollar - I mean doing marketing.

Basically in the mid-90s, an analyst's ability to research stuff was based upon his/her client base. It's really hard to find the time to do surveys and interviews and all of those other things that research involves. That is, unless you sell surveys. At META, I had 400 or so clients that I could call when I had a question. I always called myself an information broker because that's what the job was. I would get information from one spot, verify it a few more times, and then communicate it back to the rest of the community.

Back before the Internet and blogs, there was huge value in that. If you think I don't have time to do surveys, think about your typical IT manager. They had no time, so picking up the phone and calling an analyst, who could then relay back what a bunch of other folks already learned was a huge value. It was a good business and really helped customers do their job better.

But let's fast forward to the present day. Now there is no lack of information, in fact there is too much information. The job of the analyst (in my opinion anyway) is not to gather and find information any more. It's to narrow down the infinite amount of information out there. It needs to be both digestable and useful to that same IT manager who is still too busy to tackle the problem themselves.

Basically, I starting thinking about this after readying a post on Kim Cameron's blog (here) where a reader wonders how Kim has the time to read all of this stuff, link to it, and still do his day job. Kim's point is exactly right. That's how you stay current. You don't need to go to a conference anymore to meet with a bunch of people and figure out what's going on. You can do it by reading people's blogs.

Is there a problem with a certain firewall? Odds are someone has blogged about it. What's going on with Vendor X? I'm sure someone out there has an opinion. Just check out the blogosphere. Of course, this is one way communication. But most of the folks I've met through blogging have been very willing to discuss a point either through email or on the phone, if something needs to be clarified.

I'm sure my wife is thinking what the hell is the value in that? It's not so much in building and nurturing the network (though having a good network does help), it's in helping people to wade through the crap and figure out what's important to THEM. The only way to do that is to wade through the crap yourself. That's why I follow over 300 different blogs and read for a significant portion of my day. When I'm stumped, I pick up the phone and call someone that can help me understand.

The value add is that I've done this long enough to recognize the patterns and be able to figure out what is important for most of you. That's why I get up in the AM and do The Daily Incite.

 

I've written pretty extensively on vendor rankings from analysts and how and why they should be used by end users. Here is a smattering of stuff:

• MQ does matter - even if G doesn't think so (here)
• The joke of analysts' vendor rankings (here)

But something that Chris Harrington of InfoSecPodcast wrote earlier this week fills a hole in my documented position. Basically Chris' post (here) overlays all of that procurement blather that I spout above with the customer size segmentation filter. Huh? OK, I'm talking in tongues again.

Chris' point, and it's a very good one, is that a magic quadrant is built for the LARGE ENTERPRISE. That's who Gartner hangs out with and that's where they get their information (besides vendors that is). The folks that are MQ Leaders have done a good job selling high-ticket items to large companies with big budgets.

What if you are a mid-sized company, that is looking for a small-ticket item, and you have very little budget? Then you'd be like 90% of the world and the MQ would be TOTALLY IRRELEVANT to you. Chris' friend is pretty much like a lot of the folks I run across every day. The conversation goes pretty much like this:

Him: "But they aren't in the Leader Quadrant."
Me: "So what? Why do you care who sells a lot into the enterprise? That's not you."
Him: "Because I care. My CIO used to work for a big company and he believes in the MQ."
Me: "Then he's an idiot."

The conversation usually ends right about there, but the point is the same. When you are buying a security product, the vendor rankings can be a useful guidepost to define a short list, BUT ONLY if you look like the analyst's typical customer. If not, then best case you are wasting your time. Worse case, you are buying something that you don't need and likely spending way more than you need to.

While I'm on the topic, Thomas at Matasano questioned the usefulness of "joke" post (here), given most analyst work is not "statistically relevant." So let me clarify things a bit more. My point is that both Gartner and Forrester make you want to believe that they are talking to thousands of end users and developing these positions. But they aren't. And if they are just answering an inquiry - that is fine.

BUT if they are using that data to place vendors on a chart, it's a problem. The chart by the virtue of it being a chart indicates a QUANTITATIVE analysis. But the underlying information to develop the chart is in fact QUALITATIVE. That's my issue.

If they want to do a ranking of vendors based on what they hear, that is fine. But if they place them on a chart (where vendors will inevitably get out the ruler and measure the distance between the dots), then there needs to be more quantitative rigor to the analysis.

That's my story and I'm sticking to it.

 

The folks at TechTarget were kind enough to let me republish my posts
at the Expert Answer Center here. This post first appeared on July 12.
Link here.

As I discussed yesterday, I've spend a lot of time helping end users buy security products more effectively. Inevitably the customers want a recommendation on what product they should buy. Most are chagrined when I tell them that I won't do that. I can certainly provide some perspective on who are the market leaders, based on lots of criteria. But I won't recommend a product for them. That's their job, because it's their ass that's on the line if the decision is wrong. You can't outsource the decision, not if you like your job anyway.

But not all of the analysts out there think this way. The business of ranking vendors is a big one. Whether you want to call it a Magic Quadrant, a Wave, market sizing, or anything else -- these are all fundamentally the same. They strive to generate a generic answer to what is the best product, based upon some arbitrary criteria.

Here's the problem. Your environment isn't generic, is it? If you look exactly like companies of similar size in similar businesses, then what is your differentiation? Why are you different? There are definitely similarities between businesses based on size and industry, but each organization has their own strategic imperatives, culture, threshold for pain and budgets. You cannot generically decide what products will potentially be best.

And even worse, as pointed out by looking at James Governor's post on MQ sample sizes and this Forrester post, you see that these opinions are based on a very small sample sizes. Help me understand how Forrester decides market leadership based upon talking to seven vendors and 10 users? Gartner at least "talks" to a hundred or so users. But this is not statistically significant stuff, let's be clear about that.

Sure Gartner and the others field lots of inbound calls, but rankings are based on specific quantitative criteria based upon qualitative conversations. So it all gets back to opinion. They are making it up. Which is OK, but only if you trust the analyst.

As for me, I don't trust anyone. Sure, it's a personality quirk, but if my career was on the line, I'd be real careful about using these tools as key arbiters of the decision.

I recommend you use an MQ or a Wave or any other chart as a guidepost. Do your own research and potentially validate your findings relative to the analyst chart. But don't allow the chart to dictate your short list. There are a lot of vendors that don't even get on the >chart or are poorly ranked because they don't (or can't) play the game. That doesn't mean those vendors wouldn't be the best fit for what you< need to do.

But what annoys me the most is that these analysts agree with me on how and when to use a chart. They don't want the responsibility. I ranted about that on my personal blog. The problem is that customers don't get it and until they do, these
vendor rankings will be much more important then they should be.

 

Oh crap. Seth Godin, the guy with maybe one of the biggest megaphones in marketing circles thinks "Small is the New Big." That's the title of his new book (Amazon link here) and also one of his seminal posts about the rise of small companies (link here) from a year ago.

Does that mean my "Big is the New Small" is kaput? Not by a long shot, brother! We are both right. In the security business, small is a problem because of the complexity of the problem. Continuing to look at very narrow bands of the issue and praying that the customer can integrate all the pieces isn't working.

So if you are dealing with big, nasty, hairy, and complex problems, I think big is better. Small just doesn't have the resources to get the job done.

But for many other businesses: Seth's post is right on the money. Here are some of the advantages of being small:

Small means the founder makes a far greater percentage of the customer interactions. Small means the founder is close to the decisions that matter and can make them, quickly.

Small is the new big because small gives you the flexibility to change the business model when your competition changes theirs.

Small means you can tell the truth on your blog.

Small means that you can answer email from your customers.

But here is the killer: "Small is the new big only when the person running the small thinks big."

When I read that post, I get clarity about my business. Personally, I don't think IT research is one of those problems that requires a big company to solve it. So if you look to the impact that some of the smaller boutiques (RedMonk being the poster child) are having - the thesis is playing out.