Return to BTJ Online

Demand propels software security firm into a $4 billion market
Security threats increase where software development expands

by Anne Straub
Brevard Technical Journal

Dr. James A. Whitaker, chief scientist at Security Innovation in Melbourne. Photo by Craig Bailey, © 2004.

To get a feel for the mission of Security Innovation, imagine a cyberspace thriller merged with a spaghetti western. SI employees are the ones wearing the white hats.

Workers at the Melbourne firm are what's known as white-hat hackers. They try to outsmart the bad guys who want to steal information, break into computer systems and generally gum up the works for the rest of us.

Though the image might be lighthearted, the stakes are high.

More than 90 percent of companies surveyed detected an attack within the last 12 months, according to the Computer Security Institute's latest survey. The greatest financial hit came in the form of the theft of proprietary information.

The crooks are often more opportunistic than clever. Through next year, 90 percent of cyber attacks are expected to exploit known security flaws for which a patch is available or a solution is known, according to GartnerG2, a research arm of Gartner Inc. The group expects 20 percent of enterprises to experience an Internet security incident, beyond a virus, through next year. Cleanup costs will exceed prevention costs by 50 percent, Gartner says.

The challenges have propelled software security to an expected $4 billion market worldwide this year, up 25 percent from 2001, according to Gartner forecasts.

Security Innovation, a private company launched in 2002, won't say what size a chunk of that market it has. But CEO Ed Adams will say he didn't expect to finish the company's first full year with revenue measuring in seven figures. "We did that, with ease," Adams said.

Adams counts a head start among the company's advantages. SI was born after founder James Whittaker, a Florida Institute of Technology associate professor and director of its Center for Software Engineering Research, watched software proliferate during the 1990s as companies saw the opportunity to grow in new ways. Whittaker, author of two books on software security, saw the opportunity, and the threat along with it.

"The fact that James was thinking about this five years ago gave us a tremendous boost," said Adams, who knew Whittaker when both were working in the software testing industry.

Granted, companies like banks were expanding services by letting customers bank online. But they also were creating new vulnerabilities.

"Instead of worrying about tunneling under the vault or holding people up, now you've got potential for cyber crime," Adams said.

Matthew Oertle, Michael Cooper and Florence Mottay are security testers at Security Innovation in Melbourne. Photo by Craig Bailey, © 2004.

Black-hat hackers have shown a propensity to reach that potential. According to figures compiled by Carnegie Mellon's Software Engineering Institute, almost 140,000 security incidents were reported in 2003. That's up from fewer than 4,000 five years earlier.

Whittaker's research and intellectual property created at Florida Tech, along with investor funds, became the genesis of Security Innovation. The company retains close ties with the university on several levels. Florida Tech holds 10 percent ownership, receiving royalties on a percentage basis, with a guaranteed minimum. The university controls a seat on the board, filled by School of Management Dean Tim Hollingsworth. The company has an exclusive research and development agreement with Florida Tech, allowing it to commercialize advances from what amounts to a nearly zero-cost R&D center. And finally, Florida Tech students provide a ready source of labor when work piles up and a feeder system for future hires.

The company helps the university position itself as a center of excellence in software engineering, said Florida Tech president Anthony Catanese. The only drawback, he joked, is that the company could charge more hours if engineers weren't so good at what they do. "My only concern with them is they're so good at it that they do it real quick," Catanese said.

Security Innovation divides its business into three main areas:

• Testing. Outsourced information technology services make up the largest segment of the company's business. Software developers contract with Security Innovation to test their product, breaking the software and finding security vulnerabilities. For example, SI might test a new Microsoft product for vulnerabilities, or try to hack into Amazon's e-business to find security holes. Security Innovation positions itself as focusing on application, rather than the physical devices - such as firewalls -- that are the hallmark of traditional security.
• Training. The company offers courses on software testing and software security.
• Products. So far, the company has one product, Holodeck, that companies can use to test their software. The tool is named for a feature of the "Star Trek" series, and Adams is not embarrassed to admit it. "Because we're all software geeks, we all watch way too much 'Star Trek'," he said.

The company also operates a secure area for classified work, as the government makes up 60 percent of its business.

Security Innovation's most recently hired employee reflects Adams' slogan for 2004: core competency. The company added a marketing specialist last month and hopes to add people in sales and business development to take those loads off the engineers. Right now, the company employs 13.

Adams sees the market as full of more business opportunities than there are qualified vendors to perform them - so much so that the company is somewhat reluctantly considering taking on venture capital to expand. "We have so many projects in queue, we're having trouble with delivery. That's the high-class problem we like to have," Adams said.

The company already has turned down one purchase offer, and Catanese expects more to come. "There are really big companies who are interested in what they're doing," he said.