Security spending is defensive until the budget holder changes

It traded at 250.05 this morning, +0.53% on the session. I am going to argue against the consensus on security spending, and I want to be upfront that the consensus has been right for a while.

The claim I am questioning

Security is sold as recession proof. The reasoning is that nobody cuts the budget that stops the breach, and a breach costs more than the software. It is a good argument and it has held up.

What it does not address is consolidation. A budget can stay flat in total while the number of vendors sharing it falls sharply, and for any individual vendor that is indistinguishable from a cut.

Where the pressure actually shows

Not in headline spending. In the composition of it:

• Tool count per organisation, which has been widely described as too high by the people paying for it
• Platform bundling, where a broad suite is offered at a price that makes a best-of-breed point solution hard to justify
• The shift of the decision from the security team to procurement, which is where consolidation gets enforced

That last one is the important one. The security team wants the best tool. Procurement wants fewer invoices. When the second party gains authority, per-seat pricing stops being set by capability.

Where I stand

Short, and I will be honest that this is the least comfortable view I have published. The company is well run and the product is well regarded. Neither of those is what I am arguing against.

Being right about a business and wrong about its price is the most common way to lose money in software.

What would make me wrong

Consolidation running towards this vendor rather than away from it. That is a genuine possibility and it is the scenario in which I am wrong. A short on a good company inside a consolidating market is a bet on which side of the consolidation it lands, and I could easily have that backwards.

I would drop the short view on evidence that platform wins are accelerating rather than pricing being defended.