A new report by Infonetics Research called Security and Encrypted VPN Services predicts that the global managed security service (MSS) market will double in value by 2010 to about $12bn.

Infonetics said this growth is being fuelled by the increase in the number and variety of security threats, and the perceived complexity of the current crop of security systems. Another contributing factor is the ongoing shortages in IT staff with security expertise.

Internet Security Systems (ISS) Northern European director, Andrew Lawton, agreed that the skills issue was driving growth in outsourced security. “It doesn’t make sense to have staff focused on that non-core business,” he said. “The huge amount of [security] expertise needed by firms to secure themselves leads to a large cost overhead in personnel and hardware and software systems.”

Lawton said 45 percent of the security costs borne by firms is related to personnel. “Firms have to be sure personnel have up-to-date skills and they also need to be able to retain them, which is a big headache for IT directors,” he added.

One MSS area that Infonetics expects to shrink is managed encrypted VPN services. Infonetics principal analyst for network security, Jeff Wilson, said that large enterprises were starting to migrate from complex self-managed IPSec VPNs towards simple carrier-managed Multiprotocol Label Switched (MPLS) services. So, although managed encrypted VPN services revenue increased by four percent between 2005 and 2006 to $20.5bn, Infonetics predicts a decline in coming years.

Demand for managed security services is particularly strong among small and medium-sized enterprises (SMEs). Nabil Souli, chief executive of security services specialist UBIqube, said, “There are two key issues for SMEs. First is that smaller businesses have smaller IT resources, which means that security implementation is not always easy and seamless. The second is that there is an overwhelming lack of MSS providers in the UK that are equipped to provide a scalable solution to the SME market.”

Souli said that historically most MSS providers (MSSPs) have tailored their services for the large enterprise market. “MSSPs currently do not have the technology to give SMEs the same level of service with a tailor-made solution.”

UBIqube last week launched an MSS toolkit that is designed “to enable telecom operators, integrators and VARs to deliver enterprise-quality MSS to the SME/SMB market”.

Another driver for firms moving to managed security services is the increasing volume of compliance regulations, which Souli said could be the trigger for all SMEs to outsource their security.