Expanded security services well beyond value-added reseller

On July 28, TBR attended a presentation and Q&A session held by Optiv’s leadership team, including CEO Kevin Lynch and SVP for Cyber Defense & Applied Security Jason Lewkowicz, who discussed the company’s overall strategy, place in the market and core cybersecurity offerings. They were later joined by a broader Optiv team for a deeper dive into some specific security services offerings. The following reflects that session as well as TBR’s ongoing research into and analysis of the cybersecurity services practices of leading IT services vendors, cloud vendors and software vendors.

 

For TBR, CEO Lynch captured Optiv’s essence when answering a question about change management by emphasizing how much Optiv itself has evolved and will continue to do so. Lynch said the company’s services business has changed significantly in the last couple of years. Previously, Optiv provided mostly attached technical services, bringing in third parties in a standard VAR business model. With expanded capabilities, Optiv expanded its footprint at clients and has shifted its focus to business outcomes, reflecting an evolution in how chief information security officers (CISOs) see their value in an organization. Lynch described Optiv as “the last mile in a tech ecosystem” and said his company was built for this particular moment in cybersecurity services, as Optiv combined “great technical acumen in the field,” proximity to clients, and technology ecosystem partnering done in “a unique way.”

 

In TBR’s view, Optiv unquestionably benefits from deep expertise in deploying and integrating a wide range of technologies across the security space and executing a business model pivot from VAR to a full range of consulting, integration and managed services capabilities. Private equity ownership and the ability to attract top security talent undoubtedly have helped the company expand. Sustained growth in the near to medium term will likely depend, in TBR’s view, on Optiv’s ability to scale current capabilities without compromising quality, expand brand recognition within the ecosystem as more than just a VAR, and deepen the company’s footprint with clients without overextending outside its core security services offerings.

 

Close to clients, and delivering on technology and services

Optiv’s presentation included details about the company’s current business, which has over 2,300 professionals serving approximately 6,000 clients, predominately in North America. Lynch noted that the company’s revenues expanded at a double-digit growth rate from 2020 to 2021 based on two growth pillars: technology, which includes reselling technologies and solutions from 450 partners; and, services, which includes a 650-plus-person team of experts with deep technical talent working directly in the field on clients’ specific business and security challenges, supported by larger delivery and Security Operations Centers teams.

Lynch said clients vary widely by revenue size, and most of Optiv’s talent works in close proximity to clients’ sites, with the company operating just three main hubs in Kansas City, Kan.; Denver; and Bangalore, India. For context, TBR notes that Atos has a little less than three times as many security services professionals generating around $750 million annually, Accenture Security (NYSE: ACN) claims a headcount almost seven times Optiv’s with revenues close to $6 billion, and Deloitte has close to 10 times the headcount of Optiv and revenues near $4 billion. Those figures likely include professionals in roles not specific to security who provide industry knowledge, consulting or systems integration in coordination with more specialized security services engagements, but the overall scale of those three vendors challenges Optiv in terms of talent and client mindshare.

Meeting clients where they are with advice, implementation and managed services

Shifting to a discussion of how Optiv provides security services to clients, Lynch described three “modalities”: advise, deploy and operate. In the first, Optiv views its clients as deserving of “great advice on what to do in this unprecedented time,” leading the company to provide security strategies, insights, design and envisioning of desired future operational states. The second modality, deploy, constitutes the shift from “thoughts to actions,” as described by Lynch, and includes an evaluation of which technology assets should be deployed, validation of a client’s existing technology, sourcing by Optiv of fit-for-purpose technology, and integration into a client’s environment.

After this stage, according to Lynch, some clients ask Optiv to become a full-on security partner, taking over the operations of the client’s security apparatus through a managed services arrangement. Lynch said these clients typically recognize that Optiv’s security expertise cannot be replicated in-house, in part because these clients’ core business value does not come from security while Optiv’s does. He added that Optiv “will build the product stack to deliver on this promise” of providing “the entirety of [some clients’] security needs,” but cautioned that because Optiv has “to be perfect when we deliver,” the company continues to build out these capabilities to meet their ambitions.

 

Diving further into Optiv’s approach, SVP Lewkowicz noted Optiv has shifted its focus to making its services simple for clients to consume, in part by meeting a client “wherever they are on the security journey.” In describing some of Optiv’s security services, Lewkowicz said the company’s Strategy and Governance practice works with clients lacking core competence and expertise around security, helping those clients set desired outcomes; the Digital Transformation practice examines the full spectrum of enterprise technology for security implications, too often after a client has already started a digital transformation journey; and the Risk Management practice helps clients measure risk through the right security and compliance lenses.

In describing these offerings, which Optiv includes under an overall Cyber Strategy & Risk practice, complemented by a Cyber Protection & Identity practice and a Cyber Defense & Applied Security practice, Lewkowicz acknowledged the role of Optiv’s 450 technology partners and said the company is the “connective tissue” between technology and services.

 

TBR noted throughout Lewkowicz’s presentation an emphasis on highly flexible scoping arrangements, with Optiv content to meet a client’s every security need or just a small set. In TBR’s experience, most security services vendors take a more proscriptive — or at least an encouraging with some pressure — approach, potentially leading clients to take on more than they are prepared for. Both Lewkowicz and Lynch stressed that Optiv’s overall culture engendered a flexible and client-centric approach, potentially providing a strength against other security services vendors.

 

One additional note on Optiv’s approach: Lynch described his company’s decision to work with 450 technology partners as a strategic choice, saying they could work with 3,000 or more players across the security technology spectrum but had narrowed its ecosystem down to 450 to make Optiv a “value-added convener of IP.” He said that all 450 technology partners engage in go-to-market motions with Optiv and that the company wraps services around some of those technology partners’ solutions.

For a select group, perhaps as few as seven partners among the 450, Optiv cocreates and builds integrated solutions. This pyramid of partners strikes TBR as refreshingly honest — no company could adequately manage 450 relationships to a uniform degree of commitment and investment. Many larger, multifaceted IT services providers have established services-plus-technology partnerships, often described as business groups, to advance go-to-market strategies with specific technology vendors, such as Amazon Web Services (Nasdaq: AMZN), Microsoft (Nasdaq: MSFT), Google (Nasdaq: GOOGL) and SAP (NYSE: SAP). While a seemingly successful strategy for IT services vendors, TBR does not believe that kind of branded approach, an explicit tie to a massive technology provider, would benefit Optiv.

As CISOs face uncertainty, Optiv provides focus, capabilities and experience

During his remarks, Lynch provided a passionate assessment of Optiv’s place in the market, noting that his company is “built for this moment, for this challenging time for our clients” and “we can stand shoulder to shoulder and help solve problems.” He added that Optiv’s heritage as a value-added reseller provided a solid foundation for evolution to a full-breadth security services company. “We don’t start and stop with [a VAR role],” he explained, “but bring consulting and tech talent to wrap around solutions and provide integrated outcomes.” Lynch contrasted Optiv with IT services vendors and consultancies that have a security services business as part of their overall suite of offerings and capabilities. Optiv just does security, and in Lynch’s telling, clients appreciate that singular focus.

 

Lynch spoke at length about the current challenges facing CISOs, including a challenging market for talent, accrued technical debt and legacy tools, many of which are not integrated and cannot coherently and consistently deliver business, data or technology outcomes. Added to this environment, Lynch said CISOs face changing reporting structures and must now do more than simply provision technology; CISOs now have to deliver business results, a shift Lynch described as “from inputs to outcomes.” Further, Lynch said cybersecurity attack surfaces and perimeters got stretched because of the pandemic and remote working, raising questions for CISOs about whether that expansion would become permanent. Lynch speculated most enterprises would remain hybrid for the coming decade, resulting in sustained demand for security services.

 

To meet these challenges, Lynch said Optiv brings its twin technology and services pillars, as well as the full 450-partner ecosystem, in a differentiated way, delivering full capabilities against CISOs’ current needs. In addition, the company launched its first solution using its own processes and will be aggressive in the near term on innovation and development, potentially also using acquisitions to expand across the market and into additional geographies.

Lynch and John Johnson, Optiv’s VP for Cyber Strategy & Transformation, noted competitors provide technology solutions but rarely have the ability to identify system dependencies and do not focus on business processes, leading to gaps in data and understanding about clients’ business-critical processes. Johnson noted that traditional IT services providers and consultancies do not approach resiliency and recovery with the same rigor as Optiv, speculating that these competitors perhaps lack talent who have responded to real and substantial ransomware attacks. On a final note about differentiation, Lynch said Optiv has experienced people who have seen the bad outcomes that can happen, are battle scarred and know what is really needed.

 

TBR has written extensively about IT services vendors’ and consultancies’ cybersecurity practices, having been briefed by those vendors, visited security operations centers and seen demonstrations of leading-edge solutions. But even with scale and people who are passionate about their craft, those security services practices remain only a part of the vendor’s or company’s overall business. Lynch is right in saying Optiv’s focus on only cybersecurity separates his company from competitors, no matter those competitors’ scale and client base.

Further, TBR’s research on digital transformation (DT) (see Figures 1, 2 and 3) illustrates two trends beneficial to Optiv: buyers continue to make security a priority, and buyers increasingly want an ecosystem of vendors, not “one throat to choke.” Optiv’s business model pivot to expanding beyond being a VAR, combined with the expertise Optiv has been recruiting in recent years and an emphasis on consulting — yes, Optiv now does change management consulting as part of its cybersecurity strategy engagements — appears to round out a complete picture of a most capable security services company that is well suited for the coming changes in the security services market. In Lynch’s words, TBR believes Optiv may be “built for this moment.”

 

TBR includes coverage of cybersecurity services in individual vendor reports, benchmarks and market landscapes, with all analysis based on the individual strategies, performances and activities of the IT services vendors and consultancies in TBR’s scope. Foundational reports used for this special report include IT Services Vendor Benchmark, Digital Transformation Insights Report: Voice of the Customer Research and Management Consulting Benchmark. Access these reports and more with a 60-day free trial of TBR Insight Center™.

Earlier this month, TBR reconnected with Albert Seubers, Atos’ global strategy director for Smart Society, to discuss developments in the smart city space broadly and Atos’ efforts specifically. TBR has examined smart cities from a variety of perspectives in recent years, including how smaller versions of cities, such as ports and arenas, could serve as test beds for the technologies and services needed to overcome the regulatory, change management and political challenges foundational to most smart city opportunities. The following reflects TBR’s discussion with Seubers as well as ongoing research around smart cities, digital transformation and Atos.

Connectivity among emerging technologies boosts hope for more smart cities

In TBR’s view, as the ecosystems around emerging technologies foster increased adoption by enterprises and create scalable use cases, municipalities can more easily understand the potential for smart city projects. The technology gets faster, cheaper, more reliable and more connected, all of which opens possibilities for more technologies.

Understanding that the exponential acceleration of connections between IoT, edge, analytics and AI, made possible through wider cloud and 5G adoption, has expanded the technological possibilities of smart city projects, Atos and other IT services can now position smart city engagements as relatively safe investments. The technology will work as expected, with the necessary connectivity sustained and the analytics providing useful information for decision making.

As TBR has previously noted, technology limitations do not hold back smart city use cases; political will and budgets do. Atos’ approach to tackling the technology challenges while managing the people — politicians, regulators, citizens — reflects this understanding and leans on Atos’ long-standing reputation for consistently delivering against the needs of clients, including municipalities, first responders and other actors within a smart city environment.

Digital twins will be the next 5G as 5G becomes ubiquitous

According to Seubers, digital twins have emerged as the latest hot topic within the smart cities ecosystem, particularly in the U.S. Seubers described digital twin-enabled solutions designed to forecast traffic models and emissions, using a digital representation of the city to include elements such as air quality and sound-related stress. Turning to 5G, Seubers commented on the disparities in adoption across the globe.

Many cities in Asia and some in the Middle East, Seubers said, have already rolled out 5G, although reliability has varied considerably. Europe broadly remains in a transitory state, with very few examples of citywide 5G coverage and usage. “It’s the promise,” Seubers said, but to date no cities have successfully deployed at scale, with data and privacy still very much country-to-country issues, further complicating any broad adoption across the region. The U.S. lags.

As for the benefits of 5G to smart city opportunities, Seubers lamented that too many municipal leaders invest in 5G rollouts and “expect change will happen,” without fully understanding the potential use cases, challenges and changes that will arise once 5G is in place and in use. That uncertainty around potential failures and fears of misspent public funds, of course, provides an opportunity for Atos.

Critically, data remains the linchpin for every smart city application. Atos’ experience with collecting, cleansing, orchestrating, analyzing and protecting data provides the vendor with the trusted expertise municipalities demand for any smart cities project. City leaders, who are confident that a smart city deployment will provide citizens with added value and not compromise citizens’ data — better government without Big Brother — will advocate for, budget for and defend their initiatives while looking to their smart city vendors to provide those assurances. The technology, all parties will agree, is not the challenge — it is the data and the people.

Tackling bite-sized projects to avoid having too many cooks

Addressing the second half of the smart cities challenge — the people — Seubers said Atos has learned through experience that having too many decision makers unnecessarily complicates priorities, timelines and adoption. Change management becomes unruly and even the technology ecosystem can become overburdened with niche players supported, politically, by a variety of municipal stakeholders.

Atos’ proven approach centers on specific departments within a city, delivering results on a small scale and demonstrating value to the wider municipality. One key to success, according to Seubers and common to nearly every digital transformation effort: executive-level commitment. Helping gain leadership buy-in, Seubers explained Atos has been using its global network of Business Technology & Innovation Centers (BTICs) for “inspiration sessions” to help municipal leaders think beyond a single problem and beyond a single technology solution. Due to travel restrictions in recent years, the BTIC Studio network has proven to be a great asset for driving online inspiration sessions, working with different BTICs in parallel during customer meetings.

As an example, he cited a session in Atos’ Vienna BTIC in which five major Polish municipalities will discuss a range of smart city projects, examining both proven use cases around Europe and solutions particularly well suited to Poland, including data privacy laws, technology infrastructure, and federal and municipal funding structures.

In TBR’s view, Atos’ strategy depends on determining where small-scale projects can be launched, delivering quick success and then expanding methodically throughout a municipality’s broader smart city landscape. This creates minimal initial budgetary commitments, provides leaders time to gain citizen buy-in and allows Atos the flexibility in proposing specific solutions, in contrast to a cookie-cutter, one-size-fits-all-cities, technology-first approach. Atos also recognizes that smart cities can only succeed when the human components — leaders, technology professionals and citizens — benefit in meaningful and measurable ways.

 

Next for Atos: Expanding where the opportunities are, delivering technology

If abundant 5G and advances around digital twin technology spark a resurgence in smart cities, TBR anticipates Atos will continue to turn inspiration sessions into small-scale implementations across Europe and in some select cities outside the vendor’s home region. [Tweet this!]

Asian and Middle Eastern municipalities may become an increasingly lucrative market as well, as the combination of rapid 5G deployment, typically fewer decision makers, and newer technology infrastructure in those regions matches well with Atos’ capabilities and approach. Expanding in APAC through smart cities could be a faster route to growth for Atos than options elsewhere outside Europe. In addition, TBR anticipates Atos will increasingly conflate sustainability and smart cities offerings, building on the core value proposition that smart cities can be part of a municipality’s and country’s decarbonization strategy.

One final note: Atos is unabashedly a science-driven company among IT services peers that often emphasize consulting, outsourcing or both. As much as smart city projects depend on advising leaders and managing stakeholders, citizens will always want to know one thing for certain: Does the technology work? On this point, Atos’ track record of getting the science, technology and data right gives the vendor a quietly strong market position should a spike in smart cities demand emerge in the near term.

Robotic process automation and citizen-led strategies may upend talent management for the better

Every consultancy and IT services vendor — along with many of their clients — faces challenges recruiting and retaining people. PwC may have found a surprising tool in the war for talent and battle against attrition: automation. Seriously. Combined with analytics and deployed with intensive change management, intelligent automation may be one of PwC’s key methods for helping the firm and its clients attract and keep talent. [Tweet this!]

 

In late June, TBR met with Kevin Kroen and Kevin Schwartz, both PwC partners and leaders in the firm’s Intelligent Automation practice. The following reflects that discussion as well as TBR’s previous reporting on and ongoing analysis of PwC, particularly PwC Products.

Rethinking automation: Citizen-led, advanced and ubiquitous

Kroen began the discussion by explaining that in the early and mid-2010s, PwC tried to build a full automation practice as a premium brand in a nonpremium business. The firm’s consulting around automation gained some traction, but clients were frequently reluctant to pay for substantial automation consulting engagements. In addition, PwC consistently came in as an expensive choice for implementation, particularly against India-centric IT services vendors.

 

When PwC assessed the market, a diverse set of competitors appeared to be delivering subpar value to clients. In many cases, automation software vendors and systems integrators (SIs) crammed technology solutions into business processes without a good fit. Clients failed to engage in the strategic thinking about their automation needs and goals prior to buying an automation solution.

 

Rather than being part of a larger technology or digital transformation strategy, automation was “single-threaded” and had minimal adoption. Most damaging to overall client value, the SIs and automation software vendors ignored the necessary change management.

 

So, in 2019 PwC did a rethink and came up with three key components to a new intelligent automation offering: citizen-led, advanced and fully wrapped into all of PwC’s existing practices. As described by Kroen, citizen-led imagines enterprise professionals outside of IT being trained for and prepared to use automation, embracing the tools, and becoming users and even innovators. For PwC, launching the Digital Fitness app in November 2017 started the firm on its journey to citizen-led digital upskilling and, nearly five years later, the firm’s own success has become a use case it brings to the market: It worked for us; it can work for you too. (For a detailed description of PwC’s citizen-led approach, click here.)

 

The second component, broader and more advanced automation, emerged from the realization that the right automation tool kit — developed with PwC Alliances — had become table stakes across the market and PwC needed to build peripheral capabilities that allowed clients to apply automation solutions to their most challenging problems, not just simple processes.

 

According to PwC, the firm’s technology investments and alliances allowed it to deliver on the promise of seamless, intelligent, advanced automation. And lastly, PwC pivoted from selling automation as a stand-alone service to wrapping automation into the firm’s practices and offerings, including tax, audit, risk and consulting.

 

While this was not an overnight change — business model and cultural shifts never are — Schwartz said some practices embraced automation more quickly than others and, overall, PwC had substantially transitioned to bringing automation to clients through all practices. For example, PwC partners leading the Digital Value Creation offering within Fit for Growth now include automation in their proposals, fully baking the tools and value propositions into the offering’s go-to-market approach.

Embracing the employee experience of working with, not being replaced by, automation

Kroen stepped back from discussing the specifics of PwC’s automation practice today to describe automation’s likely evolution, saying that relatively soon the low-hanging fruit would be consumed and automation would become part of innovation, helping enterprises disrupt themselves and change faster.

 

According to Kroen, the “end state will be digitally native” employees who use automation to grow the business, not simply to reduce costs by streamlining processes. From cost-cutting to growth through — and this is where PwC may be unlocking a tool in talent management — an improved employee experience. PwC’s use of automation, for itself and its clients, revolves around people, not tools.

 

If enterprises embrace change management as critical to automation adoption, upskilled employees will not have to worry about losing their jobs to automation but instead will use intelligent tools to work faster and spend less time on repetitive tasks and can graduate from finding ways to cut costs to helping the enterprise grow. In the war for talent and the battle against attrition, automation becomes part of the solution. [Tweet this!]

 

For example, in TBR’s Spring 2022 Global Delivery Benchmark, we noted the impact automation could have in overcoming the talent obstacles emerging from the war in Ukraine: “In addition to employee attrition, which remains the most immediate threat to vendors’ performance and business models, the ongoing war in Ukraine is further disrupting vendors’ resource management strategies.

 

While so far there has been a minimal impact on vendors’ delivery models, the potential for the conflict to expand outside Ukraine’s borders keeps vendors on edge and going back to the drawing board when it comes to their business continuity plans.

 

TBR sees two immediate solutions to the challenge: diversify global footprints beyond traditional delivery hubs such as India, and ramp up automation in service delivery … we believe ramping up automation will allow vendors to decrease their reliance on India as a global delivery hub and possibly provide them with the necessary solution to combat the potential development of new clusters of state economies.”

 

As a firm-related example, Schwartz said newly hired tax and audit professionals at PwC were being trained on automation tools using the support of the firm’s Digital Labs professionals and the ProEdge learning platform. With clients, PwC partners have been able to demonstrate that the firm helped its own professionals build new skills and become better at and more engaged in their jobs, which makes work more enjoyable and challenging in a positive way.

 

Schwartz indicated that PwC understands, through its own internal experience and working with clients on automation, that upskilling an entire workforce is not the goal for any client. Instead, Schwartz said, the firm focuses on promoting the idea of “acumen and awareness for all” and training 20% to 30% of its employees to become power users. ProEdge, which TBR reported on previously, has become an important piece of PwC’s value proposition around automation and a citizen-led approach.

 

Kroen noted that PwC initially expected ProEdge would be a “transformative solution” impacting the professional development of the firm’s employees as well as a business model change as PwC embraced being a software vendor. ProEdge was initially going to be sold as a premier software offering, but in reality, consulting engagements around ProEdge have grown faster and more substantially than expected.

 

Clients understand the value of citizen-led innovation and expect PwC to provide the guidance and assistance needed to deploy ProEdge to its full extent. Kroen acknowledged the citizen-led approach remains a relatively new concept in the market and is not fully embraced by every industry or enterprise, which makes the prebuilt ProEdge solution, with proven outcomes based on PwC’s internal use, an excellent tool for selling the citizen-led concept, both internally and externally.

Who knew RPA could be HR’s best friend?

TBR did not anticipate coming away from a PwC automation briefing wondering if robotic process automation (RPA) — the dreaded job-killing RPA — held a secret to success in combating talent challenges, one of the most frequently discussed topics across IT services and management consulting.

 

While the discussion occasionally veered into technology details and PwC’s insights into pricing, the competitive landscape and internal challenges, TBR kept returning to the effect a strategic, citizen-led and change management-embracing approach to automation could have on talent across an enterprise. Upskilled and empowered employees will contribute to cost-cutting by being more effective, revenue growth by engaging in innovation, and overall operational efficiency by staying longer.

 

If PwC can combine this approach to automation with the firm’s overall approach to employee experience (see the upcoming special report on PwC My+), it may begin to separate itself from peers with respect to recruiting and retaining while simultaneously bringing added value to automation initiatives — and talent initiatives — at clients.

 

In the last few years, TBR has written extensively about both PwC and automation, including in the following special reports:

• PwC unleashed: A professional services firm adopts Netflix-like business models
• PwC Products: Not your father’s PwC
• PwC’s Industry Cloud strategy delivers on 3 major cloud trends
• PwC accelerates SaaS strategy as latest round of solutions aim to solve marketers’ business challenges
• Evolving at a perfect pace: PwC EMEA Products
• SAP use case reveals big things for PwC
• PwC’s The New Equation: Convening leadership to build trust and drive sustainable outcomes
• ‘Get it right, be convincing and do it fast’: PwC’s Risk Proof upends risk assessments
• PwC’s Saratoga, diversity and inclusion challenges amid the shifting landscape of HR management
• UiPath amplifies the RPA’s value that comes from scale
• UiPath Forward Americas