Zoom’s rapid adoption highlights security concerns; Microsoft and Google are better positioned

Microsoft (Nasdaq: MSFT) and Google (Nasdaq: GOOGL) were relatively well prepared for the unexpected demand for videoconferencing, with global data centers and strong security measures in place, while Zoom’s security was not ready for the same scaling. There have been numerous reports of “Zoombombing,” which is when hackers join a Zoom meeting and disrupt the workflow, particularly in online classrooms. While some educators did not use password protection to make their online classrooms private, TBR believes this security lapse also occurred because Zoom lacks end-to-end encryption. Microsoft and Google Cloud have experienced difficulty with outages but have performed well in terms of security with end-to-end encryption in Teams and Meet. The regularity of these hacks has led to a recent investigation by the FBI and caused some government agencies, companies and educational institutions to ban the use of Zoom. In TBR’s special report Security measures taken to combat impacts of COVID-19 on businesses will have long-term implications, Senior Analyst Nicole Catchpole discusses the security concerns with Zoom and other cybersecurity threats that have risen amid the COVID-19 pandemic.

Zoom, Microsoft and Google remove pay barriers, increasing usage and setting the foundation for a much larger base of paying customers post-COVID-19

Use of videoconferencing solutions is skyrocketing, but modernization of these platforms will be a long-term strategy

Zoom, Microsoft and Google are offering their video-collaboration tools for free to support the unexpected global shift to remote work and learning environments. For six months, Microsoft is removing paywalls for Government Cloud and certain Office 365 subscriptions — including Office 365 E1 for businesses and Office 365 A1 for educational institutions, both of which include Microsoft Teams. Google Cloud is also offering Meet for free until Sept. 30, but only to existing customers, which makes it slightly more restrictive than Microsoft’s offer. Finally, Zoom has also removed the 40-minute time limit on its free basic subscription tier for K-12 schools in numerous countries, including the U.S., where the company boasts roughly 60,000 customers as of mid-March. Within the “freemium” tiers that are available, Zoom customers can have up to 100 participants in a virtual meeting, whereas Teams and Meet can support up to 250 people in a meeting. Given that each of these vendors has reduced cost-related barriers to adoption, customers can select the vendor that best fits their broader IT environment.

The global shift to a virtual work-from-home and learn-from-home environment has drastically increased demand for SaaS solutions that support collaboration and remote workflows, particularly videoconferencing as companies and educational institutions try to maintain as much face-to-face communication as possible. Among the numerous SaaS offerings available, some of the most popular are Zoom, Microsoft Teams and Google Meet. Zoom quickly rose in popularity and became a household name, growing from 10 million users in December 2019 to 200 million users in March 2020. While Zoom’s (Nasdaq: ZM) number includes individual nonpaying consumers, the vendor has also signed paying business and organizational customers including IAC Group, Rubrik and Texas A&M. Microsoft Teams and Google Meet experienced growth spikes as well. The number of users on Teams more than doubled, from 20 million daily active users in November 2019 to 44 million in March 2020, including enterprises such as EY, SAP (NYSE: SAP), Continental AG and Accenture (NYSE: ACN). Google Meet grew by more than 25 times from January to the end of March and is adding 2 million new users per day, with customers such as Korean Air, Shopify (NYSE: SHOP) and TELUS (NYSE: TU). While Zoom’s total user growth is strong and its offerings are widely used, TBR expects Microsoft and Google Cloud will start to poach Zoom customers due to their value-add hardware and SaaS offerings Office 365 (200-plus million users) and G Suite (6-plus million users).

The COVID-19 pandemic has unleashed an array of cyberattacks that threaten the health of our virtual systems, including but not exclusive to those in healthcare, banking and government agencies. Cyber criminals are capitalizing on widespread weaknesses with attack vectors in the form of spam, phishing scams, ransomware and malicious URLs. As the number of infected persons soars, so does the number of cyberattacks, but despite the short-term effects of combating threat actors, in the long term, the world will emerge more secure and better prepared, armed with lessons learned from strategies implemented and tested during the pandemic.

Malicious actors target victims through various tactics and ploys

Hot zones of cyber vulnerability have typically been localized or within a specific organization. While such attacks have disastrous ramifications in their own right, never before has the number of threat vectors been so far-reaching. As the COVID-19 pandemic forces the majority of the global workforce to stay home, employees have had to create makeshift ways of working while longer-term solutions are devised. The surge in the number of individuals working remotely and the strain that places on existing infrastructures is an underlying cause for a large majority of these attacks.

Many corporations and individuals are turning to user-friendly and feature-forward solutions. In particular, Zoom has seen a rampant surge in daily users, from 10 million in December to 200 million in March, as what was once meant for use by businesses is now also being used for daily work life and personal communication. Unfortunately, the company did not have the adequate levels of security infrastructure to support this surge, resulting in self-proclaimed “Zoombombers” infiltrating private corporate meetings, Alcoholics Anonymous meetings, online learning environments and more. The company was quick to issue a statement and plan to address these issues, with Zoom CEO Eric Yuan stating in a blog post, “We did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home.” Yuan added that over the next 90 days the company will “[enact] a feature freeze … shifting all of our engineering resources to focus on our bigger trust, safety and privacy issues” and release a transparency report, similar to reports shared by tech giants such as Facebook, Google and Twitter.

In addition to hacking into and taking command of private meetings, threat actors are masquerading as legitimate organizations with the intention of collecting highly personal information, such as a COVID-19 safety portal allegedly from the World Health Organization and a fake disease prevention waitlist portal. Additionally, a Venmo-like interface was recently discovered in the form of an emergency fund to generate relief dollars for those in need, and the Better Business Bureau has received numerous reports of individuals acting as U.S. Department of Health and Human Services and other government department employees, instructing text message recipients to click on a link for a so-called mandatory online COVID-19 test.

Who is working from home? Do they have everything they need? Can they stay connected? Are they OK? Companies around the world have been struggling to answer those questions in recent weeks as the COVID-19 virus became a global pandemic and suddenly forced many workers, and their employers, to adjust to remote working. As human resource policies, security concerns, connectivity and productivity have all been challenged, PwC U.S. rolled out a solution to answer the most basic and pressing question: “Are you able to work today?” With a simple interface, a quick and anonymous process, and with security and privacy baked in, PwC’s solution helps clients quickly determine what percentage of their workforce is enabled to work effectively and what percentage has issues with technology, mobility, supplies or well-being. If widely adopted, the solution should pave the way for a second PwC product: an application designed to help track and trace employees in the event of someone contracting COVID-19. In TBR’s view, these paired solutions demonstrate a concrete and immediate response — from idea to launch in five weeks — to some of the issues facing global companies during the pandemic and should set PwC’s clients up to better understand and manage remote working productivity in a post-COVID-19 world. 

First: Confirm status

Every company needs to know whether its workforce can be productive on any given day — an issue that hardly seemed critical or hard to measure at the start of 2020. Now, getting a daily picture of potential productivity has become an ongoing challenge for many companies navigating COVID-19, raising questions around what percentage of the workforce can be expected to be productive. On April 1 PwC launched a solution, Status Connect, to address that challenge while still conforming to privacy and security standards. At its core, the solution allows administrative professionals within an organization to know what percentage of the workforce in any specific geography and/or business group has an issue preventing them from working effectively. With that information, particularly as daily responses turn into trends, a company can deploy additional resources where needed, forecast potential slowdowns, and gain insights into what kinds of underlying problems hold back the company’s overall productivity.

Initially the solution offered employees only two choices, technology and other, in essence to gauge what is challenging their ability to work effectively, but PwC has already expanded the choices to technology, mobility/travel, business supply and well-being. PwC leaders noted that some clients already adopting the solution anticipated needing a more complex set of options to gain meaningful insights, until PwC explained the richness of data insights available across a large population based on a simple user experience. As the firm continues developing Status Connect, it is adding gamification to enhance the sense of community and drive adoption and commitment to using the solution every day, as well as daily custom broadcast messages and company customizations. Notably, the firm has implemented the solution across some parts of the U.S. member firm, but not yet globally.

As TBR has previously noted: “With risk permeating every business conversation and PwC accelerating investments in digital-related offerings, including PwC Connected Solutions, which sits within its Risk and Regulatory Platform business, the firm has prepared for the next wave of opportunities. Trading on trust remains at the core, especially as the politics of data continue to disrupt PwC and its clients. Becoming customer zero keeps PwC consistent with peers, while pulling in risk differentiates, particularly against non-Big Four competitors. But the firm creates a good use case for embracing digital when it comes to managing risk.” PwC is not immune to COVID-19 and all of the workforce management implications that come with it. Adopting the solution internally is certainly the proper next step as the firm strives to protect its spot in the market as the shift to digital operations elevates the strategic importance of risk and compliance functions.

It takes a village, but a distant one

For years, IT services vendors — and now increasingly consultancies — have been building business models around supporting enterprises’ IT and business processes, largely by leveraging the human arbitrage model and price-competitive offshore centers. While in recent years many vendors have begun to build on-site and/or nearshore facilities offering higher-value services, COVID-19 is now challenging these vendors to shift to remote support. For vendors that largely rely on using offshore hubs in locations such as India and the Philippines, the struggles will be even greater as these countries typically lack well-established infrastructure, iNet connectivity and electricity. But even vendors that rely on a high-touch consulting model and house the majority of their workforce in more developed countries with reliable infrastructure could be pressured in the short term due to an absence of personalization and face-to-face interaction. In addition to these hurdles, all vendors face the challenge of skill shortages, particularly in emerging areas such as AI, blockchain and data science, further hindering vendors’ ability to deliver on their DT programs’ promises.

According to TBR’s December 2019 Digital Transformation Insights Report: Voice of the Customer, improving HR operations, employee efficiency and effectiveness ranked in the middle (No. 5 out of 10) as a DT objective among surveyed enterprise buyers, not only currently but also within the next two years. We believe, however, that COVID-19 will likely force buyers to reorder their DT objective priorities and place HR transformation at the forefront. Vendors that are able to weather the storm by successfully navigating their own internal HR transformation, addressing remote working challenges and executing on business continuity plans with minimal disruption will likely emerge as the winners when the COVID-19 crisis abates.

The two largest opportunities within HR transformation will be centered on: 1) change management, which is typically a consulting discussion, especially for buyers that have yet to embrace the remote working culture; and 2) digital workplace solutions, as the need for implementation and management of platforms like Zoom (Nasdaq: ZM) and Microsoft Teams (Nasdaq: MSFT) at the enterprise level is already positively impacting vendors’ top line.

While digital transformation (DT) began to permeate both the lexicon and the minds of enterprise buyers and third-party providers about five years ago, the current global pandemic has brought a dose of sobering reality, raising questions around not simply when to embrace DT programs but also which processes are most critical to weather the storm. We see employee management, aka HR operations, and cybersecurity as two areas enterprise buyers will race to invest in as the COVID-19 outbreak disrupts operational cadences and highlights security risks associated with remote working. Supplying those services will not be enough; IT services vendors and consultancies must bring their clients reliable scale, making partnering even more critical for digital transformation.