We are in the middle of a major transformation of how companies go to market, but relationships remain key.

Given market uncertainties, changes in partnering, and the surge in subscription models, most companies are now considering partnership ecosystems as the key ingredient to survival and success, according to Alastair Edwards, chief analyst at Canalys, who spoke on the State of the Channel at the ESET WORLD 2024 conference. 

“Increasingly, vendors co-selling, co-marketing, co-developing, and co-delivering with partners are becoming more important to delivering joint value to the customer,” Mr. Edwards told ESET after the conference.

In the interview with ESET, Mr. Edwards described the current situation with emerging hyperscale cloud marketplaces, the challenges that cybersecurity partnerships face, and the role of AI in the evolving world of cybersecurity.

What role do partners play in the world of emerging hyperscaler cloud marketplaces where vendors can approach customers directly?

While the initial assumption was that hyperscaler marketplaces would cut out channel partners, in fact the opposite is true. Partners will have an increasingly important role in this sales motion, as customers procure a greater proportion of software and cybersecurity through the cloud marketplaces of AWS, Microsoft, and Google Cloud in particular. Customers are able to use their committed cloud spend with the hyperscalers to buy third-party products through the marketplaces, which can be very attractive when core IT budgets are under pressure. They can take advantage of consolidated monthly or annual billing for all their purchases, which simplifies the billing process.

But beyond the transactions, customers will rely more than ever on partners, particularly as they purchase more complex solutions through these marketplaces. A marketplace is ultimately just a catalog of products and solutions. But end-customers need advice on the right technologies to buy, support for those technologies, integration, and management, which only trusted partners can provide. At the same time, vendors selling through these marketplaces continue to need partners to provide customer support, technical expertise, and complex services.

What do these marketplaces mean for vendor-partner-customer relationships?

These models create new dynamics for vendors, partners, and customers. But relationships remain key. Hyperscalers and vendors have recognized the importance of enabling partners to continue supporting customers directly, for example, through offering customized listings to customers through the marketplaces. The hyperscalers are investing in co-selling with both partners and vendors to drive momentum. There is a risk to the channel of course — those channel partners that don’t embrace this model will find themselves being overtaken by those that do. Even those that embrace this will need to continue showing value — and that value will change in future. But Canalys expects the share of hyperscaler marketplace business via channel partners to increase significantly over the next few years.

When preparing the latest Canalys Global Cybersecurity Leadership Matrix, Canalys worked with Channel Partner feedback collected over 12 months. What are the key lessons to take from it?

ESET’s Partners are generally very positive about their relationship with ESET and the support they receive. They are particularly positive about ESET’s ongoing commitment to partners (and channel-led strategy), ease of doing business, the quality of account management and technical support, and ESET’s ability to plan centrally and execute locally. This is why ESET achieved Champion status in this year’s global Cybersecurity Leadership Matrix report.

Based on this feedback, channel partners seek to prioritize relationships with vendors that align with the transformation in their business models and vendors offering products that partners can wrap their own services and solutions around. What does it mean for security vendors? What should they prioritize to create and maintain long-term relationships with partners?

In some ways, the same things apply to building long-term partner relationships: minimizing sales conflict, investing in partner profitability through effective partner programs, building trusted relationships between vendors and partners, and equipping partners with the skills to sell and support the vendor’s technologies.

But in addition to this, vendors must build greater flexibility into their programs and engagement strategies to support an increasingly diverse partner base and partners operating multiple business models, whether those are resell, managed services, consulting, development, etc. Increasingly, vendors co-selling, co-marketing, co-developing, and co-delivering with partners are becoming more important to delivering joint value to the customer. And recognizing customers will work with multiple partners throughout their technology life cycles — and that most partners lack the resources to specialize in every area — vendors must support effective collaboration between partners.

How important is it for cybersecurity vendors to bring innovations such as AI-powered services?

Of course, this is incredibly important. AI is moving to the center of a new cyber arms race between bad actors — cybercriminals that are weaponizing AI to launch more effective attacks — and the cybersecurity industry that is using AI to enhance cyberdefenses, augment existing capabilities, and improve predictions and remediation times. Vendors must be at the forefront of this race or risk falling behind. Canalys expects AI to usher in a whole new suite of advanced cybersecurity technologies. Channel partners and customers will choose to work with vendors that are staying ahead of a rapidly evolving landscape. At the same time, there is a danger that AI becomes overused in terms of vendor product launches and marketing, which will damage credibility and add to customer confusion when most are unclear about the value of AI. Avoiding this risk is critical to long-term success.

On the other hand, there are still some people who see cybersecurity as one single product, such as antivirus, and are surprised when they get a question about how many endpoints they have and what their network looks like. How to earn the trust of such potential partners and show them that cybersecurity is a much more complex topic?   

Many customers still don’t place enough strategic importance on cybersecurity, and these customers are most likely to only think of one product, like antivirus. But they are also the most vulnerable. Cyber resilience needs to become a business hygiene factor, not a nice-to-have. Government regulations will play a bigger role in forcing that. The reality is that building effective cyber resilience as a customer means addressing a plethora of new threats and an expanded surface area that needs to be protected. For companies that understand this, the biggest challenge they face is managing an exponential increase in cybersecurity complexity. One way to do this is to work with a single managed services partner who takes on the management of this complexity on behalf of the customer. MSPs are seeing the fastest growth in the market as a result.

What are the benefits of having a long-term relationship with a leading cybersecurity vendor such as ESET?

Maintaining a long-term vendor relationship is important to ensuring consistency but also efficiency, in terms of the cost and complexity of managing that relationship … partners and customers don’t have to constantly retrain on different vendors’ products and processes, for example. But while there is a growing trend toward ‘platformization’ in the cybersecurity industry (concentrated around a few big cybersecurity vendors), the reality is that no vendor can do everything effectively in security. So, integration with other (specialist) vendors also becomes key to success.

According to Canalys, many partners rank visibility and community involvement highest of their criteria for vendor partnership — even higher than product or pricing. Why is that so?

We are in an ecosystem-led world, in which partners differentiate through specialist skills, customer focus, and business model. Vendors who empower partners within a broader ecosystem, who promote their partners’ skills, and drive collaboration between partners will provide more value to partners than those that just focus on product or pricing.

In the current world when almost everything is cloud-based or XaaS, is it still important for vendors to maintain local offices providing support to their partners?

Yes, local support will remain key. Even in a cloud-based world, relationships still matter. Cloud and AI can be used to augment those relationships and improve efficiency and productivity. But this is a highly competitive world, and those vendors who see the cloud as a way to step away from their partner relationships will suffer from a loss of relevance and share.

Currently companies and their IT admins are battling alert and portal fatigue. How important is it for cybersecurity vendors to help their partners with simplifying alert management and what are the current trends? 

Extremely important. Customers are struggling to stay on top of the scale of cyber threats and the speed with which they emerge. Finding and retaining the skilled staff to do this is a constant struggle. One of the biggest trends in the market is the role of MSPs in managing that on behalf of customers. Vendors who empower their MSPs with tools like simplified alert management or use AI to automate certain low-level support functions will benefit (through enhanced chatbots, etc.) and ultimately this should enable them to deliver a higher level of support for their customers.

Is the pricing/billing system an important consideration in a partnership? What are the current trends? Do customers favor flexible daily billing or flat rates with long-term commitment?

With the shift to subscriptions, the biggest demands from customers in terms of billing and pricing are simplicity and predictability, when the complexity of managing multiple vendor subscriptions is increasing, with different start and end points, contract lengths, and billing models. This can make it extremely difficult to manage budgets, spending, and planning. Customers as much as possible want partners to help them eliminate that complexity. At the same time, they want flexibility to consume and pay in the way that aligns with their business models. The most successful cybersecurity vendors will help to simplify these models for customers and provide this flexibility to meet the needs of different customers.

The number of Android threats detected by ESET telemetry in the past four years has tripled. 

Trojanized chat apps, software development kits turning legitimate apps into spyware, or fake websites offering malicious mobile applications — these are just a handful of the growing number of threats targeting smartphone users in the past few months discovered and analyzed by ESET researchers.

While these threats may sound like the personal problems of private individuals using their own devices, various surveys show that smartphone equipped rank-and-file employees are in fact yet another attack surface for businesses, one that should be prioritized. 

And that’s not easy. Even with thorough cyber-awareness training, there is still a good chance that an employee will fall victim to a sophisticated attack and become the Achilles’ heel in an otherwise first-rate defense of their respective business.

Being aware of this, ESET has introduced a new Mobile Threat Defense module to its comprehensive business solution ESET PROTECT, with sweet pricing available for the Advanced tier and higher. Users of ESET PROTECT Advanced and higher can enjoy one free mobile device seat per one paid seat for other devices. 

To understand the scope of the problem, let’s review some key data from ESET telemetry. From the beginning of 2020 until the end of 2023, detections of Android malware rose by 222%. ESET Threat Reports provide further insight as to why this number has more than tripled in just four years.

In 2021, ESET telemetry detected a 428% annual increase in Android banking malware. The following year, the overall increase was driven by adware. And 2023 saw a significant increase in Android spyware cases.

If you are asking what it means for your business, check out the results of the surveys discussed below. 

A 2022 survey of working adults and IT security professionals from across the world revealed that half of the respondents used their employer-issued devices to check personal emails and messages. A further 45% used their work devices for reading news stories, while 32% shopped online.

Ironically, emails, online shops, and even news portals were the precise attack vectors described in several pieces of ESET research in 2023.

When it comes to employees using their own devices, 48% of organizations deploying a Bring Your Own Device (BYOD) policy witnessed malware being introduced through an employee’s personal phone, according to a Samsung 2023 survey.

If you wonder what’s behind these compromises, another 2022 survey found that the most common mistake contributing to cyber incidents is employees’ poor password hygiene and misuse of personal email.

Maybe those numbers are too general, so let’s see some real examples of how a malicious app installed on an employee’s smartphone can endanger the whole company.

Last year, ESET researchers published a blog about two campaigns targeting Android users that had been active since July 2020 and July 2022, respectively, and were distributed across several app stores and dedicated websites. 

The threat actors in question patched open-source Signal and Telegram apps for Android OS with malicious code that ESET researchers later identified as BadBazaar. These malicious apps went by the name Signal Plus Messenger and FlyGram, and their purpose was to exfiltrate user data, such as contacts, call logs, and the users’ list of Google accounts.

The Signal Plus Messenger app proved even more dangerous than FlyGram with its unique capability to spy on the victim’s communications in the legitimate Signal app, an app that is often praised for its reliability and that is trusted by high-value targets, such as journalists.

However, after installing Signal Plus Messenger, threat actors were able to connect the compromised device to the attacker’s (Signal equipped) device and read its messages. Such sensitive information could be used in further spear phishing attacks against business officials.

A similar case was covered in June 2023, when ESET researchers published research on Android GravityRAT spyware. This malware was distributed within the malicious but functional messaging apps BingeChat and Chatico — both based on the OMEMO Instant Messenger app. The spyware can exfiltrate call logs, contacts, SMS messages, the device location, basic device information, and files with specific extensions, such as jpg, PNG, txt, pdf, etc.

If your company has a BYOD policy, taking an interest in Android malware, the threat behind the 89% increase in ESET telemetry detections in the second half of 2023 is a must. This increase was primarily due to a mobile marketing software development kit (SDK) that ESET identifies as SpinOk Spyware.

This SDK was offered as a gaming platform and was incorporated into numerous legitimate Android applications, including many available on official app marketplaces. Once an app with the aforementioned SpinOK SDK is installed, it operates like spyware, connecting to a command-and-control server and extracting a range of data from the device, including potentially sensitive clipboard (short-term storage) contents.

Again, this attack can impact employees who might “Game” on their smartphones, gathering sensitive data that can later be used against their company.

So far, we have been describing spyware detected by ESET researchers during past year, but there are also other threats to business coming from mobile devices. 

• Other malicious apps – Not all malicious apps are spyware going after messages and files in a mobile device. Some of them, for example, try to lure victims into giving their bank account credentials or encrypt files in the victim’s device and ask for a ransom.
• Phishing – Some of the biggest data breaches in history started with one employee falling for a phishing message, giving credentials, and letting cybercriminals enter the company’s network. 
• Physical theft – Physical theft or loss of a corporate mobile device could be a serious cyber incident, especially if the smartphone or tablet contains sensitive information and is locked by a weak password. And such things happen often. In London alone, 90,864 phones were stolen in 2022. 
• Vulnerabilities – If you think that you are safe with using only standard cloud-based team communications platforms such as Microsoft Teams or Slack, think twice. Vulnerabilities and bugs that can lead to a data breach don’t spare even the biggest names on the market.
• Worms – Because laptops and smartphones use different operating systems, it is rare to see one malware that spreads and executes in different environments. However, there have been cases such as the Hamweq.A worm, which used smartphones as carriers to spread malware into Windows PCs via the USB cable.

Most employees probably don’t use their mobile devices for accounting, coding, or administrative duties, but previously mentioned real-life cases clearly show that they are valuable targets for cybercriminals nonetheless. This makes them a potential liability to a business’s cyberdefenses.

This is why having complex, multilayered protection of your mobile devices within a unified cybersecurity platform is so important. If you want to protect that Achilles’ heel and are interested in ESET solutions for companies and their mobile devices, click here. 

Guest speaker, Forrester Sr. analyst Tope Olufon explains how to stay resilient in Europe’s fluid threat landscape.

Cybersecurity is a complicated and constantly changing endeavor requiring robust security solutions and services such as cyber threat intelligence, automated incident response, and managed detection and response (MDR). But having all of these is not enough, according to Tope Olufon, senior analyst at Forrester, a leading global market research company.

At the ESET WORLD 2024 conference, Mr. Olufon also highlighted the importance of threat actor motives and the specific context in which cybersecurity solutions are deployed. He also kindly answered a few of ESET’s questions afterward.

Considering the fluid threat landscape together with cybersecurity context, it is not possible to say what the best product is or how, for example, a good threat intelligence report should look, according to Mr. Olufon.

“No matter, how you slice and dice a threat intelligence report, what matters the most in the end is what it means for you, how can you use this and how this is going to make you more secure tomorrow, next week, or next year,” Mr. Olufon said.

Currently, the two most commonly reported attack methods are software supply chain breaches and software vulnerabilities, as organizations hit by those attacks tend to have noisy and opaque system environments, according to Forrester. 

This means that companies still struggle to achieve good visibility of their IT assets and are flooded by numerous false positive detections.  “The visibility needed to define your organizational needs and to set a context for cybersecurity investments is missing,” Mr. Olufon said.

Here are biggest information/IT security challenges noticed by Forrester:

• Receiving too many false positive detection alerts
• Lack of comprehensive IT asset visibility
• Complexity of IT environment
• Inability to measure the effectiveness of a security program
• Receiving too many detection alerts

Besides these internal challenges, organizations need to also adapt to current external trends: Geopolitics are a lot more significant, since previously “insulated” sectors such as health care are now prime targets for threat actors, and the global skills gap means that things will get worse.

“It is an asymmetric playing field,” Mr. Olufon said, stressing that it doesn’t mean that those more vulnerable organizations are hopeless. “While there are, of course, some constraints, those organizations can start from somewhere. Organizations can start with creating an asset inventory, identifying what they have. The only way to eat an elephant is one fork at a time and that’s how you approach cybersecurity regardless of industry.”

Another thing that organizations need to consider is threat actors’ motivation. There are threat groups that go only for their targets’ money, but others want to stir political instability, or disrupt critical infrastructure.

To understand the current threat landscape and be prepared for upcoming threats, organizations should utilize cyber threat intelligence. However, many of them struggle to incorporate the compiled information into their security programs.

“In those organizations, the threat intelligence is something you pay for and show to the board at quarterly meetings. ‘We noticed 1000 samples of this attack,’ that doesn’t really mean anything,” Mr. Olufon said.

Therefore, threat intelligence needs to be contextualized and the right stakeholders need to be identified.

Despite cybersecurity companies investing a lot into prevention, organizations need to anticipate that something bad is going to happen. Therefore, incident response (IR) capabilities are a key part of cyber defenses.

Successful incident response means that a threat is mitigated quickly, and a targeted company doesn’t lose money or customers. But this is easier said than done. Currently, organizations face several challenges when utilizing proper IR:

• Risks grow exponentially, but resources do not. Talent and tooling need to constantly evolve.
• Data sovereignty requirements make data collection and storage a complex issue because local data residence requirements could make organizations’ capabilities constrained. 
• Evolving privacy requirements introduce new complexities to employee activity monitoring as privacy requirements in some countries make data collection difficult.
• Threat intelligence feeds are poorly integrated. Threat-hunting efforts are also rudimentary. 

And all this sheds light on the importance of MDR. Its essential component is Endpoint Detection and Response (EDR) which brings to the table the ability to respond to an incident both while it is still occurring and immediately after. Other important MDR components are threat-hunting capabilities.

“Human-driven threat hunting capabilities to be precise. Because what we have seen in the market is a lot of vendors saying that they have AI-driven threat hunting. But that is not sufficient, as AI is still just an enabler” Mr. Olufon said.

Finally, MDR should utilize automation because threat actors are very good at automation too, and MDR should help achieve a balance of powers.

But again, context is important. An MDR provider should also be able to bring contextual recommendations to improve an organization’s security posture. For example, by helping them to not only identify vulnerabilities but also smaller mistakes that lead to cracks in defenses.

All of this is good for today, but organizations need to look to the future and anticipate what is going to happen over the next months and years.

We can already see concepts like edge intelligence, TuringBots, or extended reality and organizations certainly don’t want to fall behind threat actors when they start to utilize these new technologies.

Let’s take cloud computing as an example: “A lot of companies still don’t have a cloud security strategy, but we have had cloud since 2006 and IT teams have been leveraging the cloud since then. Security teams started to take it seriously in 2016, ten years later, while still trying to treat the cloud as an emerging tech. It doesn’t really work that way,” Mr. Olufon said.

To sum up, the adversaries’ motivation and their capabilities are evolving, they are very good in automation and finding vulnerabilities in their targets’ systems. On the other hand, organizations often struggle with deploying automated cybersecurity solutions and don’t have a good visibility into their systems.

Especially, in case of more vulnerable organizations such as healthcare or charity organizations, all these challenges make cyber environment rather asymmetric. That is why organizations need to be smart about how they plan their defense strategies, how they adjust their budget, and how to make the most out of cybersecurity solutions they deployed.