Security, it goes without saying, is a hot topic, within the IT world generally and among members of the managed services vendor community specifically.
Indeed, Continuum made a big, very public bet on security years ago. ConnectWise followed suit last November. Kaseya’s recent acquisitions of RapidFire Tools and more recently ID Agent signal a similar bullishness on the security market.
Datto, by contrast, is taking a far more cautious approach. “I still think we have some time to figure out what the right strategy is before we really jump in feet first,” says Rob Rae, the company’s vice president of business development. Rae spoke with ChannelPro at its 2019 DattoCon event, which concluded yesterday in San Diego.
Though companies worldwide will spend $103.1 billion on security-related software, hardware, and services this year, and over $21 billion specifically on managed security, according to IDC, Rae believes it’s too soon for vendors like Datto to be pushing their partners into becoming cybersecurity service providers.
“We’re too early,” he says. “There’s need. There’s absolutely no doubt in my mind there is need today. I think that from a pricing perspective, there’s not enough pain in the SMB space that we’re going to find enough of those end users that are willing to pay for security.”
Or at least an advanced security bundle sold over and above what end users are already buying, says Datto CEO Tim Weller. The average SMB decision-maker thinks they’re getting security now, he notes. “Going back to them and saying, ‘it’s an extra $20 a month per seat’ is sometimes challenging.”
Not that Datto has nothing underway in security. At DattoCon this week, in fact, it announced an agreement with Vade Secure to sell that company’s email security software, which currently protects 600 million mailboxes around the globe, to users of its SaaS Protection cloud-to-cloud backup product for an incremental $2 per seat per month. Additional moves along similar lines are likely to define Datto’s security strategy in the near term.
“You can see sort of like our initial attempts or initial thoughts there,” says Chief Product Officer Emily Glass of the Vade alliance. “A more concerted effort is something that we’re talking about internally.”
Rae hints at the kind of opportunities the company is looking for as that talking proceeds.
“Think about what Datto’s traditionally been good at,” he says. “We find technologies that are maybe underserved, undervalued. We find technologies that are in the enterprise space and not in the SMB space, where they’re designed for enterprise, but don’t have an SMB price point or SMB-type strategy. Products that don’t have … channel programs that we can bring to the MSP community. I think that’s where our opportunity’s going to be.”
In the meantime, partners aren’t pressuring Datto to articulate a security strategy, Rae continues. “They’re coming to us more along the lines of what are you guys doing from a security perspective within what I already have?”
The answer is quite a bit. Just like its competitor ConnectWise, in fact, Datto is serious about keeping its existing products as secure as possible. “I think there’s a lot to do right there before we start throwing little point solutions out at MSPs,” says Weller. “We’re very focused and have a very large team focused on our own security.”
Spearheading that effort is Ryan Weeks, Datto’s chief information security officer. “I have secure software developers that are embedded inside the dev orgs to make sure that as things are getting built, they’re getting built securely,” he says, adding that he also has a dedicated person on his team for each product Datto makes offering advice on minimizing risk. He also has his very own team of white-hat hackers on staff.
“We pen test our own stuff,” Weeks says. “We seek out vulnerabilities. We work with developers to remediate them in advance of things getting released.”
Weeks plans to embed security expertise even more deeply in Datto’s product organization soon. “We’re actively hiring for a product security manager role, which is going to be basically a layer that lives within the product group and has dual reporting between product and security,” he says. “We need someone that both speaks security and speaks product, and can constantly be having that conversation and be helping each individual product owner.”
Collectively, efforts like those are already bearing fruit. Last year, Datto’s core BDR solution achieved SOC 2 Type 1 certification. It wasn’t easy either, according to Weeks, and required buy-in from all 1,600 employees on the company’s payroll.
“I think that’s something that shows a commitment to security that we didn’t necessarily advertise but is a huge win for the partners, because now they have independently verified assurance that Datto is doing the right things to keep their data safe,” he says.
