Cyber-security services will account for almost 20% of operators’ incremental revenue from SMEs

Operator revenue from connectivity services for small and medium-sized enterprises (SMEs) is expected to be mostly flat between 2023 and 2028. However, there will be some growth, and almost 20% of this incremental revenue will come from cyber security.

Analysys Mason’s Selling cyber-security services to SMEs: effective strategies for telecoms operators outlines some effective strategies that operators can take to differentiate themselves from other security providers and maximise the revenue that they generate when selling cyber-security services to SMEs. Selling fixed broadband add-ons focused on endpoint detection and response (EDR) and offering a more comprehensive security portfolio are some of the strategies with the most potential for success.

Cyber security will generate almost 20% of operators’ incremental revenue from SMEs between 2023 and 2028

Connectivity revenue from SMEs will remain mostly flat between 2023 and 2028 at roughly USD170 billion, though it will still account for 80% of operators’ total revenue from SMEs in 2028. Selling IT services will continue to be operators’ best prospect for revenue growth. We estimate that cyber-security services will account for almost 20% (USD3.3 billion) of operators’ incremental revenue from SMEs worldwide (Figure 1). Other IT services such as public cloud services (SaaS and IaaS/PaaS) will also contribute significantly.

Figure 1: Breakdown of operators’ incremental revenue generated from SMEs by service type, worldwide, 2023–2028

Cyber security will make up over 20% of a typical operator’s IT service revenue from SMEs; the remainder will mostly come from cloud (SaaS and IaaS/PaaS), co-location and hosting and unified communications (UC) services.

The total addressable market (TAM) for SME cyber security will reach USD52 billion by 2028 and operators will hold an estimated market share of 18% (USD9 billion). Operators will also hold significant shares of the co-location and hosting and UC markets. They will have only a small share of the cloud market, but the TAM for SME cloud services is much larger than that for other IT services, so operators will still generate significant revenue in this area.

Operators are able to play a larger role in the competitive cyber-security market than in other IT services markets for a number of reasons. Areas such as network security and mobile security are much closer to operators’ core connectivity competencies than cloud services are, which gives operators a strong foothold in the security market. Many IT services are easily bundled with fixed and mobile connectivity packages, but security services and mobile security/device management are the services that SMEs would most commonly consider taking from their telecoms provider.

Selling security add-ons to broadband packages is the logical next step to generate further revenue from SME cyber-security services

The ability to bundle security services with connectivity is one of operators’ main differentiators when selling to SMEs. The results of our survey indicate that almost 80% of SMEs would consider purchasing at least one IT service from their main telecoms provider. Furthermore, fixed security and mobile security/device management services were the second- and third-most commonly purchased IT services from SMEs’ telecoms providers.

Many operators offer basic cyber-security solutions bundled with fixed connectivity, but not all allow for significant revenue generation. Incumbent operators in Europe often bundle basic cyber-security services at no extra cost with their basic SME broadband packages. Doing so offers clear benefits by in terms of differentiation from lower-cost providers and acts as a starting point to upsell more-advanced security services. Telefónica has a slightly different approach; it only bundles security services with premium broadband packages. However, the potential for incremental revenue generation is still more limited than when selling standalone cyber-security services as an optional add-on to broadband packages.

We have identified two packages from operators that could be used by other operators as blueprints for generating significant incremental revenue from cyber-security services: Orange’s ‘Cyber Protection’ and Deutsche Telekom’s ‘Magenta Security Shield Smart’.¹ Both offer managed EDR as their primary feature, which is one of the most demanded security features for SMEs. Orange and Deutsche Telekom primarily sell these services as straightforward add-ons to their broadband packages at relatively low prices (EUR6–10 per month), which enables strong take-up with low sales costs.

Many operators also offer bundles of basic cyber-security solutions and mobile connectivity. However, many of these bundles are simply a way of reselling vendors’ anti-virus licences (or similar). Some operators offer more-comprehensive packages from vendors that can enable more-meaningful revenue generation, but there is still little in the way of additional value-added services or differentiation.

Offering managed support can be a key differentiator when selling cyber-security services to SMEs

Reselling a vendors’ solution with no additional value-added aspect can make it difficult for operators to differentiate themselves from other providers. Including manged support is an approach taken by some operators to differentiate their more-advanced SME mobile security packages. Our report highlights three packages that offer some level of managed support for mobile security services: Verizon’s ‘Business Mobile Secure’, TIM’s ‘Mobile Threat Defence’ and Orange’s ‘Mobile Micro-SOC’.¹ Many operators also sell fixed security solutions with managed support.

Operators should offer at least some of the managed services that they have developed for the large enterprise market to SMEs. For example, Telefónica has expanded its digital and security operations centres (DoCs and SoCs) to include SME cyber-security solutions, and Orange is using analysts from its enterprise security division, Orange Cyberdefense, to monitor its Cyber Protection service for SMEs. This will help operators to bolster their offerings in the SME segment, where manged support is increasingly in demand, and differentiate from smaller providers who do not have as much expertise in the enterprise security market to make use of.

¹ For more information, see Analysys Mason’s Approaches to cyber security for SMEs: ten operator case studies.