While security companies have grown swiftly, they have invested much of their cash in technology to stay ahead of their competitors and ahead of hackers. Margins will remain tight as companies fight to gain business.
"It is going to be a race of these new companies," Courtot said of the emerging generation of security providers.
Research and data company IHS projected recently that enterprises will spend $175 million in cloud infrastructure and services this year. The company said it expects the number to grow to $235 billion in 2017.
The increase in cloud computing and use of mobile devices presents a conundrum for security. "Where does my network start and finish?" Courtot asked."I have apps on Amazon. I have a lot of endpoints. I have mobile devices. I have to do business with a lot of people," he said. "I have to exchange data between partners." (SYMC) Checkpoint Software Technologies or Fortinet (FTNT). Nonetheless, Courtot said Qualys could be a buyer. The first criterion for a target, he said, would be the quality of the management team and the ability to keep talent at the company after an acquisition. Second, the target would have to have a cloud architecture, rather than a legacy enterprise network security model. Courtot pointed to the winners and losers in social media to illustrate the importance of architecture. Friendster preceded Facebook (FB) but it developed an architecture that did not scale well. MySpace.com took over, but kept its architecture closed. Facebook opened its infrastructure to developers, and supplanted MySpace. The third criterion, Courtot said, is "of course you don't want to overpay."