Low Price as a Differentiator for Cybersecurity Products

Low price can be a cybersecurity product differentiator in several ways: strengthening an ecosystem (Microsoft's free Windows Defender), as loss leaders bundled with other products, as freemium foot-in-the-door strategies, or providing "good enough" security for customers who wouldn't pay for stronger protection.

General wisdom holds that it’s hard for businesses to compete on price. If competitors repeatedly undercut each other’s prices, they will drastically erode each other’s profit margins. To what extent do these dynamics hold for cybersecurity products?

Consider well-established security product categories, such as anti-virus, network firewalls, log management and intrusion detection. The vendors prefer to make their products stand out by developing unique features; however, when the products are mature, the new features are rarely groundbreaking and can often be replicated by competitors. When products are perceived as being interchangeable, the buyer holds more negotiating power than the seller, and the vendors end up competing on price.

When Security Strengthens a Product Ecosystem

One way to stand out in a mature, crowded market is with price. Microsoft did this by offering Security Essentials for free, then building its successor Windows Defender directly into the operating system. The strategy worked: Defender now consistently performs well in independent tests, and most Windows users rely on it as their primary protection. Microsoft didn’t worry about commoditizing consumer endpoint security products, because this wasn’t where Microsoft wanted to make money.

Enterprise software companies sometimes bundle security products for free or very cheaply as part of a large deal. It’s common for platform vendors to include Security Information and Event Management (SIEM) capabilities as part of broader enterprise agreements, treating them as table stakes rather than standalone revenue generators.

In these examples, commodity security products are treated as loss leaders, and are positioned as a baseline component for other products or services.

When Low Price is a “Foot in the Door”

Vendors can offer a product inexpensively to bring attention to other, more profitable offerings. For instance, VirusTotal offers free malware scanning, driving awareness of its premium threat intelligence platform, and Cloudflare provides a generous free tier that includes DDoS protection and a web application firewall. These free offerings provide real value while exposing users to the brand and its paid capabilities.

Security products are sometimes offered on a freemium basis, whereby the vendor provides a lightweight version of the product to capture the initial attention of the customer, with the hope of up-selling the more expensive product.

In these cases, the free security products act as advertisement and a way to get a “foot in the door” of the enterprise or consumer.

When Low Price Can Be a Competitive Advantage

Companies can price their products low, when compared to competition, to capture a major part of the market. In this case, the strategy usually entails eventually increasing the price or turning to the freemium model described above.

Sometimes, companies find a way to change the industry by providing long-term pricing that is drastically cheaper than their competition, and finding a way to keep costs low to turn this into a sustainable competitive advantage. This is similar to what Google has done for the email market when it released Gmail a feature-rich webmail product that offered practically unlimited storage.

This pattern has become more common in cybersecurity, particularly for compliance-oriented products like PCI tools for small retailers, where dramatically lower pricing opens the market to organizations that would otherwise go without. One way to look at these products is to nitpick at the ways in which their security is weaker than the competition’s. The goal, though, is to make security affordable where the alternative is no security at all.

Inexpensive Security That’s Good Enough

Not everyone needs the same rigor security controls. As the result, there’s room for inexpensive security products that are good enough. These products aren’t for everyone, but they are perfect for customers that wouldn’t justify paying more for stronger security. In cases like this, price can be a competitive advantage.

Pricing a security product is a complex issue, and surely this post glossed over some factors, considerations and examples. For more on how security products can stand out, see my post Ease of Use as a Competitive Advantage for Security Products.