The channel’s share of the cybersecurity market is rising as it becomes more complex, an analyst revealed as he warned threat actors are winning the AI arms race.
At an Omdia event on Friday, Omdia Chief Analyst Matthew said the channel’s 90% share of the wider $300bn cyber market is only growing – bucking a trend of decline in the wider technology sector.
“Across all of IT, the partner share is around 65%, and that’s been falling steadily over the last five years. It’s going to decline next year,” Ball said.
“Cybersecurity is actually moving the opposite way.
“The more complex security gets, the more customers pull in their partners to help. As we rethink risk and redesign cybersecurity, there’s going to be a lot of growth opportunities emerging for both vendors and partners.”
“The advantage sits with threat actors”
Ball linked the trend to AI, which he said has both enabled cyber attackers to improve their speed and precision, and widened the attack surface.
“Threat actors have taken the lead in this AI arms race we’re currently in,” he said.
“They’re using AI to move faster, hit more targets, and improve their return by being more precise.”
The fastest time from break-in to data being stolen has shrunk to 72 minutes, four times faster than what it was a year ago, Ball said.
AI-enabled attacks have expanded by 89% in the last year, and victims are now four-and-a-half times more likely to click on a phishing email that’s written by AI than by a human, he added.
The recent restrictions placed on Anthropic’s most-powerful models show defenders can’t assume they’ll have access to the latest AI tools to help them win the arms race, Ball said.
“Right now, the advantage really does sit with the threat actors,” he said.
AI is “redrawing the entire economics of every stage” of the cybersecurity lifecycle, Ball said.
With every AI deployment expanding the attack surface, the opportunity for partners to provide advisory services will increase, he counselled. AI also requires more accountability, sparking an opportunity around governance services such as VCISO, he added, although falling costs will see margins of detect and react services come under pressure, Ball added.
“Partners will become orchestrators of the digital workforce”
AI is changing how customers buy security, what gets bought, and where it gets bought, Ball said, meanwhile.
On the first of these shifts, Ball said customers were already moving from point cybersecurity products to platforms but that this will accelerate “because AI needs better telemetry”.
“Customers need to make faster decisions; they need greater context. Ultimately, they need platforms to help them deliver security in the AI era,” he said.
On the second point, Ball predicted cybersecurity sales via hyperscaler marketplaces will grow by a CAGR of 35% to hit nearly $10bn by 2030 as customers increasingly use them to “burn down” cloud spending commitments.
“However, marketplaces don’t really reward everyone equally. They favour partners that are big enough to transact on them, that can co-sell with the hyperscalers, and that can sit inside these large platform deals,” he said.
Turning to the third shift, Ball said customers are moving away from buying products, and instead buying outcomes.
“Partners that can really prove business outcomes can start pricing on value,” he said.
“The convergence of all those different areas really means the way partners create value to their customers is also going to change,” Ball continued.
“For years, we’ve seen partner value has often centred around selecting the vendors, helping them stitch them together, and then managing the complexity.
“But that business model is changing, and AI is starting to collapse it.
“Platforms are unifying the data layer. Agents are absorbing the work that traditionally partners have been doing. It’s all changing, and so really the value is moving.”
In the future model, partners will run a workforce of agents, each with different specialities, Ball predicted.
“Partners ultimately become the orchestrators of that digital workforce,” he explained.
In this new world, partners have “three distinct paths”, Ball said, namely reselling managed agent security services, creating their own IP on top of vendors’ platforms, or owning the entire end-to-end process themselves.
The EMEA cybersecurity market is forecast to grow by 12% to just under $100bn in 2026, with technology generating a third of that and services two-thirds.
“Every $1 of technology that’s being generated by partners generates more than $2 of services, and nearly all that today is delivered by partners,” Ball concluded.
