Highly sought security talent flowed to the boutiquecompanies for two reasons. First, top IT securityexperts---often from the military and government agenciessuch as the CIA---left public service in droves a few yearsago to start their own companies. Subsequently, venturecapitalists heard tales of Pentagon-level security, so therewas plenty of money out there, until recently. Second, therewas fraternal loyalty; security experts gravitate tocompanies run by their peers.

But the startup trend led to a glut. There were too manyboutiques, and they were burning cash fast. That, in turn,led to aggressive selling, such as Pilot´s offering discountsfor a year´s service for customers that paid upfront. Customers took the deals, which in turn prompted thesecurity vendors to scale up too fast. All of this isprecedented; the ASP market did the same thing two years agoand has stalled ever since.

If small security-only companies can´t escape the economicsof their smallness, the larger general purpose IT servicecompanies can´t get out from under the weight of theirhugeness. Brown evaluated several larger companies and cameaway unimpressed.

"My experience is the bigger companies don´t have theexpertise or the service," he says. "We looked at two ofthem, and it was a circus. They couldn´t even get coordinatedinternally. They hadn´t gotten our business, and they werealready infighting as to who would handle our account."

So for Durso, it becomes a balancing act. She´d like to staywith a security-only company because of the expertise andservice. At the same time, she feels as if she has to slideup the scale to find a stable business. "Really we´re lookingfor a company like Pilot in terms of service," Dursosays. "But you find yourself opting to be more conservative.