Cisco's MARS invasion!

Little green men? Roswell, N.M.? Nope. This invasion is centered on Cisco Monitoring Analysis and Response System (MARS). Cisco MARS (formerly Protego) is a hybrid event management and network behavior analysis product that monitors network/security devices and network traffic, looking for anomalous activities and ongoing security events.

Cisco is one of dozens of vendors who play in this networking/security management nexus. The competitors are not slouches; the list includes a few recognizable companies such as EMC, IBM and Symantec. Even the "start-ups" in this space are pretty mature. ArcSight, Arbor Networks, Mazu Networks and SourceFire have been around for years, raised tons of dough, and established themselves with enterprise and service provider customers.

This begs the question: Why is Cisco MARS so prevalent? There are three main reasons:

1. Cisco continues to give away the razors to sell the blades. In this case, MARS is a razor, while switches, routers, security devices, IP-telephony or anything else Cisco sales reps have in their product catalogs are the blades. The strategy is simple. Get MARS out in as many accounts as you can. It's hard to buy a competing widget when Cisco will give you one for free.

2. Security remains a networking domain. Say what you will about recent security imperatives around encryption, data leakage protection or identity management, most security folks come from a networking background. In spite of IBM's data center presence, Microsoft's desktop dominance and Juniper's routing excellence, no one can shmooze the enterprise networking crowd like Cisco.

3. Cisco's phat sales and marketing resources give it an unfair advantage. OK, IBM and EMC are strong here too, but Cisco has done a great job of using its account relationships, field-level expertise and marketing communications skills to get its product in the door. In a confusing market space like security management, Cisco has the right people, money and message.

Many competitors dismiss Cisco saying that MARS is an inferior product. Hmm, sounds a lot like what Digital Research said about DR-DOS when Microsoft won the IBM PC business. I can't recall the last time I even thought about Digital Research, can you?

Right now, security management is extremely hot, so everyone is winning their share of business, but all the vendors in this space say that they see Cisco MARS everywhere. As things get a bit tighter, this may put Cisco in the security management catbird's seat.