I have a basic question about the channel in cybersecurity. I come from primarily infrastructure software where the channel isn't as strong, and in other parts of application software, it's similar. There are partners, but the distributor and reseller relationships in security are somewhat unique. Why does two-step distribution exist in the cybersecurity world? Why are there both a distributor and a channel partner, and what value do they bring to the ecosystem?

The size of the channel partner determines this. If the channel partner grows so large that they can't handle the demand, they usually bring in a distributor to manage the day-to-day activities within the partner and drive growth within the reseller and end-user community. You'll see many small end vendors that don't have a distributor, but once they reach a certain size, a distributor is brought in. The distributor adds value to the deal in terms of payment solutions, logistics, stockholding, and monitoring cash flow. They handle exchange rates, selling from GBP, USD, Euro, etc. They essentially act as a middleman. However, given the demand and the amount of activity from the resellers for the vendor, having a distributor is necessary.

For pure software solutions coming from vendors like Fortinet or CrowdStrike that don't involve much hardware, do they still go through the same two-step distribution process?

Yes, exactly. Mainly for the software side, where logistics aren't needed, it's mostly about the payment solution. Everything related to Fortinet is channel-based, so they won't sell directly to the end user. They ensure to include the distributor and the reseller in all activities. This is mainly to keep everything aligned, ensure the partner program isn't violated, and offer the value we can bring to the end user and reseller community.

Going back to the channel partner, is it more common for them to be exclusive to a certain product or vendor, or do they typically deliver a complete solution across cybersecurity, when dealing with the end customer?

It depends on what they're offering as a service. Initially, a channel partner wanted many vendors on their portfolio to meet various requirements. However, in the last five years, vendors have become more innovative and create more of a solution for the customer. For instance, SD-WAN through Fortinet. Fortinet is the only provider for SD-WAN that's integrated within the firewall. Then they'll look at the Fortinet Fabric, which includes switches, access points, and endpoint protection. Before you know it, you've got a full-blown solution for the end customer without needing any more vendors involved. This makes it easier for the channel partner to communicate effectively with the end user and manage the solution, providing a single-pane-of-glass view over what they're providing. It's better to manage a platform of one or two vendors rather than three or four.