Report:
The Forrester Wave™: Cybersecurity Consulting Services In Asia Pacific, Q4 2023
How does Forrester define the Cybersecurity Consulting Services In Asia Pacific market in 2023?
In 2023, APAC CISOs face a collision of challenges including talent crunches (23.6% increase in cybersecurity workforce gap), evolving threats, emerging technologies like generative AI, and regulatory sprawl. One-third of the 55 most notable breaches in 2022 were from APAC, prompting regulatory responses across Australia, India, Singapore, and Japan. APAC CISOs now require consulting providers that obsess with customers first, attract and retain the right talent mix, and think proactively and strategically without sacrificing technology and tactics. The evaluation assessed 10 providers across 31 criteria, categorizing them as Leaders (Accenture, EY, PwC), Strong Performers (KPMG, TCS, Wipro), Contenders (Deloitte, Trustwave, IBM), and Challengers (Tech Mahindra).
Key Facts for The Forrester Wave™: Cybersecurity Consulting Services In Asia Pacific, Q4 2023 in 2023
- Publication Date: 14-Dec-2023
- Document ID: RES178471
- Summary: In our 31-criterion evaluation of cybersecurity consulting service providers in Asia Pacific (APAC), we identified the most significant ones and researched, analyzed, and scored them. This report shows how each provider measures up and helps security and risk (S&R) leaders select the right one for their needs.
- Authors: Jinan Budge, Joseph Blankenship, Min Say, Bill Nagel
How did the Cybersecurity Consulting Services In Asia Pacific market evolve in 2023?
- One-third of the 55 most notable breaches in 2022 were from APAC
- APAC faces a 23.6% increase in the cybersecurity workforce gap
- Australian regulators amended privacy legislation and strengthened industry-focused regulations in 2023
- India's parliament passed the Digital Personal Data Protection bill
- Singapore amended its Personal Data Protection Act
- Japan strengthened its Act on the Protection of Personal Information
- Generative AI (genAI) emerged as a new challenge for APAC CISOs
- Talent crunches, evolving threats, emerging tech, and regulatory sprawl have complicated the APAC security environment
What product features are required to be included in this year's evaluation?
- Revenue of at least $30 million in APAC for cybersecurity consulting services
- Broad footprint of cybersecurity consulting customers and revenue across several APAC countries, deriving no more than 85% of APAC revenue in any one subregion (Australia and New Zealand; Greater China; India and South Asia; Japan; Southeast Asia; and South Korea)
- Generates at least 10% of global cybersecurity consulting revenue in APAC
- At least 70 active enterprise clients (firms with 1,000 or more employees) in APAC
- Complete suite of cybersecurity consulting services covering minimum of three core business scenarios and one extended business scenario as shown in The Cybersecurity Consulting Services Landscape In Asia Pacific, Q3 2023 report
- Significant interest from Forrester clients in the form of inquiries, advisories, interactions at events, and other conversations
What are the common features of top products in the Cybersecurity Consulting Services In Asia Pacific space?
No common features specified.
Scope Exclusions
- Vendors with less than $30 million APAC revenue in cybersecurity consulting
- Vendors deriving more than 85% of APAC revenue from a single subregion
- Vendors generating less than 10% of global cybersecurity consulting revenue from APAC
- Vendors with fewer than 70 active enterprise clients in APAC
- Vendors not offering comprehensive cybersecurity consulting portfolio (minimum three core and one extended business scenario)
- Vendors without significant Forrester client mindshare
- Managed security services providers (not consulting-focused)
- Technology vendors without substantial consulting practices
Inclusion Criteria
Vendors must, among other requirements:
- Revenue of at least $30 million in APAC for cybersecurity consulting services
- Broad service coverage across APAC with no more than 85% of revenue from any single subregion
- APAC generates at least 10% of global cybersecurity consulting revenue
- At least 70 active enterprise clients (1,000+ employees) in APAC
- Comprehensive cybersecurity consultancy portfolio covering minimum three core business scenarios and one extended business scenario
- Significant mindshare from Forrester clients through inquiries, advisories, and events
Offering Strengths — Relative Weighting
- Alignment with client CISO needs — 5%
- Customer retention and satisfaction — 5%
- Customer partnership and collaboration — 5%
- Customer centricity — 5%
- Engagement personnel and team allocation — 5%
- Localization of services — 5%
- Engagement delivery — 3%
- Cybersecurity training and literacy for clients — 3%
- Helping clients with emerging technology — 5%
- Use of emerging technology in client delivery — 5%
- Knowledge transfer to client teams — 3%
- Cybersecurity industry contribution — 3%
- Cybersecurity strategy and vision — 15%
- Governance, risk, and compliance — 5%
- Technology stack consolidation — 5%
- Threat and incident response — 5%
- Technical security assessment — 5%
- Security and risk culture — 5%
- Extended services — 10%
Strategy Strength — Relative Weighting
- Vision — 30%
- Innovation — 15%
- Talent strategy — 20%
- Partner ecosystem — 15%
- Community — 10%
- Pricing flexibility and transparency — 10%
FAQs
Q: What does this research cover?
A: This research covers a 31-criterion evaluation of the 10 most significant cybersecurity consulting service providers operating in Asia Pacific. It evaluates providers across three main categories: Current Offering (50%), Strategy (50%), and Market Presence (0%). The evaluation focuses on how well providers align with APAC CISO needs, customer centricity, localization of services, vision, innovation, talent strategy, and partner ecosystems.
Q: Who should use this research?
A: This research should be used by security and risk (S&R) leaders and CISOs in Asia Pacific who are selecting cybersecurity consulting providers. It helps them understand which providers best match their specific needs based on factors like customer obsession, talent quality, strategic thinking capabilities, and ability to address challenges like regulatory compliance, generative AI risks, talent gaps, and Zero Trust implementation.
Q: What are the mandatory features of vendors included in this market?
A: To be included in this Forrester Wave evaluation, cybersecurity consulting providers must meet all of the following criteria: generate at least $30 million in APAC cybersecurity consulting revenue; maintain broad service coverage across multiple APAC countries with no single subregion representing more than 85% of revenue; derive at least 10% of global cybersecurity consulting revenue from APAC; serve at least 70 active enterprise clients (1,000+ employees) in the region; offer a comprehensive suite of cybersecurity consulting services covering a minimum of three core business scenarios and one extended business scenario; and demonstrate significant mindshare among Forrester clients through inquiries, advisories, and event interactions.
Q: What are some reasons for not being included in this report?
A:
- Insufficient APAC revenue (less than $30 million in cybersecurity consulting)
- Geographic concentration exceeding 85% in any single APAC subregion
- APAC represents less than 10% of global cybersecurity consulting revenue
- Fewer than 70 active enterprise clients in APAC
- Incomplete cybersecurity consulting portfolio (not covering minimum three core and one extended business scenarios)
- Lack of significant Forrester client mindshare and engagement
- Primary focus on managed services rather than consulting
- Technology product vendor without substantial consulting capability
Q: What should buyers consider when evaluating products in this market?
A:
- Prioritize providers that obsess with customers first and business later, putting client needs above commercial gain
- Seek providers with in-depth understanding of your specific business, geography, and industry
- Evaluate providers on their ability to balance junior staff for cost efficiency with senior expertise where needed
- Look for providers with gender parity on leadership teams and strong diversity, equity, and inclusion outcomes, not just programs
- Assess providers' ability to deliver strategic vision while maintaining technical depth and tactical competence
- Consider providers' customer retention rates and satisfaction measurement processes
- Evaluate providers' approach to emerging technologies, particularly generative AI risks and opportunities
- Review providers' talent retention strategies and attrition rates
- Assess partnership ecosystems and how partnerships translate to client value
- Verify provider stability and reputation through reference customers, particularly regarding 'A team sells, C team delivers' risk
- Consider providers' investment in R&D and innovation specific to APAC market needs
- Evaluate localization capabilities and understanding of regional regulatory requirements
Q: How has the Cybersecurity Consulting Services In Asia Pacific market evolved in 2023?
A:
- One-third of the 55 most notable breaches in 2022 were from APAC, ending the region's relative immunity to headline-making incidents
- Regulatory sprawl across APAC with Australia amending privacy legislation, India passing Digital Personal Data Protection bill, Singapore amending Personal Data Protection Act, and Japan strengthening its Act on the Protection of Personal Information
- Emergence of generative AI creating new security challenges and opportunities
- 23.6% increase in cybersecurity workforce gap creating significant resource constraints
- Growing expectation for consulting providers to address interlinked challenges of talent, threats, technology, and regulation
- Shift from PowerPoint strategies and maturity assessments to actionable, tactical consulting that translates technical matters into business insights
- Movement toward Zero Trust and modern security architectures
- Increased focus on faster, more consequential attack scenarios introduced by generative AI
- Need for AI model defense capabilities
Q: What differentiates Strength of Offering vs. Strength of Strategy?
A: Current Offering (50% weighting) evaluates vendor capabilities in delivering cybersecurity consulting services today, focusing on customer centricity, engagement quality, service localization, strategic consulting capabilities, and breadth of services. It measures how well vendors meet current CISO needs across tactical, operational, and strategic dimensions. Strategy (50% weighting) assesses vendor forward-thinking capabilities including vision for the future of cybersecurity, innovation in IP and methodologies, talent development programs, partnership ecosystems, community contribution, and pricing approaches. It measures how well positioned vendors are for future market demands and their ability to lead clients into emerging security paradigms.
Reference
- Forrester, The Forrester Wave™: Cybersecurity Consulting Services In Asia Pacific, Q4 2023, 14-Dec-2023, ID RES178471
View Leaders
View Vendor Movements
