Jon Oltsik

Senior Principal Analyst

  • Blogs
    Apr 24, 2015

    Making Sense of Raytheon and Websense

    I was just getting on my flight to the RSA Security Conference in San Francisco on Monday morning when I received an e-mail announcing an intriguing cybersecurity deal.Defense contractor Raytheon announced its acquisition of security veteran Websense for approximately $1.6 billion. Vista Equity Partners, Websense’s previous owner, also contributed $335 million and will retain some skin in the game.

  • Blogs
    Apr 22, 2015

    Somber Message at the 2015 RSA Conference

    As the 2015 RSA Conference got underway this week, I attended a dinner hosted by Pacific Crest Securities. Our host began the dinner by asking former cyber czar Richard Clarke to say a few words. Now this was a rather festive dinner as the cybersecurity industry is in the midst of a robust boom. Nevertheless, Clarke’s brief talk was a reminder of where we’ve been and the state of cybersecurity today.

  • Blogs
    Apr 17, 2015

    Undercurrent RSA Conference Theme: Security Technology Integration

    Just a few days until the start of the RSA Conference and I expect an even bigger event than last year – more presentations, vendors, cocktail parties, etc. The conference will likely focus on security technologies like endpoint security, cloud, security, threat intelligence, IAM, and others which I described in a recent blog.

  • News
    Apr 14, 2015

    IT fragmentation leavng business vulnerable to hackers -CBR

  • esg video capsules
    Apr 13, 2015

    ESG Video Capsule: The Endpoint Security Paradox

    In this ESG Video Capsule, ESG Senior Principal Analyst Jon Oltsik discusses ESG's recent research on endpoint security.

  • Blogs
    Apr 13, 2015

    Threat Intelligence Sharing Momentum and Needs

    Threat intelligence sharing is certainly riding a wave of momentum as we head into the RSA Conference next week. Over the past 6 months, we’ve seen things like lots of federal activity, further adoption of threat intelligence standards, and industry actions.

  • Blogs
    Apr 7, 2015

    Anticipating RSA 2015

    The annual security geek-fest known as the RSA Security Conference is just 2 weeks away. Alas, I remember when it was a cozy event that attracted a few thousand visitors and focused on esoteric security technologies like cryptography, deep packet inspection, and malware detection heuristics.

    As for 2015, I expect at least 25,000 attendees spanning keynote presentations, show floors, pervasive hospitality suites and a constant barrage of hokey themed cocktail parties.

  • Blogs
    Apr 2, 2015

    Could Software-defined Networking (SDN) Revolutionize Network Security?

    Network security grows more and more difficult all the time. According to recent ESG research on network security, 79% of security professionals working at enterprise organizations (i.e., more than 1,000 employees) believe that network security is more difficult than it was two years ago. Why? Threats are getting more targeted, voluminous, and sophisticated while networks grow more complex with the addition of more users, devices, traffic, etc.

  • News
    Apr 1, 2015

    Taming the third-party threat: Application security - SC Magazine

  • Blogs
    Mar 31, 2015

    The Proportional Cybersecurity Law (aka Oltsik’s law)

    The combination of IT complexity, the growing attack surface, and a progressively more dangerous threat landscape is making cybersecurity more difficult. And it’s not one particular area of cybersecurity that’s becoming more difficult, it’s the whole kit and caboodle.

  • News
    Mar 30, 2015

    Advice to CSOs: Have a sense of humour - IT World Canada

  • Blogs
    Mar 26, 2015

    In Cybersecurity, the Network Doesn’t Lie

    In a recent ESG Research Report, enterprise security professionals were asked to identify the primary objectives associated with their organization’s network security strategy. It turns out that 40% of organizations plan to move toward continuous monitoring of all assets on the network while 30% of organizations plan to capture more network traffic for security analytics.

  • Blogs
    Mar 23, 2015

    Massive Enterprise Endpoint Security Opportunity

    In the past, large organizations spent most if not all of their endpoint security dollars on a single product—antivirus software. This decision created a multi-billion dollar market dominated by 5 vendors: Kaspersky Lab, McAfee (Intel Security), Sophos, Symantec, and Trend Micro.

  • briefs
    Mar 19, 2015

    2015: Year of the Information Security Tipping Point?

    A majority of organizations plan to increase information security spending this year—especially in industries such as retail, transportation/logistics, manufacturing, and communications & media. These budget increases make sense as business and IT executives come to terms with the dangerous threat landscape and persistent wave of highly-publicized data breaches. Rather than a minor spending correction, ESG believes that these changes will last several years as organizations modernize their security defenses, improve infosec oversight and analytics, and adopt internal security controls and processes to accommodate cloud and mobile computing.  

  • Blogs
    Mar 19, 2015

    The Increasing Cybersecurity Attack Surface

    I just read a good Wall Street Journal blog by Ben DiPietro titled, Speed of Tech Change a Threat to Cybersecurity. His main point is that while organizations are adopting new technologies like cloud computing, mobile computing, and applications based upon the Internet of Things (IoT), they continue to address cybersecurity risks, controls, and oversight with legacy tools and processes. This creates a mismatch where cyber-adversaries have a distinct offensive advantage over a potpourri of assorted legacy enterprise security defenses.

More Results:



Jon Oltsik is an ESG senior principal analyst and the founder of the firm’s cybersecurity service. With almost 30 years of technology industry experience, Jon is widely recognized as an expert in all aspects of cybersecurity and is often called upon to help customers understand a CISO's perspective and strategies. 

Full Biography