The Dynamics of the Largest Cybersecurity Industrial Clusters: San Francisco Bay Area, Washington D.C. And Israel

Abstract

This report offers a multi-disciplinary perspective on the cybersecurity industry. Conceptualizing cybersecurity industry clusters as ecosystems, we focus on three distinct mega-clusters: the San Francisco Bay Area, metropolitan Washington, D.C., and Israel. Benefits of clustering include: access to a pool of specialized labor, knowledge spillover, access to capital, and inter-organizational linkages. Research suggests that clusters’ economics should be linked to their social dimensions and the configuration of the built environment. In addition, based on the empirical analysis, we suggest using a nuanced taxonomy of cybersecurity clusters using a spectrum of intensities: mega-, mesa- and micro-clusters, sub-clusters, and hot zones. The Big3 clusters were catalyzed during the 1990s cybersecurity genesis – even before cybersecurity was recognizable as a distinct sub-industry within high-tech – and certainly well before the term “cybersecurity” was coined. All three cybersecurity clusters emerged as specialized clusters embedded within a larger high-tech ecosystem. At the same time, government was a key actor in facilitating the high-tech and defense ecosystems in each of these three regions. Cluster concentration remains high: the Big3 mega-clusters, hegemonic since their founding, together serve as headquarters for 53% of the largest and most influential global cybersecurity firms. Cybersecurity industry dynamics. The industry can be viewed as a manifestation of two far-reaching relationship interplays: industry clustering processes and place (meaning, the industry’s socio-spatial context). Regarding the first: there is some evidence of rapid industry consolidation — especially within the Big3 clusters (393 firms merged or acquired through 2018). However, the industry still remains quite fragmented because of the continued entry of new players and the breakup of some giant firms (e.g., Symantec). The second interplay is between place and social context, human capital, and institutions. Via comprehensive mapping, we show that cybersecurity clusters are situated in large, diverse urban regions, within complex, multi-modal transportation networks, with proximate universities, and layered on household income sectors.Lessons for smaller clusters globally. Cybersecurity clusters (and sub-clusters) grow where one of two conditions exists: an anchor organization (such as the National Security Agency outside Washington) and/or where there is already a strong high-tech culture (as in Silicon Valley). Nurturing a new cybersecurity cluster is a long-term strategy, one that requires many years of patience (as in the Be’er Sheva sub-cluster in Israel). Local governments have been nurturing cybersecurity clusters specifically for about a decade with tax benefits, partnerships, and advocacy programs. However, these policies do not take place in a vacuum; rather, they are part of the ongoing competition between regions and cities. Thus, purposeful cluster growth requires more than a bundle of policies; it needs a cohesive strategic plan that structures a set of policies for nurturing the industrial ecosystem. Only with a holistic vision, which considers the social, economic and spatial context, can a cybersecurity cluster evolve and grow. Finally, we identify three cybersecurity industry/cluster challenges for the future. First is the persistent cybersecurity workforce shortage—apparent in both countries covered in this report. The second challenge is the resiliency of these high-tech clusters as the hegemony of global cities is expected to diminish post-COVID-19, with the workforce migrating out of expensive and unhealthy urban areas. The third challenge is the durability of the cybersecurity industry itself. Are there too many cybersecurity firms? Will a new generation of technologies reconfigure these firms? In sum, cyber industry cannot be understood in isolation, but only as part of a larger context. Although this industry has some unique features, cybersecurity clusters are not autonomous, and their emergence is connected to a wider technological infrastructure, and to a particular political urban and regional context.