Once upon a time, Symantec Corporation was synonymous with computer security. From its founding in 1982 and well into the 1990s, the company led the industry in computer virus detection and protection.

But the cybersecurity landscape has changed dramatically over the years. While spam and rudimentary computer viruses were the enemy back them, today record-breaking IoT-based botnet attacks and global ransomware like WannaCry are the norm.

As a result, large established security vendors — including Symantec, Cisco, IBM, Check Point and Intel — have a harder time competing against emerging vendors like Palo Alto Networks, Fortinet, Trend Micro, FireEye and Forcepoint, according to a Technology Business Research (TBR) report released in February.

In fact, established security vendors Symantec and Intel have illustrated market challenges recently, with Intel selling part of its security business and Symantec launching a reorganization plan in hopes of returning to profitability.

A growing market

There's certainly no shortage of demand for cybersecurity products and services today. The cybersecurity market will grow almost 12% over the next two years, according to TBR. Meanwhile, Cybersecurity Ventures estimates global spending on cybersecurity products and services will exceed $1 trillion cumulatively over the next five years.

But forces like "adoption of the General Data Protection Regulation in the European Union as well as the evolving security requirements associated with the digital transformations underway in many organizations," means the market will see shifts, said Jane Wright, Technology Business Research security practice lead.

Long-established security vendors, which were born and thrived under a much different cybersecurity landscape than today's climate are struggling to modernize and add online protection services to their traditional products.

In Symantec’s case, the company has also suffered some unique blows to its reputation recently.

Last June, a Google security expert exposed several critical vulnerabilities in Symantec and Norton security products. In July, the Department of Homeland Security issued a similar warning about the products. 

Then early in 2017, Google said Symantec failed to properly validate at least 30,000 Secure Socket Layer (SSL) /Transport Security Layer (TLS) digital certificates over the last several years. SSL/TLS certificates encrypt web server and web browser communication over a network, which protects companies from eavesdropping, content hijacking, cookie stealing and censorship.

Google said it planned to gradually remove trust in old Symantec SSL certificates and reduce the accepted validity period of newly issued Symantec certificates, according to a Google Chrome announcement. In the announcement Google engineers also stated that they "no longer have confidence in the certificate issuance policies and practices of Symantec," and those practices have "created significant risk for Google Chrome users."

Symantec is one of the largest providers of digital certificates, accounting for 42% of the certificate validations on the market, according to Mozilla data. For Symantec, Google downgrading trust in the company was a blight on its reputation.

Symantec could not immediately be reached for comment. 

What's going on in security?

Beyond the SSL issue, established security companies are struggling with a rapidly evolving security landscape that is seeing huge changes in scope and complexity.

"The number of players in the space is increasing daily," said Mitch Lieberman, director of research at G2 Crowd. "The sheer number of players make it hard to isolate why [Symantec is] struggling. It could be the baggage of a consumer or small business focus, or that people believe new cybercrime approaches require new types of defense."

Cybersecurity in the enterprise really comes down to "prevent, detect and respond," said Lieberman. Many of the older tech companies are good at the first two elements, but not so great at "respond."

"Responding is a critical element of solving the problem," said Lieberman. "If the old-school companies can figure out how to fit into the processes required by cybersecurity professionals, then they will be able to live by brand name and live to fight on." 

Lieberman said more companies are also bringing in consulting firms to help them manage security and make decisions. But old school companies in the cybersecurity arena typically went direct to consumers and businesses.

"Now, they need to go after influencers," Lieberman said.

Al Sargent, senior director at OneLogin, said the current cybersecurity landscape is being driven by three major trends: Securing the cloud, multiple authentication factors and machine learning to cover a broader set of threats. Cybersecurity companies that don’t respond to needs in those areas could therefore have a tougher time competing today.

Can Symantec recover?

Symantec is working hard to make a comeback. The company bought Blue Coat for $4.65 billion last June in hopes that its more modern approaches to security could help reinvigorate Symantec’s offerings. The purchase created a single security vendor primarily focused on enterprise security. Last October, Symantec CEO Greg Clark said, "we are the first really truly integrated cyber defense platform."

Clark said Symantec plans to work closely with channel partners to dominate the cybersecurity market, to focus on open source development, and to "use its depth of engineering talent as a key differentiator."

But just last month, Symantec reported disappointing fourth-quarter fiscal 2017 results, indicating the company's turnaround may take longer than expected. Yet experts say that doesn't mean Symantec can't make it happen eventually.

Among G2 Crowd users, several of Symantec's products are "highly rated and liked," Lieberman said. 

But Lieberman added that Symantec and other old school security companies will need more than good products to survive. "They need to be willing to accept new approaches and how things are done now."

Lieberman also warned that those companies need to be cautious around buzzwords like machine learning and artificial intelligence.

"As enterprise software vendors learned early on, taking your technology stack and hosting it on AWS does not suddenly make you a cloud vendor," he said. "In cybersecurity, adding AI and ML to your marketing materials does not suddenly make you bleeding edge."