Will the compliance frenzy settle down once organizations get used to regulatory frameworks? Eventually does compliance just become a part of doing business?

I think a lot of companies are going to get to the state where compliance is a part of doing business, but not everyone is there yet, the market is very young. Not many companies have a records infrastructure, not many are able to prevent data leakage, and IP protection is a problem for any company that has supply chains overseas. So most companies aren't there yet. There's not a public company in the world that won't face making compliance a fabric of how they do business, and they will have to get there over the next couple of years.

What will be the most important security initiatives for enterprises during the remainder of this decade?

Establishing a policy infrastructure with a delivery infrastructure that complements it. Getting this delivery infrastructure in real time to deliver new signatures and stay ahead of new threats, but to also expand the amount of security you deliver to include compliance and reporting. The next wave of enterprise security will be a complete ubiquity of infrastructure that will allow you to get real-time updates of patches, manage policy reporting and compliance reporting. It's a very early market, but it's an important one.

Another one is going to be the consolidation of features in unified threat management at the network level. Enterprises are looking more and more to say, 'Take the VPN firewalling capability and combine that with antivirus and some filtering with a suite of services that also does some packet analysis . . . and can we get it in real time?'

What keeps you up at night?

I'm probably most worried about the shifting consolidation [in the security industry]. Right now I have a very clearly defined competitor; in the future that might not be as clearly defined, as other large vendors may want to enter the [security] market. Clearly, Cisco and others have begun to make their direction known, while not yet competing with us in the bulk of our business. But I don't think [Cisco Chairman and CEO] John Chambers is shy, nor do I think Oracle, HP and IBM are shy.

What keeps me up at night is [the thought of] waking up and reading about a large acquisition that creates a new competitor for me that's larger in scale than me. I was encouraged when I saw Cisco buying WebEx.

I'd like to see them buying more companies like WebEx and not more companies in security. But that's probably what worries me most; I feel like I have a window of opportunity here to help drive this company and be the consolidator before a larger competitor can enter the space.