It depends how broadly one defines the industry and the pie. When there is unknown risk, for example, insurance is incredibly difficult. Once we understand the risk, actuaries can do their thing and create a market. Many people have argued that premium control will motivate better security practices, which may have a positive effect on the size of this pie.

When in doubt sell since the perfect product will never be developed by the un-funded. FUD should have one more letter added Un-funded because thats what makes the wheel keep turning. As long as realistic solutions never get to the table snakeoil will be the dressing of choice. In the unlikely event an educated consumer or security products arrives they will find no product because of the lack of funding for the rational approach. At some point down the road FUD will become FUDU and when the dirty tales are told the FUDU really funded the hackers, crackers, and all sorts of attacks. This will prompt another letter "C" for Conspiracy. In the end it will take a systemic break down to create a market to compete with FUDUC. FUD leaves no room for any valid attempt to create a product to fill a need. Why would you need a CIO or and Information Security Staff if a product really worked. Even idiots like myself could purchase it. Idiots buy emotions not rational needs based approachs thats why they buy FUD faster than a reall product. So sell like the snakeoil folks get down and dirty there is no answer other than compete at whatever level it takes. Sorry but you must sell like the FUD folks to sell a real product.