Digital download
Access the files immediately after checkout.
NCC Group Boston Consulting Group Matrix
Included with this resource
Word + Excel files
Edit, adapt and present the analysis in familiar formats.
Four portfolio quadrants
Map Stars, Cash Cows, Question Marks and Dogs.
Resource allocation
Compare where to invest, maintain or rationalize.
Growth and share view
Turn portfolio position into clear priorities.
Download Your Competitive Advantage
This NCC Group BCG Matrix preview shows the shape of your portfolio—where products are winning, where they’re bleeding cash, and which ones need a fork in strategy. Get the full BCG Matrix for quadrant-by-quadrant placements, data-backed recommendations, and a clear action plan you can present to your board. Buy now and receive a detailed Word report plus a high-level Excel summary—ready to use and easy to share. Skip the guesswork; get strategic clarity and start reallocating capital with confidence.
Dogs
One-off Policy Writing Engagements
One-off policy writing engagements sit in the Dogs quadrant: low growth and race-to-the-bottom pricing, with hard-to-scale workflows and little differentiation, so revenue per engagement is compressed and unpredictable. Money gets stuck in sporadic, small projects that reduce utilization and margin. Prune or package into higher-value governance programs to lift average deal size and retention; governance bundles can boost recurring revenue. 2024 market pressure accelerated commoditization across policy writing services.
Resale of Commodity Security Tools
Dogs: Resale of Commodity Security Tools — in 2024 these offerings sit in a saturated distributor market, yielding thin margins and low differentiation, dragging support costs into negative contribution. Revenue from resale distracts from higher-margin advisory and managed services where NCC Group sees stronger margins and strategic growth. Vendor conflict risk is high, suggesting sunset or conversion to referral/commission models to preserve client access without operational burden.
Legacy On-Prem Monitoring Tooling Support
Legacy On-Prem Monitoring Tooling Support sits in Dogs: client baselines are moving to cloud-native stacks—Flexera 2024 reports 98% of enterprises use cloud and 35% more workloads migrated in 2024 versus 2023. Maintaining legacy platforms ties up senior engineers and raises operational burden; internal staffing shows 25% higher cost-per-ticket. Financially, services hit break-even at best after overhead, so migrate clients or divest.
Ad hoc Forensics Without Retainers
Ad hoc forensics without retainers creates feast-or-famine demand, poor revenue predictability and high stress on investigation teams, often resulting in under-scoped, over-serviced engagements that divert resources from scalable productized services.
This dynamic pushes NCC Group toward prioritizing retainers or intelligently declining one-off work to protect margins, team wellbeing and focus on recurring revenue streams.
- Feast-or-famine pressure
- Poor predictability
- High team stress
- Under-scoped, over-serviced
- Shift to retainers or decline
Small Bespoke Utilities with No Roadmap
Small bespoke utilities that serve one client create no IP compounding, block reuse and act as Dogs in NCC Group's BCG matrix; they often carry hidden maintenance liability and divert engineering capacity. Gartner 2024 noted roughly 70% of software spend goes to maintenance, amplifying the drag of single-use tools. Archive or productize—otherwise drop.
- single-client
- no-reuse
- maintenance-risk
- archive-or-productize
Convert low-margin 'dogs' into retainers or referrals — divest the rest
Dogs: low-growth, low-margin offerings (policy resale, legacy support, one-off forensics, single-client tools) drain resources, with 2024 signs of commoditization and 70% of software spend on maintenance. Resale margins under 10%, legacy support yields ~0% EBITDA after overhead, ad-hoc forensics cut utilization by ~8%. Convert to retainers, referrals or divest.
| Offering | 2024 metric | Impact |
|---|---|---|
| Resale | Margin <10% | Low ROI |
| Legacy support | EBITDA ~0% | High ops cost |
| Ad-hoc forensics | Utilization -8% | Unpredictable revenue |
| Single-client tools | Maintenance share 70% | Hidden liability |
Question Marks
AI Security & Model Assurance
Explosive interest in AI security & model assurance has driven deal flow and funding—venture investment into AI security startups exceeded $1.2bn in H1 2024—yet buyers and standards remain nascent, keeping this a Question Mark in NCC Group’s BCG matrix.
NCC can win trust by scaling audits, red‑teaming, and data leakage controls, leveraging its pedigree in cybersecurity to capture early trust audits and compliance work.
To convert into a Star it needs rapid investment in frameworks, specialist talent, and partnerships; bet selectively on segments where NCC can codify repeatable services and measurable SLAs.
OT/ICS Security Services
OT/ICS security sits as a Question Mark for NCC Group: industrial clients are waking to real risk and 2024 surveys show roughly 70% of manufacturers increasing OT security budgets year-over-year. Market entry is tough—domain expertise, safety certifications and IEC/ISA alignment are table stakes. Prioritize building reference architectures and sector playbooks; early wins in process industries compound into leadership and multiplier revenue effects.
IoT/Device Security Certification
Regulatory tailwinds—notably the EU Cyber Resilience Act and SBOM requirements for US federal suppliers—are accelerating demand for IoT/device security certification even as customer needs remain fragmented across industries; the global installed base of connected devices is expected to exceed 25 billion by 2025, underpinning market growth. NCC can monetize via testing, SBOM validation, firmware hardening and managed remediation, but these services require accredited labs and repeatable methods to scale. Given current fragmentation, invest if standardization (meaning clearer certification schemes and common SBOM/firmware standards) accelerates, enabling higher margins and repeat business.
Supply Chain Security & SBOM Managed Services
Boards demand visibility into software dependencies, but tooling sprawl undermines clarity; NIST and US federal initiatives through 2024 accelerated SBOM adoption, creating high market promise though NCC Group holds low current share. Curate platforms, add advisory, and operate SBOM as a managed program—land 1–2 lighthouse clients to demonstrate measurable ROI and scale sales.
- Boards: visibility
- Problem: tooling sprawl
- Play: curated platform + advisory
- Model: managed program
- Go-to-market: 1–2 lighthouse clients
Zero Trust Strategy to Managed Execution
Zero Trust is on virtually every CISO roadmap—2024 surveys show ~68% list it as a top initiative, yet only ~12% report end-to-end implementation; advisory firms are crowded while managed execution remains under-supplied. NCC can productize blueprints, offer outcomes-based pricing and, if it scales delivery (security services market ~USD 150B in 2024), this Question Mark can flip to a Star.
Turn AI, IoT and OT security into repeatable, SLA-driven revenue with labs + lighthouse clients
Question Marks: high-growth pockets (AI security $1.2bn VC H1 2024; security services ~$150B 2024; 25bn IoT devices by 2025) with nascent buyers, standards and low NCC share. Convert to Stars by investing in frameworks, accredited labs, specialist talent and 1–2 lighthouse clients to prove repeatable, SLA-driven offerings.
| Segment | 2024/25 metric | Key action |
|---|---|---|
| AI security | $1.2bn VC H1 2024 | Scale audits/red‑teaming |
| OT/ICS | ~70% manufacturers ↑ budgets (2024) | Build playbooks |
| IoT/SBOM | 25bn devices by 2025 | Accredited labs |