The dominant cybersecurity industry clusters: evolution and sustainment

Three mega-clusters dominate the cybersecurity industry: the San Francisco Bay Area, the Washington D.C. area and Israel. Together they are home to about half the influential cybersecurity firms; they have remained dominant since industry take-off in the 1990s. How have they remained dominant? We answer this question by synthesizing firm-level data, case studies, and interviews, compiling an extensive history of their evolution; then using a Geographic Information System to map these clusters. Applying the Menzel and Fornahl cluster lifecycle model, we find these clusters advanced into the Growth (2nd) stage but have not reached an equilibrium state. The model points to heterogeneity as key to avoiding cluster weakening through lock-in. Three vectors of heterogeneity explain how these clusters remain dominant: The absence of a de facto standard design, spatial expansion, and the ever-increasing cyber-threat landscape. Additionally, powerful anchor institutions are present in two of the three clusters.