The security technology vendor Entrust Inc. says it is hoping to revive interest in password tokens by offering them for $5 each.
Bankers and security experts have often said that tokens, which generate a new password every minute or so, offer excellent security, and they are widely used to control employee access to corporate networks. However, banks generally have far more customers than they do employees, and the cost of issuing tokens has often outweighed the benefit of using them for authenticating customers.
Many banks spent 2006 exploring ways to strengthen online security to meet a yearend deadline for improvements imposed by the Federal Financial Institutions Examination Council. Some banks considered using the one-time password tokens, but they ended up choosing software alternatives.
Analysts say that other vendors’ tokens often cost $40 to $50 each, though discounts usually are offered for volume shipments. Entrust’s $5 tokens must be bought with its IdentityGuard security software.
Even with IdentityGuard, which costs less at larger scales, Entrust said that its prices are lower than its competitors,’ which also include software licensing and server fees.
Entrust said it hopes its price will persuade new customers to use its products for internal security and to extend the protection to consumers as well. Previously, Entrust resold tokens from Vasco Data Security International Inc.
“It is a commodity-type product,” said Bill Conner, Entrust’s chairman, president, and chief executive. “So price is key.”
The first customer for its tokens is the online travel company Expedia Inc., which uses them with its employees, Mr. Conner said.
In talking to analysts and customers, he said, he has learned that “it’s all about lower price points to send authentication out to more employees in the enterprise … and how to extend it out to the mass market.”
Business Signatures Corp., which Entrust bought in July, tried to attract customers with a similar strategy: In January 2006, it began offering security software for a flat annual fee of $48,000 instead of the $1 per user per year that some rivals charged. Mr. Conner said that Business Signatures’ software has been absorbed into IdentityGuard, which is priced according to the size of the deployment.
George Tubin, a senior analyst at TowerGroup Inc., a Needham, Mass., unit of MasterCard International, said that, though the tokens are not a loss leader, Entrust probably is sacrificing much of its potential profit on tokens in order to sell other security tools.
“What Entrust is trying to do is sell an entire authentication platform,” Mr. Tubin said.
“It’s a smart move on Entrust’s part to round out their product offering and to differentiate themselves with a low-cost token like this,” he said. “There is definitely a segment of the market that buys this stuff based on price.”
Some companies that once considered tokens too expensive will choose Entrust, he said. Others, which have already picked a security vendor that offers tokens, may press their vendor to match Entrust’s price.
Avivah Litan, a vice president and research director at the Stamford, Conn., market research company Gartner Inc., said that some companies can even beat Entrust’s price at large scales but that what Entrust is doing “certainly is disruptive pricing.”
The lower price may even make it easier for banks to pass along to consumers the cost if they choose to use tokens in online banking authentication, she said.
“This would just be one more line-item charge to consumers on a statement,” she said, “and if they kept it under $5, I don’t think consumers would rebel.”
