Shift In Liability

With regulatory, compliance and other issues, security is a much higher-stakes business for a VAR to be in, McDonald said.

"When you're a VAR...your liability and opportunity to make mistakes is much more limited than when you step into security," McDonald said.

When making the move to add security to the portfolio, McDonald said VARs have to be extremely careful to outline contracts, disclose activity and maintain their own security or face the very real threat of a lawsuit. McDonald said he has already seen cases of CISOs and VARs being sued for information security-related cases.