The global market for cloud-based managed security services grew to $7.2 billion in 2014, up a galloping 13.5 percent from the year prior, according to a report issued today by Infonetics Research (recently acquired by IHS).

Driven by service providers' shift toward virtualized network infrastructure, cloud-based security will continue to grow and overtake on-premises security services by 2018, the report predicts.

“Providers are leaning heavily on SDN and the promise of NFV," Infonetics analyst Jeff Wilson said in a statement. "This will help them deliver a wide range of new security services that leverage virtual appliances."

Including both cloud-based security services and those using customer-premises equipment (CPE), global revenue for managed security services hit $15.8 billion last year, up 10 percent from 2013, according to the report. Cloud-based security's share of that market grew to 46 percent by revenue, led by content security and managed firewall services.

Cloud will overtake CPE within three years, the report said.

Telcos have scrambled to adjust to the shifting security services market as mobile users and cloud-based workloads have radically altered the threat profile of their enterprise customers. Providers also hope that services built on virtual infrastructure will prove more nimble than those delivered through on-premises equipment, allowing for rapid rollout of new managed services.

In some cases, network infrastructure vendors have been caught flat-footed by the shifting market. For example, Ericsson last month announced a partnership with Intel Security for managed security services, with Ericsson Vice President and Head of Managed Services Jean-Claude Geha citing Intel's "roadmap for cloud, network functions virtualization and software-defined networking solutions" in a statement.

The deal, which will see Ericsson selling telcos a white-label managed security service from Intel, is in essence a stalling tactic for the network infrastructure giant, according to one source with knowledge of Ericsson's plans.

"They really don't have the managed security services that providers want," the insider said of Ericsson. "But you can bet they're building them."