Why recurring revenue models are separating security VARs like never before