Stop buying security tools: start buying a system

A file and folder transferring data with a red warning mark indicating malware. — (Image credit: Shutterstock)

Ask a CISO why they bought their newest cybersecurity tool, and they’ll have a clear answer lined up.

It stops a specific technique, closes a particular gap, or satisfies a compliance requirement.

However, it's often less clear how the tool fits in with the rest of the stack.

Start with the outcome, not the technology

I find this additive approach is often due to focusing on specific emerging threats or identified weak points, so decisions are made with a tactical eye rather than a broader strategic view.

Part of the problem is that most organizations have never precisely defined the security outcome they are trying to achieve. Without a shared, specific language for the problem, every new purchase becomes additive, because there is nothing solid to measure it against.

Take asset labelling, which is a core capability most organizations know they need, so they invest in a tool, populate a configuration management database (CMDB), and assign criticality scores. Job done, right? But labelling an asset only answers the question of what it is, and says nothing about how that asset connects to everything around it, or what happens when a policy needs to be enforced against it.

Labelling, visibility and enforcement are three distinct jobs, not one. Solve the first and the second and third remain wide open, so another tool gets bought to cover visibility, then another for enforcement. Each purchase solves its own narrow question perfectly well.

However, none of them were ever asked to work as a single, continuous capability, because nobody defined that as the actual requirement in the first place.

What if asset management labels fed into visibility views and the same reflected how policy is drafted and then enforced? Now you have a strategic problem solved with interoperable capabilities.

How much of your stack is really putting in the work?

Gartner’s most recent Leadership Perspective Survey saw CISOs noting this as a common issue, with just 20-30% of tool capability actually being used in some cases. The instinctive response to this is to cut the stack down, however, that instinct solves the wrong problem.

A good exercise for working out the value of the stack is to evaluate every tool, new or already deployed, against three plain questions.

Does it offer continuous validation against a given threat - and what, specifically, does it validate? Is it still operationally relevant? And is it effective, right now, in the environment you have today? A tool can pass one or two of these and still be failing you.

Virtual Local Area Networks (VLANs) are a good example of this. Twenty or thirty years ago, when networks were typically static and everything likely sat inside a single data center, VLAN-based segmentation was genuinely effective. It matched the environment it was built for.

That environment has since changed almost beyond recognition. Workloads move between on-premises systems, cloud and containers, and nothing stays fixed for long. VLANs are still deployed across many stacks today, still technically doing the segmentation job they were built for. Yet their effectiveness has dropped sharply because they offer none of the continuous validation a hybrid, constantly shifting estate actually requires.

Effectiveness has an expiry date that has nothing to do with whether the tool still runs. Success should be measured by whether the system as a whole still holds up, not by how many tools remain switched on.

Consolidated security, not consolidated tooling

Gartner identified that most organizations are pursuing a vendor consolidation strategy. While this approach certainly reduces unnecessary spending and keeps budgets under control, it’s not necessarily solving the biggest problem.

Consolidated tooling and consolidated security are not the same thing, and it’s an assumption that leads to disappointment. Reducing the number of tools alone achieves little if the underlying processes remain fragmented or teams continue to operate against different objectives.

No data center I have walked through was built entirely by one manufacturer. Racks, switches, storage and cabling come from a dozen suppliers, yet they operate as one coherent system because they were designed to fit together. Security should work the same way.

The goal is not necessarily fewer vendors, but every control, whoever built it, feeding into the same continuous picture of identification, visibility and enforcement.

What to ask instead

Before completing the next security purchase, consider how well a new tool fits into the stack you already have, not just what it claims to do on its own.

A tool that deploys cleanly, validates continuously rather than only at go-live, and feeds its findings back into the tools already in place is doing real work. One that arrives as a fresh, isolated source of alerts is just adding to the noise, however good its individual detection rate looks in a demo. That means comparing what the tool was bought to solve against what it is actually delivering today, checking it against newer capabilities, and being willing to redeploy or renegotiate rather than automatically renew or even retire.

Ultimately, the strongest security programs are not defined by the number of tools they deploy, nor by the number they eliminate. They're defined by how effectively every control works together when it matters most.

We've rounded up the best endpoint protection software suites.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Director, Systems Engineering at Illumio.