You'll be sold 70 security tools. You need the right few.

Summary

What is wrong with the "top tools" lists?

A typical list on LinkedIn names 70 or more products across a dozen headings. It looks like a shopping list. It is not one, for three reasons.

Half of it is for attackers and testers

Phishing kits, password crackers, exploitation frameworks and command-and-control software are what professional penetration testers use, and what criminals copy. They have no place on a firm's own laptops. Run without written permission from the system owner, they can also break the Computer Misuse Act 1990 [7]. An enthusiastic IT generalist downloading them adds risk rather than reducing it.

Some of it assumes a team you don't have

Threat intelligence platforms and forensics suites are built for analysts who spend their day hunting and investigating. A firm with two or three IT staff will pay for the licence and never open the console.

Parts of it are out of date

Several entries carry old names or have changed hands. Microsoft renamed Azure Security Center to Microsoft Defender for Cloud in November 2021 [5]. Cisco bought Splunk in March 2024 [3], and Sophos completed its purchase of Secureworks in February 2025 [4]. A list that misses changes like these was recycled for engagement, not written as guidance.

Table 1. Sorting the list into what to buy, what to rent and what to leave alone (alphabetical).

What do most UK firms actually need?

Strip out the offensive kit and the analyst tools, and seven capabilities remain. Each can be framed as a question the board can put to whoever runs IT.

Table 2. In priority order, the order to put them in place. Identity comes first because most of the breaches we see start with a stolen or misused account; joined-up alerting comes last because it relies on the other six.

A word of caution on the last row. A SIEM that nobody tunes or watches becomes one more screen nobody opens. For many smaller firms, XDR run by a managed detection and response (MDR) service does the joining-up, and a separate SIEM only earns its place where a regulator, client contract or log-retention rule calls for one.

Why does a big platform suit a small team?

It sounds backwards, but a large integrated platform often gives a small team better value than a handful of specialist products. Our white paper More tools, less security sets out the evidence on alert overload and hidden running costs. In short, the platform does five things a collection of point products cannot:

• One place to look. One console and one alert queue is something two IT staff can actually watch.
• Joined-up signals. A suspicious sign-in, a flagged laptop and an odd email arrive as one incident, not three alerts in three products.
• One supplier. A single contract, renewal date and skill set to learn.
• Research you could never fund. Large vendors spend heavily on threat research and automation, and it comes built in.
• Capability already paid for. Bundled licences mean switching a feature on often costs little or nothing extra.

Which platform?

Several vendors offer a socket set, and this briefing does not recommend one. Microsoft is the most common example only because so many firms already own it: Microsoft 365 Business Premium includes Microsoft Entra ID P1 for Conditional Access [1], plus Microsoft Intune for device management and Microsoft Defender for Business for device protection [2]. Cisco now pairs its security portfolio with Splunk for logging and SIEM [3]. Sophos added Secureworks' XDR, identity threat detection and SIEM capabilities to its own range [4]. Palo Alto Networks, CrowdStrike and Fortinet have their own suites too. The brand of socket set matters far less than whether anyone has opened the box.

The honest trade-off

Relying on one platform brings lock-in, and it may be weaker in some areas than a specialist product. Plan for that supplier failing, with backups that do not depend on it. For most smaller firms, though, coverage that is configured and watched beats a stronger product nobody reads.

Who turns the spanner?

A platform still needs someone to set it up, tune it and respond when it raises the alarm. There are three common ways to arrange that.

Table 3. Operating models, from most to least in-house effort.

A good MSP running one integrated platform well is a better outcome than one reselling ten products. Before signing, ask four things: what do you run, who watches it out of hours, how fast do you respond, and what will you report to us each month?

Responsible is not accountable

The RACI model sets out who is responsible, accountable, consulted and informed for each task. An MSP can do the work. The board, or a named owner in the business, keeps the accountability for the result.

Table 4. Activities in lifecycle order: choose, run, respond, change, review. R = responsible, A = accountable, C = consulted, I = informed.

It is your estate, so you should take part in decisions about the platform, its design and any major change, not hear about them afterwards. Watch for a provider that brings its own complexity in with it: preferred tools, extra agents, separate portals and licences layered on top of the platform you already own. That rebuilds the sprawl this briefing warns against, and it makes leaving the provider harder. The same supplier risk runs through our paper on third-party and supply chain ransomware.

Where do testing, intelligence and forensics fit?

They still matter. Buy them as services, not software.

• Penetration testing: commission an independent test at least once a year, and after major change. The National Cyber Security Centre (NCSC) runs the CHECK scheme for approved firms [6].
• Threat intelligence: expect it inside your XDR platform or MDR service, turned into alerts your team can act on.
• Forensics: agree an incident response retainer before you need one, so experts arrive with their own kit.

What we see in practice

We have seen the same pattern in a number of firms. Security products were picked from the top-right corner of the Gartner quadrant, one category at a time, without asking how each would fit with what was already there. Every purchase looked sensible on its own. Together they left the firm paying for several overlapping products, each used for only one or two features.

Two antivirus products on every laptop

The clearest example, which we have found in several companies, is a separate antivirus product installed alongside Microsoft Defender or CrowdStrike. Products doing the same job low down in Windows end up fighting over the same registry settings. We have seen every cost of that first-hand:

• Money. Two licences for one job.
• Complexity. Two agents to update, tune and keep from blocking each other.
• Doubt. When they disagree, nobody knows which one to trust.
• Missed signals. A tool quietly hobbled by its rival stops reporting, and the gap only shows when something gets through.

Why does it happen? Often because of an old belief that no single vendor can be relied on, so an extra product goes on as a safety net. In practice every team, and every engineer, already has tools it trusts and ones it doesn't. A second agent does not settle that question; it hides it. Pick the product you have confidence in, configure it properly and test it. Resilience comes from different layers and a recovery plan that does not depend on one supplier, not from two products doing the same job on one laptop.

Information overload

The same firms often ran different systems for vulnerability scanning, patching and compliance reporting. Each produced its own alerts, dashboards and reports, so a small team faced more information than it could read, let alone act on.

The way out is not another product. Decide which platform does each job, switch on the features already licensed and retire the rest at renewal, as our white paper More tools, less security sets out.

Five questions before you sign

1. Which gap does this close? Name the risk in one sentence, or do not buy it.
2. Do we already own something that does this? Check the platform licence before the purchase order.
3. Who owns it, by name? A product without an owner is a cost, not a control.
4. Who reads its alerts, and when? Including nights, weekends and holidays.
5. If our MSP left tomorrow, what in our estate would only they understand? Anything on that list is a risk the board has accepted without knowing it.

Conclusion

The 70-tool list sells the idea that security comes from owning more products. For a firm with a small team, it rests on a few core capabilities, delivered by one platform that is configured, connected and watched. Whoever turns the spanner, the board keeps the accountability and a say in what goes into its estate. Our white paper More tools, less security gives a board test for the tools you have, and our briefing on board cyber risk reporting shows what good reporting from IT or a provider looks like.

Technical annex: checking your platform

For the IT lead or provider. Use this to confirm each capability is switched on and owned. The example column shows where the capability sits in Microsoft 365 Business Premium, because many firms already hold that licence; other platforms map in a similar way, so check with your vendor.

Table 5. Same priority order as Table 2. Licence contents change; confirm against current Microsoft documentation before relying on this table.

Glossary

Table 6. Terms used on this page (alphabetical).

Further reading

From CyberCQR

• More tools, less security: why doing more with what you own beats buying more
• Board cyber risk reporting
• Third-party and supply chain ransomware
• Simpler and stronger: fixing sign-in from the boardroom down

References

1. [1]Microsoft Learn, Microsoft 365 Business Premium security overview, viewed 5 November 2026.
   https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-security-overview
2. [2]Microsoft Learn, Microsoft 365 Business Premium security: frequently asked questions, viewed 5 November 2026.
   https://learn.microsoft.com/microsoft-365/admin/security-and-compliance/m365bp-security-faq
3. [3]SecurityWeek, Cisco completes $28 billion acquisition of Splunk, 18 March 2024.
   https://www.securityweek.com/cisco-completes-28-billion-acquisition-of-splunk/
4. [4]TechRepublic, Sophos acquires Secureworks for $859 million, 4 February 2025.
   https://www.techrepublic.com/article/sophos-acquires-secureworks/
5. [5]Microsoft Tech Community, A new name for multi-cloud security: Microsoft Defender for Cloud, November 2021.
   https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/a-new-name-for-multi-cloud-security-microsoft-defender-for-cloud/ba-p/2943020
6. [6]National Cyber Security Centre, CHECK penetration testing, viewed 5 November 2026.
   https://www.ncsc.gov.uk/information/check-penetration-testing
7. [7]legislation.gov.uk, Computer Misuse Act 1990, viewed 5 November 2026.
   https://www.legislation.gov.uk/ukpga/1990/18/contents