CyberCQR Thinking · Security tools
More tools, less security: why doing more with what you own beats buying more
Most security budgets grow by adding products. For firms of 500 to 2,000 people with small security teams, the bigger gains usually come from running fewer tools properly.
Summary
The point for boards. A security product only reduces risk when someone has set it up properly, tuned it to the business and acts on what it reports. Every extra tool competes for the same small team's time. For most mid-sized firms, the question is not "what should we buy next?" but "how much of what we already pay for is actually working?"
How tool sprawl happens
Nobody sets out to run a sprawling security estate. It builds up one sensible-looking decision at a time: a new product after an audit finding, another after a near miss, a third that arrived with an acquisition, a fourth because a customer's questionnaire asked for it. Each purchase solves the problem in front of someone. Few are ever retired.
The pattern shows in the research. A survey of 1,200 security leaders in the US and UK found their organisations managed 76 security tools on average, up from 64 two years earlier [1]. In the same survey, 82% said they had been surprised by an incident that got past controls they believed were in place [1]. More tools had not brought more confidence about what was actually covered.
Those figures come from large organisations. A firm of 500 to 2,000 people will run far fewer products, but it also has far fewer people to run them. The ratio of tools to people is often worse.
Why more tools is not more security
The case for adding products usually rests on one idea: if one tool misses a threat, another might catch it. On paper, two tools that each catch most threats should together catch almost all of them. That only holds if three things are true, and in a small team they rarely are.
| The assumption | What tends to happen |
|---|---|
| The tools catch different threats | Products in the same category look for much the same things. The threats one misses are often the ones the other misses too, while both alert on the same everyday events. |
| Someone acts on every alert | Alerts arrive faster than people can deal with them. In one survey of 2,000 analysts, teams received 4,484 alerts a day on average and could not deal with 67% of them, spending nearly three hours a day on manual triage [2]. |
| Each tool runs as designed | Products left on default settings, with features switched off and rules never tuned, deliver a fraction of what they were bought for. Tuning takes time and skill that the team may not have. |
Table 1. The assumptions behind "more tools catch more", and what happens in practice.
The skills point matters most in the UK mid-market. The government's 2025 labour market study found that 49% of UK businesses have a basic cyber security skills gap, and 30% a gap in advanced skills [4]. Basic gaps include setting up and configuring security controls such as firewalls [4]. A business that struggles to configure its existing controls will not be safer for adding more of them.
A tool nobody has time to tune or watch is a cost, not a control.
Where the cost really sits
Licence fees are the visible part of a security tool's cost. The rest is less visible but usually larger, because it is paid in the security team's time:
- Integration. Connecting each product to the others, and to logging and alerting, then keeping those connections working through every update.
- Expertise. Each product has its own console, query language and settings. A small team ends up knowing several products a little rather than any of them well.
- Attention. During an incident, every extra console is another place to look and another set of alerts to reconcile before anyone can act.
- Renewals and suppliers. Contracts, renewals and account managers all take management time that is not spent on security.
Industry research points the same way. When Gartner surveyed 418 security and risk leaders, 75% were pursuing vendor consolidation, up from 29% two years earlier [3]. The main reason given was a better risk posture, cited by 65%. Only 29% expected lower licence costs [3]. Gartner's advice was that cost should not be the main driver, and that consolidation takes at least two years [3].
Doing more with what you own
The alternative is not a particular vendor. It is a discipline: choose a coherent set of tools, get them properly configured, connect them so they share information, and keep tuning them. Four things make the difference.
| Practice | What it means | Why it helps |
|---|---|---|
| Use the features already paid for | Many business software bundles include security capabilities that are licensed but never switched on. | Closes gaps without new spend or new suppliers. |
| Connect the tools | Identity, device, email and data tools share signals, so one incident appears as one story rather than five separate alerts. | Faster, more confident decisions during an incident. |
| Tune continuously | Detection rules and policies adjusted to how the business actually works, and false alarms removed at source. | Fewer alerts, and the ones that remain are worth reading. |
| Build depth in people | The team knows its core tools well rather than many tools a little. | Better use of advanced features, and less dependence on any one individual. |
Table 2. Four practices behind "do more with what you own" (in order of cost, lowest first).
Automation is part of this, and the evidence is encouraging. IBM's 2025 UK study found that organisations making extensive use of security AI and automation identified and contained breaches 42 days faster than those that did not, and their breaches cost £670,000 less on average [5]. Automation works best on a small number of well-understood tools. It is hard to automate across a dozen products that do not talk to each other.
When more than one vendor is the right answer
Consolidation is not a rule, and a fair argument should say where it stops.
- Layers are not duplicates. Defence in depth means different controls at different layers: identity, devices, network, data and backups. That remains essential. The problem is several products doing the same job, not several layers.
- Concentration is a real risk. In July 2024 a faulty update to one widely used security product took down an estimated 8.5 million Windows devices worldwide [6]. Relying on one supplier for everything needs a plan for that supplier failing, including backups and recovery that do not depend on it.
- Some firms need specialists. Large security operations teams, firms with specific regulatory requirements and operational technology environments may need products that a single platform cannot provide.
- Switching has a cost. Replacing a product the team knows well with one it does not can make things worse for a year or more. Consolidation should follow contract renewals and be planned, not forced.
The tool estate test
We use six questions to test whether a security tool estate is working for the business. Each one can be answered at board level.
| Area | Question for the board | What good looks like | Warning sign |
|---|---|---|---|
| Alerts | How many security alerts do we get each week, and how many are looked at? | A known number, falling over time as tuning improves, with every high-priority alert reviewed. | Nobody knows the number, or alerts go to an inbox nobody owns. |
| Concentration | What happens if our main security supplier has an outage or a faulty update? | A tested recovery plan, and backups that do not depend on that supplier. | The question has never been asked. |
| Inventory | What security products do we pay for, and who owns each one? | A current list with an owner, a renewal date and a purpose for every product. | The list has to be pieced together from invoices. |
| Overlap | Do we pay twice for the same job? | Each job (for example email filtering or endpoint protection) is done by one product, or the second is there by deliberate choice. | Two products do the same job and nobody can say why. |
| Skills | Does our team, or our provider, know each tool well enough to tune it? | Named people with training and time for each core tool. | Tools were set up by a project team or reseller that has since left. |
| Utilisation | Which security features are we licensed for but not using? | A reviewed list, with a decision for each: switch on, or stop paying. | Renewals happen automatically with no review of what is used. |
Table 3. Board test for the security tool estate (alphabetical).
A practical route
- Inventory. List every security product, what it costs, what job it does and who owns it.
- Map. Match products to jobs and layers. Mark overlaps and gaps.
- Switch on. Use features already licensed to close gaps before buying anything new.
- Decide at renewal. For each overlap, decide which product stays, timed to contract renewals rather than forced early.
- Tune and connect. Invest the time freed up in tuning the remaining tools and connecting them.
- Report. Give the board a short, regular view: alerts handled, gaps closed, products retired.
Expect this to take time. Gartner's guidance is to plan for at least two years [3]. The first benefits, from switching on features already paid for, usually come much sooner.
Five questions for your next board meeting
- How many security products do we pay for, and could anyone list them today?
- Which security features are we licensed for but have never switched on?
- How many alerts did we receive last month, and how many did anyone look at?
- Where are we paying two suppliers for the same job, and was that a deliberate choice?
- If our main security supplier failed tomorrow, how would we recover?
Conclusion
Buying another product feels like progress. For a mid-sized firm with a small team, it often is not. Each new tool adds alerts, integrations and expertise to maintain, and takes attention from the tools already in place.
Security is the outcome, not a solution. Here, the outcome comes from a smaller set of tools that are properly configured, connected and watched, and from a board that asks how well its existing investment is working before approving the next one.
How much of what you already pay for is actually working?
Glossary
| Term | Meaning |
|---|---|
| Alert fatigue | The point at which security staff receive more alerts than they can review, so real warnings are missed. |
| Consolidation | Reducing the number of security products and suppliers, usually so the remaining tools can be integrated and run well. |
| Defence in depth | Using several layers of different controls, so that one failure does not expose everything. |
| Integration | Connecting security tools so they share information and can act together. |
| Tool sprawl | An accumulation of overlapping security products, often without a clear owner or purpose for each. |
| Tuning | Adjusting detection rules and policies to the business, to catch real threats and remove false alarms. |
Table 4. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Identity and Access Management: Top 10 Must-Do Actions. The identity controls to switch on first, many of them in licences you already hold.
- The VPN Trap. Why legacy remote access is a board-level risk, and the alternatives that may already be paid for.
- The Route to Live. Environment controls and the deployment pipeline as a security discipline.
External
References
- [1]Panaseer, 2022 Security Leaders Peer Report (1,200 security decision-makers, US and UK), as reported by Infosecurity Magazine, Organizations Now Have 76 Security Tools to Manage, 2022.
https://www.infosecurity-magazine.com/news/organizations-76-security-tools/ - [2]Vectra AI, 2023 State of Threat Detection (2,000 security analysts in 12 countries including the UK), 2023.
https://vectra.ai/resources/2023-state-of-threat-detection - [3]Gartner, Gartner Survey Shows 75% of Organizations Are Pursuing Security Vendor Consolidation in 2022 (418 respondents), 12 September 2022.
https://www.gartner.com/en/newsroom/press-releases/2022-09-12-gartner-survey-shows-seventy-five-percent-of-organizations-are-pursuing-security-vendor-consolidation-in-2022 - [4]Department for Science, Innovation and Technology, Cyber security skills in the UK labour market 2025.
https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2025/cyber-security-skills-in-the-uk-labour-market-2025 - [5]IBM UK, Cost of a Data Breach 2025: UK findings, 2025.
https://uk.newsroom.ibm.com/2025-cost-of-data-breach-UK - [6]TechCrunch, Microsoft says 8.5M Windows devices were affected by CrowdStrike outage, 20 July 2024.
https://techcrunch.com/2024/07/20/microsoft-says-8-5m-windows-devices-were-affected-by-crowdstrike-outage/
Security is the outcome, not a solution.
CyberCQR is a UK cybersecurity advisory practice. We help organisations get more security from the tools they already own, without vendor commissions or product resale.