Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Cutting Their Security Vendor Count
Transcript
- Lucas: The average enterprise runs about 45 different security tools. And if you talk to any CISO, they'll tell you that's the problem, not the solution. Luna: 45 tools? How does anyone even manage that? I imagine alerts coming from every direction. Lucas: Exactly. Each tool generates its own feed of alerts, most of them false positives. You end up with a security operations team that's drowning in notifications but not necessarily any safer. That's why a growing number of CISOs are actively consolidating their vendor stack. Luna: So the pendulum is swinging away from 'add another point solution' toward platform plays? Like what Palo Alto and CrowdStrike are pushing? Lucas: Right. Palo Alto's Cortex XSIAM is a good example—it tries to replace traditional SIEM, SOAR, and endpoint detection with a single data pipeline. CrowdStrike's Falcon platform does something similar, adding cloud workload protection, identity, and next-gen SIEM into one agent. The pitch is: one console, one data store, one vendor to manage. Luna: But doesn't that create a single point of failure? If you put all your eggs in one basket, a breach at that vendor becomes catastrophic. Lucas: That's the big trade-off. In a recent survey by Gartner, about 78% of organizations said they plan to consolidate their security vendors over the next two years. But the same survey found that 29% of those that consolidated regretted it, mainly due to lock-in and loss of best-in-class capabilities. So it's not a no-brainer. Luna: What's driving the consolidation pressure then? Is it purely cost? Lucas: Cost is a big part. The average security stack has grown to over 45 tools, and the licensing, integration, and training costs add up fast. But the bigger driver is operational complexity. One CISO I spoke to said his team spent 30% of their time just stitching tools together—writing custom scripts to make logs talk to each other. That's time not spent on actual threat hunting. Luna: So it's about efficiency. Fewer tools means less integration work, fewer credentials to manage, fewer vendors to negotiate with. Lucas: Exactly. And from a security outcomes perspective, consolidation can reduce the amount of context switching. When an analyst stays in one platform for detection, investigation, and response, they're faster. Some studies show mean time to respond drops by 30 to 40% with a unified platform. Luna: But you mentioned the risk of lock-in. How do CISOs decide which platform to bet on? Lucas: Most of them start with a 'crown jewel' domain—usually endpoint detection and response, or EDR. That's where CrowdStrike and Microsoft Defender are strong. Then they look at adjacent capabilities like identity or cloud security and see if the endpoint vendor can credibly cover those areas. If yes, they start migrating. If not, they keep a best of breed approach. Luna: So it's not all or nothing. There's a middle path. A 'platform-first' strategy but with room for specialty tools where needed. Lucas: That's exactly the framework most security leaders are adopting. They consolidate around a central platform—usually the EDR or SIEM—and then keep two or three niche tools for things like secrets management, web application firewalls, or fraud detection. The goal is to get down from 45 tools to maybe 15 to 20. Luna: And that has a real impact on the business side too, right? Fewer vendors means simpler procurement, less legal overhead, easier renewal cycles. Lucas: Absolutely. One Fortune 500 CISO told me they cut their security vendor count from 80 to 12 over three years and saved about $4 million annually in licensing and operational costs. That's a compelling argument when the board asks about ROI. Luna: But those savings have to be weighed against the risk of being locked into a platform that may not innovate as fast as a specialist. How do you stay nimble? Lucas: That's the challenge. Some platforms have open APIs and marketplaces—CrowdStrike's store, for example—so you can plug in third-party innovations. Others are more closed. The smartest CISOs negotiate contractual exit clauses and demand data portability. If you can take your detection rules and logs with you, you're less trapped. Luna: So it's about building optionality even as you consolidate. You're not just reducing vendor count; you're designing a stack that can evolve. Lucas: Exactly. And the best time to design that flexibility is during the procurement process, not after you've already migrated all your data. Luna: Speaking of procurement and cost—this episode feels like it's worth a coffee for anyone managing a security budget. Lucas: Yeah, if you got some practical insight out of that analysis, you can support the show at buy me a coffee dot com slash fexingo. It's a one-time thing, zero pressure, but it helps us keep the podcast ad-free and focused on the stuff that actually matters. Luna: And it's exactly the kind of conversation we try to have every week—practical, no hype, just what works. Lucas: Right. So back to consolidation: there's also a cultural shift happening. Security teams used to pride themselves on having the newest, shiniest tools. Now the badge of honor is a lean, well-integrated stack that actually gets used. Luna: So the CISO of the future is less a tool collector and more a systems integrator. Lucas: Exactly. And that requires a different skill set—not just knowing which vendor has the best detection rate, but understanding data architecture, API design, and vendor management. The role is becoming as much about operations as it is about security. Luna: Which kind of makes sense. Because if your operations are messy, your security will be too. Lucas: Absolutely. And one final data point: Forrester recently found that companies with fewer than 20 security tools had a 40% lower chance of experiencing a material breach compared to those with more than 50. So the numbers back up the intuition. Luna: That's a pretty powerful stat. It's not just about saving money—it's about actually being more secure. Lucas: Right. And that's the core message for any team rethinking their stack: consolidation isn't just a cost-cutting exercise. It's a security strategy.