Too many 'point'less tools: Platformization is better

One of the most frequent complaints I hear from CISOs and enterprise cybersecurity practitioners is, "We have too many tools."

According to research from Informa TechTarget's Enterprise Strategy Group, 37% of organizations use more than 26 products to secure their environment, and 10% use more than 51 products. How does that even remotely scale? And what resources does a company require to get any value from that many tools?

Last year saw significant debate in cybersecurity circles about platformization. Some vendors went all in on this strategy and are pulling multiple markets and point technologies to build the ultimate "one ring to rule them" platform, while other vendors are sticking to their guns and describing their point product as a "better mouse trap" that helps catch nasty rodents better than a bloated platform.

What's interesting is that many of the security practitioners who complain about too many tools tell me that platformization is a horrible idea that will result in one product with only a moderate ability to provide value.

When Enterprise Strategy Group asked organizations the most beneficial action for improving security efficacy and operational efficiency, only 19% answered "consolidating security tools."

Listen up, security teams: You can't have it both ways. You can't keep purchasing niche security technologies to improve the mouse trap -- as we have for the last 25-plus years -- while asking for fewer technologies and broader platforms. These two requests are at odds with each other.

So, which is it? Do you want innovative niche products that move the security needle from 92% to 95% detection rate, or do you want a platform that uses value from multiple adjacent markets to create a more holistic view into actually solving problems?

Many of us have been trained to ask for better detection and improved ability to find malicious actors that it has become a useless mantra. Not only that but the products in the market today are good at detecting bad actors. Why do we insist on focusing our efforts on such a minute amount of security improvement when UX, better prioritization, automation of fixes and efficient value are so much more important?

It's no longer about finding malicious actors in new and novel ways. It's about eliminating the overhead that eats up resources and time, and prevents us from using our current capabilities to their fullest extent. It's about being more efficient with what we already have, not about the next shiny new product. It's about decreasing overhead and requiring significant value from every product we have already purchased or intend to buy.