This is the third in a series from TMG talking about security stack consolidation. We have been exploring the topic of security stack consolidation. Our first post explained what the debate about security stack vendor consolidation is all about. Our second focused on the pros and cons of consolidation. Today we are going to discuss the case for security stack vendor consolidation.
If you were to set up a bingo card with phrases you’ll hear from vendors during security tool sales pitches these days, “single pane of glass” would probably appear next to “AI-powered” and “intelligence-driven”, and would likely sit right under “next-gen.” This isn’t to say these marketing and sales teams are lying. They’re much, much more likely to be telling the truth. However, they are only telling the truth about their product.
Gartner recently published research that, on average, organizations work with 10-15 vendors and manage 60-70 security tools. Of course, many of these tools don’t require hands-on, active management every day and can run more or less in the background. However, I suspect there is a near 100% chance each of those 10-15 vendors promised a single pane of glass, not considering the other 9-14 other “single panes” security teams are tasked with managing. Consolidated stacks (should) have the innate advantage of actually reducing the panes of glass security teams are looking at, since the tools are natively integrated.
One of the long-standing idioms in security is that “complexity is the enemy of security.” And with every additional vendor comes inherent complexity, such as:
· Integrating the tools to talk to each other correctly (and fixing the issues when they stop)
· Maintaining updates and patches
· De-duplicating and triaging
· Alerts from multiple vendors
· Maintaining identities and access to these systems
Many organizations are finding the risks of adding these complexities far outweigh the (often negligible) benefits of a competitor’s tool. When consolidating security stacks, the difficulty of all these tasks inherently goes down.
How the CrowdStrike Outage Affects the Consolidation Debate
As the now-infamous “CrowdStrike outage” in July 2024 showed us, large market share in a single place can lead to even larger failures when something goes wrong. We saw this globally as we watched as some of the world’s largest industries ground to a sudden halt.
Consolidating security stacks means buying into one of the largest players such as Microsoft or Google in the market who can produce and support enough tools that can protect companies’ data. It’s also important to remember a few things about that incident:
1. The CrowdStrike outage wasn’t caused or exacerbated by consolidated security stacks. Microsoft machines all went down that day due to updates from a non-consolidated stack tool (i.e., CrowdStrike’s Falcon EDR) that were not tested properly.
2. These types of failures can – and probably will – happen to all vendors of all sizes. Whether they’re bugs, updates, attacks, or anything else, you cannot assume any vendor – no matter what promises their sales team make – will never have something go wrong that could affect your business.
When we think about these two facts together, the questions about consolidation change from, “What happens if my consolidated stack’s vendor has an issue and everything goes down?” to:
· What is their testing process like?
· What happens if the vendor has an issue?
· Do they have the resources and capacity to pull to fix it quickly?
· Will other integrations also fail because the tools don’t natively integrate?
· Will they communicate effectively with me and other necessary connected parties when something goes wrong?” (CrowdStrike answered this one with a resounding “No.”)
While very few companies operate with extra capacity these days, we cannot assume that amassing a multitude of vendors will protect you from a single point of failure. And sometimes many of those questions will lead to answers that actually favor vendor consolidation due to native integrations, testing, and resources to put into large scale problems. Of course, this requires the customers to hold companies accountable for quality services and products. This can make you feel powerless when facing massive tech behemoths.
Administrative Benefits of Security Stack Consolidation
Vendor consolidation allows for administrative benefits, both from cost and efficiency standpoints. Single vendors can bundle their packages for savings on the tools, which can allow for extra budgetary room for security teams to fill the final 10-20% their consolidated stack is missing. And while contract renewals are never “easy,” reducing the number of them each year can also be a boon to leadership and budgetary planning teams.
These administrative benefits also apply to personnel issues. One of the most daunting issues in the cybersecurity industry right now is that of a massive talent shortage. The World Economic Forum recently estimated that by 2030, we will face a talent gap of 85 million cybersecurity workers in its recent Strategic Cybersecurity Talent Framework white paper. This shortage poses many problems for organizations, service providers such as MSPs, and vendors all looking to secure their environments, such as:
· Rising salaries of talented cybersecurity professionals
· Difficulty attracting talent
· Difficulty retaining talent due to the sheer number of job openings
· Employee burnout
· Loss of historical knowledge and gaps in knowledge transfers
· Time lost due to onboarding and training
Many organizations are moving toward MSPs to minimize these effects and to ensure appropriate coverage. But whether the security teams are internal or managed elsewhere, vendor consolidation works in organizations’ favor. This is because they are more likely to be familiar with managing these larger players’ solutions, and the onboarding and training time is reduced significantly. This also makes finding talent in a tough candidate pool that much easier, when experience with these solutions is likely a requirement.
Tips for Successful Security Stack Vendor Consolidation
Of course, one of the criticisms of security stack consolidation is the idea of putting your eggs into one basket. (And this is certainly what you’ll hear from the vendors whose businesses depend on non-consolidated security stacks.) To be clear: this is a valid criticism and one that needs to be accounted for if moving toward a consolidated stack.
1. Assess, plan, repeat. Assess your environment and security stack, vendors, integrations, etc. Gain a good understanding of where the security teams are struggling. If moving into a consolidated stack would potentially alleviate some of those issues more than introduce new ones.
2. Align with business objectives. Operational efficiencies, budgets, and performance should all tie into these conversations and plans.
3. Ask hard questions of your potential single vendor in the sales and renewal process. How do the native integrations improve processes? What process improvements and integrations will my team benefit from directly? Scour service-level agreements to understand them.
4. Know you may still have to supplement. The large tech companies have finally started investing in their native tools so they are truly competitive with other vendors (Microsoft Defender and Sentinel are two that come to mind, as examples). Just know there will still be coverage gaps. For instance, protecting SaaS applications, their connections, and data requirements – which is where almost all modern business is now being conducted – is still an area where the major security players are falling behind. The large vendor will probably cover 80-90% of your security needs with native integrations and a singular ecosystem. You should also understand what that last 10-20% is for your business.
Vendor consolidation is a complex consideration and undertaking, from concept to assessment to planning to selection to implementation. When the options are this vast and complex – and your team and team members are stretched thin – these types of projects can lead to extra expenses at best, and disastrous implementations and lowered security postures at worst. At TMG, our Technology Acquisition Partners live and breathe this world. We can help you make the best decisions for your business. If you’re considering consolidating – or deconsolidating! – we can help you find solutions that fit.









