This is the final installment in our series about security stack consolidation from TMG. We have been exploring the topic of security stack consolidation. Our first post explained what the debate about security stack vendor consolidation is all about. While our second focused on the pros and cons of consolidation. Our third discussed the case for security stack consolidation. Today we are going to summarize the prior posts to round out this security stack consolidation deep dive series.
Understanding the Security Vendor Landscape
Just as consumers moved from cable bundles to individual streaming services and are now seeing a return to bundled offerings, security teams have experienced a similar journey. Going from one single security vendor to multiple – often smaller and/or startup – vendors for each tool, and now going back to the bigger players such as Microsoft for their security stacks. Recently Palo Alto released their commitment to “platformization”, i.e., security vendor consolidation. They tout a Gartner statistic that states “75% of organizations are pursuing security vendor consolidation, compared to only 29% in 2020.” (At TMG we have seen this to be true!)
Frustrated by red tape, slow responses, and a perceived lack of rapid innovation against threat actors, many organizations moved away from large, bundled security solutions. Orgs now favor of best-of-breed tools from various vendors. Gartner recently published research that organizations work with 10-15 vendors and manage 60-70 security tools on average. However, many are now reconsidering consolidation due to challenges such as:
· Tools struggling to integrate and communicate effectively
· Overwhelming and redundant alerts
· Difficulty managing multiple user interfaces
· Maintaining patching and updates with potential tool integration disruptions
· Uncertainty from vendor acquisitions
· Multiple bills and contract renewal
We’re currently at another crossroads in cybersecurity where many organizations’ security teams operate under strict budgets and low headcounts. This makes bundled packages from large vendors appealing. This is especially bolstered by those vendors’ tools and products ranking among best available now, not just more convenient – yet not “best” – options. However, companies are rightly worried about the idea of putting all your security eggs in one basket.
Many organizations are considering whether a single platform that can cover 80-90% of their security needs without the drawbacks of a more widely varied security stack. Let’s take a closer look at the pros of security vendor consolidation and some of the cons. Then what your organization needs to do before security projects, whether they be a complete forklift or adding to an already crowded stack.
Benefits of Security Stack Vendor Consolidation
While perfect security conditions might allow for a carefully curated stack of best-in-class tools, reality often falls short of this ideal. Consolidation offers several compelling advantages:
· Improved Integration and Visibility: Consolidated stacks (should) provide seamless data flow between tools and unified dashboards. This reduces the number of “panes of glass” security teams must manage. This visibility can be vital during disaster response as well, since the response teams don’t have to collect logs and information to then aggregate and get a full picture of the problem.
· Simplified Management: With fewer vendors, administrative overhead often decreases. Important tasks such as updates and patch management become more streamlined. This is a critical vulnerability, as noted by Verizon’s most recent annual Data Breach Investigations Report (DBIR) when they found 14% of breaches last year were caused by this exact issue, showing the importance of removing friction whenever possible in the patching process since these numbers are only continuing to rise. We know that “most” organizations do not allow for the cost of administration of such a project and/or work expectation. However, the IT decision makers we work with take this into consideration prior to any decision.
· Cost Efficiency: Bundled solutions often come with better pricing and organizations can potentially reduce training and staffing costs.
· Widened Security Staff Talent Pool: Exactly because of the fact these major vendors’ platforms are widely used and adopted, that means that many security professionals also have direct experience with them, which makes staffing much easier. With limited budgets, finding security employees can be challenging. Especially if the position requires experience with most of 10-15 niche and/or smaller security vendors. However, most mid-career security – and often entry-level to some degree – will have had at least some experience with most of the bigger players’ tools and protocols.
· Enhanced Response: When you need to investigate a threat or a breach, every second can matter. Aggregating reports from multiple panes of glass and/or tools in order to hunt down a threat is time your response is delayed. Consolidated security stacks don’t suffer from this problem nearly as much.
Security Stack Consolidation Concerns
The primary argument against consolidation is the “all eggs in one basket” concern, noting that a significant breach in that vendor would mean a large, single node of failure for the company. The CrowdStrike outage in July 2024 highlighted potential risks of relying heavily on a single vendor. However, it’s crucial to remember that:
1. The outage wasn’t caused by consolidated stacks but by a non-consolidated tool. In addition to this, many of the “consolidated stack” organizations utilize multiple non-consolidated tools.
2. All vendors, regardless of size, can experience issues.
The key is to ask tough questions about testing processes, issue resolution capabilities, and communication protocols when considering either a consolidated or less consolidated approach.
· Note: There has been a rush from suppliers to make rather “bold” statements such as, “Companies should consider diversification in areas like XDR.” For example, we heard one industry leader go so to such lengths to avoid putting all his eggs in one basket he suggested implementing three (3!) different endpoint products. They suggested segmenting their base as an example: servers, user endpoints and OT. This means that if an issue is not a technology failure rather a process failure – say, testing prior to release – then the company with 3 endpoint solutions would never be able to know when or if any of those segments will fail.
At TMG we feel statements and suggestions like this are preposterous and potentially dangerous to companies trying to implement secure postures while also able to manage the solutions. This is more trying to cover the “tyranny of the issue” rather than seeking a responsible resolution.
But those aren’t the only questions to ask. Others to ask about the solutions and/or consolidation are:
· As the company grows, do all the solutions scale as well?
· If a tool requires one full time employee to run successfully, how many will you need a little on down the road? (And how quickly will that happen?)
· How much time do they (or would they) spend on integrations between tools, and how much of that could be relieved?
· Will this reduce alert fatigue for your team?
· If you need to replace someone on the staff quickly, how long does onboarding take and how hard will it be to find someone with experience on that tool/toolset?
Ultimately the one question that is or should be always asked and answered is: Does this add value to the organization?
The answer must be YES, and with artifacts to support the yes! By doing this decision makers are supporting their intent and showing value to the business, generally almost always leading to an approval from leadership or boards.
Steps Toward Successful Consolidation
Whether you’re consolidating or not, these decisions require thoughtfulness in every step of the project to learn about your organization’s security needs both now and as you grow.
1. Assess your current environment, security stack, and pain points.
2. Align consolidation efforts with broader business objectives.
3. Thoroughly evaluate potential vendors, asking hard questions (see above).
4. Understand that you may still need to supplement a consolidated stack for complete coverage, but that getting you to 80-90-95% of what you need in a way that’s more functional means that “last mile” will be much easier to traverse.
Looking Ahead
We expect to see a move toward consolidation for many companies, as their complexities grow past their ability to secure them with disparate tools and integration headaches. And as major vendors are investing heavily in improving their native tools, they have succeeded in making them increasingly competitive with specialized solutions.
However, it’s important to remember that consolidation isn’t a one-size-fits-all solution. Each organization must weigh the benefits against potential drawbacks and make decisions based on their specific needs and risk tolerance. This is where partnering with Technology Acquisition Partners can come in from the start, and help you understand your needs and what solution(s) meet those needs best.
Whether you choose to consolidate or maintain a diverse vendor ecosystem, the key is making informed decisions that align with your organization’s security needs and business objectives. If you have questions about vendor consolidation or want to chat more, please contact us
TMG is available for a conversation, not a sales pitch, to dive into what you are looking for and ask questions to help challenge you to think differently. Remember what you do once every 3, 5 or 7 years, is what we live and do every day. We see what the industry is doing, we see strategies that work and those that fail, we see the trends, and we KNOW about the rapid pace and change that is occurring in technology.
One final question: How do you as a leader keep up with all the demands and areas of your day job, AND stay up to date on all suppliers that are entering into the industry? That is exactly what TMG provides for our clients. We help find solutions that work for them both now and as they scale.









