Managing Security Vendor Sprawl

Cybersecurity continues to be an area of focus for organizations of all sizes. This is a direct consequence of the ever-expanding threat landscape combined with the increasing dependence we have on technology in our daily lives. As a result, cybersecurity expenditure is increasing. Unlike some other technology areas, the number of security vendors and tools a typical organization needs is also increasing. In fact it is not unusual for many companies to be using between 60 and 75 security tools. These tools are usually delivered by numerous vendors. This vendor sprawl is creating problems in the management of security and is leaving businesses exposed. This sprawl is almost unique to the security space. What is causing it? What problems does it create? How can organizations address the problem?

Cybersecurity: A Market of Massive Opportunity

One of the unique characteristics of the security vendor landscape is the sheer number of vendors. One of the primary causes of this is the sheer size of the opportunity. Cybersecurity is a huge market and attracts a lot of interest from startups. Estimates of market size vary. The security market has been valued at as much as USD 172.32 billion in 2023, and could grow to over USD 400 billion by 2030.

Dependence on trust means that adoption cycles are often slow, making it impossible for a single vendor to easily dominate all segments of the market. For instance, Microsoft, which is the single largest player in the security market holds just under 10% market share. At the same time, Israel is injecting a huge number of startups into an already fragmented market. Unit 8200 of the Israeli Defense Forces, which specializes in signals intelligence, has become a veritable breeding ground of security startups through the high number of tech-savvy entrepreneurs it churns out. In fact, Unit 8200 has been responsible for making Israel the country with the largest number of tech startups per capita, with a significant number of these being in cybersecurity.

New Threats Mean New Controls

As the threat landscape continuously evolves, new classes of threats emerge. This means that organizations have to adopt new tools to provide new classes of controls that address new threats. Because of the way the market has developed, we often see that a new vendor or new product needs to be adopted to deal with a new class of threat. Existing vendors often continue to focus on their area of expertise, while startups focus on combating new threats. We can see this in the evolution of security tooling and controls. Antivirus was one of the earliest areas that spawned the development of specialist startups. As increasing use of the Internet gave rise to the need for firewalls a new group of vendors emerged. After that, the need developed to detect threats, bringing us tools such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), developed by yet another cohort of new startups. While many startups have been acquired over time by larger, more established players, the cycle of startup creation has been repeated to deal with threats in new technology areas, such as email, cloud, and identity. This proliferation of controls has in turn created a need for yet new classes of controls to manage that very proliferation! Arguably, the drive to try to integrate different classes of security controls started with Security Information and Event Management (SIEM), which started by bringing all security logs and alerts into one location for analysis. That trend has evolved further, as Extended Detection and Response (XDR) now provides an umbrella of threat detection and response across all other controls.

Challenges Created by Sprawl

The continuous emergence of new security vendors creates problems for organizations of all sizes:

• Gaps in capability: The fact that organizations need to continually adopt new security tools (and vendors) means that they struggle to develop complete coverage. It becomes almost impossible to build a suite of tools that completely addresses all possible threats.
• Friction between tools: Different vendors work differently and develop tools in different ways. This sometimes means that tools conflict with each other when you try to install them in the same environment, or on the same endpoint.
• Swivel-chair management: Each tool usually has its own management interface. As a result, administrators need to “swivel” from tool to tool, easily becoming confused or losing track of what they were doing.
• Alert fatigue: Each security tool generates its own stream of alerts. One event can often result in multiple tools generating alerts. Without the ability to correlate events that are related to each other administrators quickly become fatigued by the volume of alerts.

These challenges are exacerbated by the fact that business applications also need to provide security functionality, even if it is just for functions like access control and user identity. As a result, they also create their own streams of security alerts.

These challenges are not unique to large organizations. Even SMBs find themselves in a position where they need multiple security products, and they almost certainly cannot source these from a single vendor. This is true of even the most basic set of security applications such as endpoint protection (for example Antivirus and Endpoint Detection and Response), Next Generation Firewalls, email security and VPNs. They also find themselves needing multiple, often cloud-delivered, business applications. Each of these generates its own stream of security alerts.

Solving the Sprawl

While the concept of consolidation seems appealing, it’s unlikely that anyone will achieve the feat of narrowing down to a single security vendor. Even if we can achieve some level of consolidation, as new threat classes emerge, we will be forced to add new tools and vendors, reigniting the sprawl again. This means that we need to take a different approach, accepting that we cannot eliminate vendor sprawl. We need a way to work with multiple point tools and introduce a way of making sense of all the alerting noise and filling the gaps. This is exactly what XDR does, by correlating across multiple sources of events, and performing advanced analytics, using technologies such as machine learning to provide a single, prioritized view.

Samurai XDR brings you the capability to correlate security alerting across all your infrastructure and applications, both on-premises and in the cloud, providing you with a single pane of glass for all your security alerting and investigations. Samurai XDR adds a unique advantage with its threat intelligence, gathered from NTT’s Tier 1 Internet backbone, with more than 40% Internet coverage. The ability to monitor at this level makes it possible to detect new threat activity early. This makes it possible for you to find the proverbial “needle in the haystack” by leveraging techniques such as Boost Scoring to sift through multiple weak signals and detect threats before they are able to do damage.

To see how Samurai XDR can help you to gain visibility, across all your security vendors, in a single pane of glass, claim your 30 Day Free Trial now!