Why Consolidation Fails on Confidence: What Actually Unlocks It

EXECUTIVE SUMMARY

A Gartner® survey found that organizations "want to consolidate their security vendors to reduce complexity and improve risk posture, not to save on budget or to improve procurement."¹ But not every consolidation delivers that outcome. In our experience, when it falls short, the reason is often the same: teams remove tools that provided core capabilities the remaining platforms were missing. And all of a sudden, the overall tool stack is weaker.

This piece looks at

• the fundamental capability that most platforms may be missing, but that
• the leading vendors in the NDR, EDR, CTI and Email Security markets are investing in, and
• what we learned from our customers about how to make consolidation work, with one example from the Financial Services industry.

Everyone is consolidating. Not all of them are getting it right.

The pressure to consolidate is real and well documented. "A recent survey by Gartner, Inc. found that 75% of organizations are pursuing security vendor consolidation in 2022, up from 29% in 2020."¹

The interesting part is the reason. The same survey found that "Sixty-five percent of surveyed organizations expect to improve their overall risk posture, and only 29% of respondents expect reduced spending on licensing."¹ We read that as a signal: for most teams, consolidation is a maturity move rather than a budget exercise.

But intent is not outcome. Consolidation doesn't automatically improve risk posture. In some cases, it quietly weakens it.

Sit with that for a second: People set out to make their defenses simpler and more coherent, and some of them end up worse off than before. The usual explanation is execution. A messy migration, a gap in coverage, some capability quietly lost in the move. Sometimes that's exactly what happened. But there's a more uncomfortable reading, and any analyst who has lived through a consolidation already knows it.

The thing that gets removed is often not spare capacity at all. It was a core capability that the broader platform products had, but were not doing a good enough job at. It was a second set of eyes the team kept precisely because they were never fully certain the first set was right or sufficient.

The common ground between NDR, EDR, CTI and Email Security? A core capability you should not be missing out on.

Teams keep a stand-alone product with capabilities that are, in theory, covered by the large platforms they already work with. Not because the math says to, but because platforms alone never quite earned their trust, and two tools feel like protection against being wrong.

Look across the NDR, EDR, CTI and email security markets and a pattern emerges. The strongest vendors in each invest heavily in the same underlying capability: the ability to take a suspicious artifact — a file, a URL, a packet capture, a process execution — and produce a verdict accurate enough to drive automated action.

Call it the Deep Analysis and Enrichment Capability, or DAEC. It has four pillars:

• In-depth artifact analysis — static and dynamic examination of files, URLs, executables, network flows, and attachments to identify malicious behavior.
• Automated IOC extraction — pulling and normalizing indicators (IPs, domains, hashes, CVEs) from raw data at scale.
• Alert enrichment — mapping raw signals to MITRE ATT&CK TTPs, actor attribution, geolocation, and sector-specific risk.
• Data accuracy and fidelity — the false-positive rate that determines whether an automated block is safe to fire.

What our customers taught us about consolidation, security posture and risk

Your team usually already knows: Consolidation is necessary. But in some cases, it is driving up your risk.

Gartner® notes, "Cybersecurity and IT leaders anticipate cost savings and improved operational efficiency when adopting a broad portfolio of cybersecurity technologies from a single vendor. To maximize value and avoid costly mistakes, cybersecurity leaders must break down complex and expensive decisions into independent yet interconnected criteria."²

In our view, based on what we see with our customers, those criteria should include a mapping of the core capabilities a SOC team needs to maintain or improve security posture and keep risk under control.

Customer case study: an example of consolidation from the Financial Services sector

We watched this play out with a security team at a large financial services organization. A mature SOC, dedicated analysts, several thousand endpoints across multiple regions. They were running two overlapping investments doing related work, and they had a clear goal: lean fully into their Microsoft security estate, Defender and Sentinel, and stop paying for the second layer they'd kept alongside it.

On paper, the decision was easy. In practice, they couldn't make it. Not because the Microsoft stack wasn't capable, but because moving to it alone meant trusting its verdicts completely, and in a regulated industry, "probably fine" is not a place you can operate from. Blocking a legitimate business email carries a real cost. Missing a targeted threat carries a worse one. The second tool stayed in the budget because letting it go felt like pulling out the safety net before anyone had confirmed the net wasn't needed.

What changed the calculus wasn't a cheaper option. It was a different kind of look. They placed VMRay behind their Microsoft workflow as a verification layer. Dynamic analysis that detonates a suspicious sample and reports what it actually does, evasion-resistant enough that malware built to recognize a sandbox doesn't simply go quiet the moment it lands in one.

The capability that ended up mattering most wasn't catching threats, though it did that too. It was the trustworthy benign verdict. The ability to say, with no hedging, "this one is clean, close it." As the team's security leader put it, the real operational value was getting verdicts they could trust enough to act on immediately, cutting through the noise other tools generated and closing false alarms without second-guessing.

Once that confidence existed, the consolidation stopped being a gamble. They could rely on their Microsoft stack because they finally had a trustworthy second look of a different kind sitting behind it. The overlapping platform was no longer holding anything up, because the uncertainty it was covering for was gone. So they let it go.

The capability that was missing all along: enabling automation and team confidence

It's tempting to read that story as a story about products. Two overlapping tools, one removed, budget recovered. That's the version that fits on a slide, and it misses what actually happened.

The stack didn't have a product gap. It had a capability gap. When we looked across threat intelligence, email security, endpoint, and network detection and response, the same technical core kept surfacing as the thing that separated the strongest vendors from everyone else:

• the ability to analyze a suspicious artifact deeply,
• extract usable indicators from it,
• enrich them with real context, and
• produce a verdict accurate enough to act on.

Different buyers, different budget cycles, same engine underneath. We've come to call it the deep analysis and enrichment core.

The property of that core which matters most to anyone planning a consolidation is that it cannot be inherited. Breadth doesn't produce it. A platform that covers more surface area does not, by virtue of covering more surface, look any harder at the single suspicious attachment sitting in front of your analyst this morning. Coverage and depth are different purchases, and only one of them tells you what a thing actually does.

That's what the SOC in this story was missing, and it explains why the second platform never solved the problem. Verdicts arrived without the behavioral evidence to stand on. Context arrived late, or buried, or not at all. Adding another product built the same way duplicated the coverage they already had while leaving the depth exactly where it was.

It also explains why their automation had a ceiling. Every team pursuing consolidation is ultimately pursuing automation: faster playbooks, fewer manual touches, machines closing the alerts humans shouldn't have to read. That shift is only available to teams whose verdict quality is high enough to act on without a human double-checking, because in production a false positive doesn't just create alert fatigue, it blocks a customer's legitimate email. Analysis depth is what buys the right to automate.

Once the capability was present, the duplication had nothing left to justify it. The team gained the operational returns you'd expect: faster triage, quicker SOAR playbooks, fewer hours lost to false positives. They also stopped paying for a significant platform they no longer needed, which is a real number and a welcome one. But the number was a consequence. What they had actually acquired was the ability to know, and everything else followed from that.

That's the part the consolidation conversation usually misses. We frame it as a question of how many tools, how many vendors, how many panes of glass. Underneath, it was always a question of what your stack can establish with confidence. You don't simplify by removing things and hoping. You simplify by making sure the capability you actually needed is present, and then noticing how much of the rest was standing in for it.

The tools you can finally remove are the ones you were only keeping because you weren't sure. Give a team a reason to be sure, and the stack gets smaller on its own.