Don't Cut Corners With Digital Transformation—cut Vendor Excess

Many companies establish their digital transformation by integrating multiple products from different vendors. However, as is often the case, this integration can involve cutting corners.

When you cut corners in digital transformation, dysfunction often follows. You can cut the corners of a puzzle piece to force a fit, but it won't result in a cohesive or well-connected picture. A jigsaw of poorly connected or non-communicating technology will not yield your desired results.

Successful transformations are born out of unified, seamless technology integration. When enterprise infrastructure components work in isolation, their value and effectiveness can be stifled and diminished. Data can slip through the cracks of disparate security products, creating visibility and security gaps as well as the misalignment of different telemetry data, processes and alerts. This can result in costly errors, visibility blindness, mitigation delays and complexity.

Instead, what should be "cut" are vendor excess and product sprawl that lead to complicated and wasteful management.

Consolidating, Integrating And Streamlining

A well-crafted patchwork quilt, while functionally beautiful, can be vulnerable to damage due to the numerous pieces and seams. Over time, it can begin to separate and fray.

While assembling a cobble of security products together as needs emerged may have fit the purpose and budget at the time, the vulnerabilities and escalating complexity for security teams can become overwhelming. Additionally, a shortage of skilled technical staff to manage all of the products and act upon the different data and alerts they create can lead to your security fabric coming apart at the seams.

According to a Gartner Inc. survey, increasing technology sprawl and elevation in the threat landscape are leading companies to recognize the need for greater vendor consolidation. Organizations actively pursuing consolidation jumped from 29% in 2020 to an estimated 75% in 2022. Gartner found that while reduced spending on licensing and other budgetary factors are considerations in consolidation efforts, most organizations aim to reduce complexity and improve the overall risk posture.

The Process Of Consolidation

The transition to a more consolidated security stack is not a quick leap but a well-strategized and carefully evaluated process. Organizations may need years to carry out an effective consolidation, keeping in mind when vendor licenses, support contracts and other commitments reach expiration.

Time is of the essence, but due diligence and research are also vitally important. A detailed consolidation plan is necessary in order to make the right decisions about what infrastructure to eliminate and what to keep. Many security leaders are turning to extended detection and response (XDR) as a first step in their consolidation efforts. According to the Gartner survey, 57% of organizations believe they have resolved security threats faster after implementing XDR.

XDR consolidates multiple products and data to provide greater visibility, deeper analysis and faster response across endpoints, applications, workloads and networks. XDR takes the single-layer solution of endpoint detection and response (EDR) to the next level by scanning the entire threat landscape, which enables centralized management of diverse locations across the enterprise network.

The Benefits Of Successful Technology Consolidation

• Reduce ongoing vendor management and product maintenance costs.

• Reduce security risk.

• Simplify security operations for better decision-making and faster time-to-remediation.

• Reduce the need to hire specialized talent to manage product sprawl complexity.

• Optimize resources with more capabilities while minimizing vendor and function overlap.

• Reduce time spent patching and updating multiple products and effort sifting through separate telemetry data and alerts.

Preparing For A Vendor Consolidation Transition

In addition to initial costs and ongoing expenses to maintain and support a single vendor with multiple natively integrated products, assess the total cost of ownership over a multiyear period. Before consolidating any solution that encompasses multiple product categories, it's important to determine your goals for each functional capability.

Vendor consolidation execution must ensure the solution delivers the needed results while minimizing potential problems. Successful consolidation requires defined goals and evaluation criteria for the technology and the vendor. Communication and collaboration with all stakeholders are critical, as is ongoing communication with the vendor.

How To Ensure The Consolidation Process Is Successful

• Define the criteria for success. Documenting the business requirements and priorities of the various stakeholders helps ensure their priorities are met. For example, privileged access management (PAM) will impact departments outside of IT (such as HR), while endpoint security will impact all users. Whatever the priorities, each stakeholder needs to have its requirements included in the vendor decision.

• Compare vendor solutions. When choosing a vendor that consolidates multiple products, it helps to conduct an analysis of each vendor's capabilities, strengths and weaknesses, and any overlap with existing products you plan on keeping. An additional consideration should be the vendor's support for on-premises, cloud and hybrid environments to protect expanding attack paths. It helps to have an inventory of existing products as well as their capabilities, strengths and weaknesses.

• Prioritize functional capabilities. When you have selected the vendor to consolidate around, it's important to prioritize each product deployment based on your immediate security needs and risk assessment. Identify and classify your business-critical assets based on risk, impact and cost. Determine the possible vulnerabilities that could threaten those assets and the potential impact on the enterprise. The risk impacts may be operational, financial, regulatory, partner-related and customer-related.

Each type of asset is critical and must be correlated with cybersecurity product protections. There are many variables that will go into the prioritization process, such as the timing of existing licensing contracts you may have with vendor products you are going to remove.

An organization's journey toward successful digital transformation should be a thoughtful process that doesn't rashly cut corners to focus only on cost savings. From a vulnerable quilt of many pieces, it should lead to a seamless security blanket of robust protection—creating a consolidated, cohesive infrastructure fabric.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?