Reduce cyber risk and complexity with security vendor consolidation
The cybersecurity landscape is complex.
Initially, organizations approached cyber with a scattergun approach, buying and deploying a variety of best-of-breed solutions, which were implemented by numerous vendors. Most deployments ended up as either shelfware or as incomplete deployments. It was similar to the Wild West.
Today, the landscape has evolved. Enterprises are moving towards a cloud first approach, with cloud-native applications, built to run in cloud environments. This has led to a significant paradigm shift.
By 2025, Gartner predicts that 70% of organizations will consolidate the number of vendors securing the lifecycle of cloud-native applications to a maximum of three vendors.
This trend isn’t limited to the cloud and in 2022, the research analyst firm found that 75% of organizations pursued security vendor consolidation, up from 29% in 2020. Improving cyber risk posture was identified as the number one factor by 65% in this stark shift in strategy.
On top of this, Prashant Mascarenhas, Vice President - Cybersecurity & GRC Services at HCLTech, speaking at RSA conference, says that the talent shortage is a key reason for security vendor consolidation.
“In the cybersecurity industry, cyber skills are at a premium. With multiple vendors in an enterprise environment, there are risks around a lack of skills, the lack of the right kind of talent and the potential loss of knowledge. When the talent moves, there is implicit knowledge that moves along with the talent, which creates risks for the enterprise.”
The talent challenge
A multi-vendor environment typically blends into a situation where organizations either have a contingent workforce who are brought in to do point-in-time projects or multiple vendors sourcing talent from different places. This creates several risks around loss of knowledge and a lack of service continuity and quality.
“If you lose a resource who was managing critical infrastructure then that environment is now not supported anymore,” says Mascarenhas.
He adds: “The inevitable churn of talent also creates a problem. There's always a risk of malicious behavior creeping in. The insider threat, intentional or not, has always been cited as a very large risk to the enterprise. If there isn’t the right set of controls for the talent that’s coming in, the insider risk grows.”
In addition, multiple different vendors in the environment will have overlapping responsibilities. This could impact an enterprises’ security posture, leading to gaps in enterprise resiliency and potential security incidents.
Seamlessly consolidating vendors
Leading a vendor consolidation requires a collaborative effort between cybersecurity line leaders and IT executives, who have vendor management experience.
According to Mascarenhas, the first step to seamlessly consolidating security vendors is to view the strategy from a long-term business case standpoint.
Any vendor consolidation strategy must span over not just risk mitigation, but cost, service continuity and service improvement.
The second element to consider is talent. “During a vendor consolidation, there is the potential to lose some good talent. It’s important that talent gets handled in the right manner so they can transfer the tribal knowledge and contextual understanding they’ve gained on the environment,” he says.
Another aspect in any consolidation exercise is the importance of change management.
“It’s something that is often overlooked, but it’s important as there are multiple dimensions of organizational change management that need to be handled through the entire consolidation exercise, starting right at the inception planning stage,” adds Mascarenhas.
Finding the right partner who will invest in the long-term success of the relationship is the final and crucial factor for a seamless vendor consolidation.
When considering a partner, Mascarenhas advises organizations look at their approach to talent creation and scaling perspective, what levers they can apply from a human effort production perspective with technologies like automation and how they can invest in proactively cannibalizing services revenue, while still improving the outcomes that are being delivered.
"On this journey, organizations will need a true end-to-end partner who's aligned to the business and security outcomes that the enterprise wants to drive, while investing in building the right skill pool to support the medium to long-term initiatives,” he says.
You can read the original blog here
Upcoming Cyber Security events
Cyber Security updates
Sign-up to get the latest updates and opportunities from our Cyber Security programme.
Authors
Nick Ismail
Nick Ismail is the Global Head of Brand Journalism at HCLTech. He is responsible for delivering the editorial and content strategy. He previously spent 6 years leading the content for Information Age, a B2B technology publication headquartered in London.
