Adding Too Many Security Tools is a Big Mistake

More Tools Can Mean Less Security for More Money

---

It seems like there’s a new cyberattack making headlines every day – and a new “must-have” security solution to counteract that threat. With such a flood of tools, it can be easy to waste money and time on supposed solutions that don’t actually solve any of the potential security problems that threaten your business. Plus, a wealth of solutions can also be a wealth of opportunity for cybercriminals to exploit. Instead, concentrating on purchasing the right solutions is the smart decision to increase your company’s security without increasing your IT staff’s stress or your budget. 

---

---

More Tools Does Not Mean More Security

---

With the constant shifts in security technology and a volatile threat landscape, companies have to constantly ask themselves whether or not they have the security solutions that they need to maintain a high cyber resilience in order to really keep their business safe from cybercrime. That can lead to throwing money at the problem by buying additional security tools to prevent disasters like a data breach. But while it may seem like a good idea, adding more security tools does not add additional protection against cyberattack threats. Experts estimate that many enterprises maintain 19 different security tools, with only 22% of such tools serving as vital to primary security objectives. Almost half of the security tools that are available to IT teams are just clutter. Only about 47% of existing IT security tools are actually used daily. 

The fact that companies are buying solutions that they don’t need while still facing increasing threats from devastating cyberattacks like ransomware is a source of frustration for IT decision makers. Constantly researching, training and facilitating integration son the next big thing also sucks up time that security professionals need for doing their actual job.  More than 70% of security decision makers believe the increasing amount of time they spend managing tools inhibits their ability to effectively defend against threats . IT decision makers also understand that buying too many new tools is a waste of money. In this study of more than 1,000 security professionals,  85% of them were concerned that their companies are adding technologies faster than they can productively use them, with 71% admitting most existing tools are underutilized

---

---

ROI and Value Can Be Murky from Differing Perspectives

---

Security leaders are also answerable for budgets, and it can be a challenge to measure ROI on tools as well as explain why using a solution was discontinued in favor of choosing a new one. Even security executives and the folks on the ground can disagree on that issue. A study showed the dichotomy. For example, 57% of C-security leaders surveyed believed that their department deactivated old tools because they found a better option. However, 52% of other security executives said the same tool was deactivated because it was not providing proper return on investment, compared to only 20% of security operations professionals. Additionally, one in three (35%) executives felt the reason for replacement was due to lack of in-house expertise, compared to 13% of the operations team. 

In fact, security leaders at most enterprises find that it’s a constant struggle to measure ROI for security tools. In the same study, researchers found out that companies most often measure their investments using three metrics: the number of critical vulnerabilities identified (52%), tool functionality (49%), and the percentage increase in visibility (48%). Only 29% of respondents said they measure the level of visibility contributed by tools across the environment, and only 33% look at how fast they can detect and respond to threats.

Security leaders at the executive or C-suite level also view investment and direction differently than those charged with execution. People at the highest levels, like CISOs and Vice Presidents, tend to have their eye on strategic business goals and ROI. In contrast, security directors and their staff spend their time dealing with day-to-day security concerns like putting out fires, managing patches and endlessly analyzing reports from their abundance of tools to identify threats. Overall, 63% of security operational managers don’t think the board understands their priorities in the context of the value of new security technologies, versus only 41% of upper management. 

---

---

Alert Fatigue is a Hazard

---

Alert fatigue can also represent a real security hazard. IT staffers are treated to a cacophony of beeps, blips and “helpful reminders” every day. Eventually, they all become background noise. The alerting features of many solutions are such a constant annoyance for security teams that they don’t hear them or turn them off, creating additional danger. Over 45% of respondents in a survey about IT team burnout noted that they regularly turn off high volume alerting features when they are just too busy or there are too many alerts for analysts to process. That’s extremely dangerous because turning off, ignoring or muting alerts means that a true emergency may be missed.   

False positives also complicate staffers’ lives, and that can bring danger too. Nearly 70% of respondents in the same survey said that 25% to 75% of the alerts they investigate on a daily basis are false positives, with 15% reporting that more than half of their security alerts are false positives. Those phantom problems cost companies a fortune every year. An in-depth study showed that a security analyst can spend as much as 25% of their time is spent chasing false positives — of every payroll hour you’re paying for, they’re wasting 15 minutes on false positives. The typical organization wastes an estimated 300 hours per week or more just wading through on false positives. That’s way too much money for the trouble even if it’s essential to be cautious about the possibility of a cyberattack. 

Every IT team is overworked and overstressed these days, especially with the challenges that they’ve had to face in the last two years. Add in the complications that companies face from a seemingly never-ending IT skills shortage, and you’ve got a recipe for disaster. A big factor in the elevated stress level that IT teams have to deal with is an overwhelming number of alerts. Almost half of the respondents in the study reported personally investigating 10 to 20 alerts each day, a 12% increase from 2019. An overworked 25% of respondents said they investigate 21 to 40 alerts each day, up from 14% the year prior, and 66% of survey takers reported seeing an increase in alerts since mid-March of 2020. 

---

---

 How Can You Be Sure That You Really Need a New Security Solution

---

New technology is always popping up with appealing features and innovation that may make you think that it’s something your company needs right away. Checking to see if it meets these criteria can help you save time, money and headaches. 

Is it a compliance requirement now or in the immediate future? 

Compliance standards are constantly in flux, so you may truly need a new solution to keep up. It also pays to have a look at what may be in the pipeline for compliance rules in your industry to make sure that you’re ready. New US federal compliance standards for contractors emphasize zero-trust security in their requirements, placing multifactor authentication high on the tool shopping list for government contractors. 

Does it actually add security? 

Take the time to study not just what the solution does and how it performs, but how those features will benefit your organization specifically. A solution may be wonderful, but it still might not be right for you if it doesn’t protect your organization from the real threats it faces daily. 

Will it suck up too many resources? 

Compatibility and ease of integration has to be high on your shopping list. If spending a lot of money on a new solution also means spending a lot of money on payroll hours to deploy it, integrate it, fix flaws, apply patches and train your techs to use it without a major improvement in security, it’s probably not a good idea. 

Is it more trouble than it’s worth? 

If you’re even asking this question, you probably already know the answer. If it truly seems to be a mystery, really look at the concrete positives and negatives of using this new tool for your security, your business and your staff. Make an old-fashioned list of positives and negatives for each category and follow the conclusion that the results show you no matter how tempting it is to buy a new tool. 

What does my staff think about it? 

Executives and business owners can have very different perspectives from the people who are in the trenches every day. Consult your team about a new solution and get their take on it. They may notice functions or aspects of it that you won’t – and they’ll be more likely to make use of a tool that they’re actually excited about. 

---

---

Choose Solutions That Offer More Value

---

The ID Agent digital risk protection platform features smart solutions that are packed with functionality and value, as these businesses discovered. We’re constantly innovating to create the perfect tools to keep your business a step ahead of cybercriminals while improving your IT team’s quality of life. 

• Passly includes an array of identity and access management tools with robust functionality. Essentials like multifactor authentication and single sign-on make give you the operfect springboard for zero-trust security, while automated password resets will make everyone’s life easier. 
• Dark Web ID  gives you 24/7/365 always-on monitoriing of your business credentials, alerting you immediately if one appears on the dark web. This also prevents malicious inisdres from selling their access in the booming cybercrime-as-a-service economy. Plus, automated reporting means that your team doesn’t need to stare at a dashboard.
• BullPhish ID improves everyone’s phishing resistance and boosts security awareness. Recruit all of youremployees to the security team with lessons about compliance, ransomware, credential compromise and more that can be quickly customized and automated to make training a breeze.
• See them in action in these short demonstration videos: https://www.idagent.com/learn-more 

The ID Agent digital risk protection platform has the strong solutions that every business needs to protect their systems and data from today’s biggest threats. Contact our solutions experts today to learn how your business can benefit and receive a free, personalized demonstration.

---

---

---

---