As Chief Executive Officer at IRONSCALES, Eyal Benishti pioneered a leading self-learning anti-phishing email security solution.
getty
With the pandemic entering its third year, the Federal Reserve raising interest rates and mass tech company layoffs, organizations have begun discussing a dreaded word: recession. With these developments, many companies are looking at ways to trim IT budgets, and I suggest they look at their cybersecurity infrastructure.
That may sound a little crazy, given the expanding attack surface and the rising tide of business email compromise (BEC), ransomware and other emerging threats. However, if you carefully examine many organizations’ security infrastructures, you may find outdated legacy systems, function overlap and point solutions sprawl that could be trimmed. The result may be lower investment costs and significant total cost of ownership (TCO) savings as well as better, not worse, protection.
In this article, I’ll offer four suggestions on where to look to start trimming.
Eliminate legacy systems.
Every solution in your security technology stack requires maintenance, upgrades and refreshes, which add to staff time, resources and dollars. Even cloud solutions require network bandwidth, back-end support and cloud expertise in a time of skills scarcity.
Look over your infrastructure for legacy security solutions whose functionality is covered by a newer next-generation tool and think carefully about eliminating them. For example, organizations with a heavy investment in Microsoft solutions, such as Office 365, may no longer need the endpoint antivirus and email filtering solutions they’ve relied on for years. If you’re among the companies who made the big transition to the cloud, you may find that many of the capabilities you have relied on third parties to cover in the past are now built into your existing cloud service. Also, look for licenses you are paying for that you no longer use.
Trim point solution sprawl.
In the past few years, organizations have invested in a lot of security point solutions to respond to new threats, hybrid work and an explosion of user devices, hoping to achieve the best of breed in every emerging security category.
The trouble with this strategy: In addition to the usual expertise, training, maintenance and expensive upgrades, point solutions rarely integrate well with each other or your other solutions, which means a lack of consistent policies and possible holes in your attack surface. Now is the time to think about abandoning the expensive, best-of-breed strategy by considering whether you can get rid of some of those point solutions.
Consolidate vendors.
As you look to eliminate point solutions, examine the solutions you have left and research those vendors, especially the major ones, to see if they offer the same capabilities. You may find that their solutions for the same function, while not “best of breed,” are capable and suited to your needs and risk profile.
You can see TCO savings by using an integrated suite of security tools. The main benefit comes from having a single vendor, which means a single invoice, a single person to complain to and a single pane of glass for maintenance, management and policy configuration. Not to mention the advantages of consolidated compliance reporting, bulk discounts and economies of scale.
The result: You’re only managing 25 vendors and solutions, rather than 1,000, with much better integration among functions and better visibility into your overall security posture. Your staff can also use the free time it once spent managing all those solutions to find new ways to enhance your security posture.
Once you’re up and running with a single suite, you may find that you’ve succeeded in plugging a lot of security holes you didn’t even know existed.
One category you may not have thought of is staff security training and threat simulation. Several vendors include staff training modules that teach users how to recognize and address phishing emails, bad attachments and dangerous links for little to no extra cost. Integration and synergy apply here as well, as staff-training data can be fed into protection modules, which can be configured accordingly, while the threats found by the protection modules can be integrated with your training to keep it fresh and relevant to your risk profile.
Look for flexible, M&A-friendly solutions.
Slowdowns and recessions often lead to a lot of company mergers and acquisitions, with the requisite merging of IT technologies and infrastructure. The faster an organization can integrate these infrastructures and make them play well with the rest of their technology investments, the smoother the M&A adjustment will be.
When you start consolidating your security infrastructure, consider carefully whether the suites and solutions you intend to keep are M&A-friendly, allowing you to integrate a new division without a lot of redeployment, reconfiguration and redefining of policies and functions.
In the end, you may find that there’s a positive side to the economic slowdown, as it forces you to reevaluate your risk profile, security posture, strategies and tools. After consolidation, mergers, acquisitions and legacy elimination, you may end up with much better, more efficient protection at a lower cost than you ever thought possible.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
