CISO explains why security tool consolidation efforts routinely fail to reduce sprawl
A former executive at CME Group argues that eliminating redundant security tools is an organizational psychology challenge, not just a technical one.
Key points
- Consolidation efforts often fail because changing team mindsets is harder than swapping software.
- A former CME Group executive adopted the title of chief decommissioning officer to manage tool removal.
- Middle management approval is critical for turning executive security policies into daily engineering behavior.
Security tool consolidation efforts frequently fail because the underlying challenge is organizational psychology rather than technical infrastructure. According to a report by CSO Online, a former CISO at CME Group argues that removing redundant tools is significantly harder than purchasing new ones. This perspective challenges the common industry assumption that buying a unified platform automatically reduces vendor sprawl.
The executive describes a recurring scenario where security leaders identify eleven tools performing the work of four and select a new strategic platform. Six months after the purchase, all original tools remain active while the new platform becomes the twelfth item in the stack. This outcome occurred across financial services, media, and technology sectors. The failure stems from the difficulty of convincing teams to abandon familiar tools for standardized alternatives.
The Role of Middle Management
The former CISO adopted the unofficial title of chief decommissioning officer at CME Group to address this specific problem. The role involved identifying obsolete technology, determining ownership, and assessing operational dependencies. The executive noted that the job required more than administrative oversight; it occasionally involved forcefully terminating support for legacy systems. This hands-on approach was necessary because buying technology is easy while killing technology is difficult.
Consolidation strategies typically stall between initial planning slides and actual production deployment. Executives often rely on top-down messaging, where the CEO, CIO, and CISO announce standardization plans. Procurement teams renegotiate contracts, and industry analysts validate vendor choices. However, this high-level alignment does not guarantee adoption. The real barrier exists in the daily workflows of engineers who must use these tools to complete their jobs.
Why Top-Down Orders Fail
Changing a toolset is straightforward, but changing the mindset of engineering teams is far more complex. The report notes that executives cannot force adoption through authority alone. Reality sets in when developers report that new scanners add significant time to their workflows. Marketing managers may rely on legacy APIs that generate revenue but lack security updates. These practical constraints create friction that top-down mandates cannot resolve.
Exception requests for unsupported tools often persist for years despite end-of-life status. The report emphasizes that transformation happens in the layer of engineering managers, architects, and product owners. These individuals determine whether announced policies become practiced behaviors. Without their buy-in, strategic platforms remain unused additions to the existing stack rather than replacements.
What should you do?
Organizations attempting to reduce security tool sprawl should focus on understanding operational dependencies before initiating consolidation. Security leaders need to engage directly with engineering managers and product owners to identify which tools are critical for revenue or development speed. Simply announcing a new platform from the executive suite is insufficient. Leaders must address the practical workflow impacts that teams face when switching tools.
What to do and how to stay safe: CME Group
- Audit current tool usage to identify which applications are actually used versus those that are merely licensed.
- Engage engineering managers and product owners to understand the operational impact of removing specific tools.
- Identify legacy systems that generate revenue or support critical workflows before attempting to decommission them.
- Monitor exception requests for end-of-life tools to understand why teams resist standardization efforts.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do security tool consolidation efforts often fail?
Consolidation fails because it is an organizational psychology problem; changing team mindsets is harder than changing the software stack.
What title did the former CISO use at CME Group?
The former CISO used the unofficial title of chief decommissioning officer to manage the removal of obsolete technology.
Who determines if executive security policies are actually followed?
Engineering managers, architects, product owners, and operations leaders determine whether policies become daily behaviors.
