Security tool consolidation: prove what can be switched off

The renewal saving becomes real when the old security service can be switched off. Until then, the CISO may be paying for two platforms, migration work and a team learning a new investigation process at the same time.

That does not make consolidation a bad investment. It makes the retirement decision the centre of the business case. Start by identifying the work that must survive, then establish which capabilities can be retained, integrated or removed. A smaller product list is useful only if the resulting operation meets the organisation’s needs.

Follow an investigation from alert to evidence

Choose a representative investigation with the analysts who perform it. Follow the initial event through collection, parsing, detection, triage, enrichment, containment and evidence retrieval. Include the custom rule, saved query, external lookup or ticket integration that makes the workflow useful.

Compare the target environment at those points. A replacement may detect the same endpoint behaviour but lack the identity history needed to explain who initiated it. Another may offer a better incident view while requiring a different data store for older evidence. These are design choices to resolve, not small details to leave until renewal week.

The Microsoft Defender and Sentinel combination illustrates the distinction. Microsoft documents up to 30 days of native raw Defender XDR data in advanced hunting, with longer access to supported tables through an onboarded Sentinel workspace and configured analytics-tier retention. It also describes external streaming, with retention starting when that streaming is enabled.

A requirement to investigate events six months later therefore needs a deliberate retention and query design. Seeing a current incident in a unified portal does not demonstrate that the required historical data will be available there. Nor should a migration plan assume that enabling a stream recreates evidence that was never retained.

Integration is not the same as complete replacement

Microsoft’s Defender XDR integration documentation also identifies ingestion limits. Some vulnerability-management tables can appear in the Sentinel schema without their data being ingested into the workspace. The presence of a table name is therefore insufficient evidence that an existing query will produce the same result.

Test the actual rule or investigation, including its data source, fields, lookback period and required permissions. Use known events or controlled exercises to establish that the replacement collects the evidence and produces the intended outcome. Check a quiet period too: a rule that generates an alert but overwhelms analysts with irrelevant cases has not met the operational requirement.

Preserve the distinction between an accepted capability reduction and a successful replacement. The organisation may reasonably decide that an old report is no longer needed. Record that decision with its owner; do not describe the report as migrated if it has been abandoned.

Choose one of three outcomes for each capability

Retain a capability when it performs necessary work that the target has not demonstrated. That might mean a narrower licence, a read-only evidence service or a temporary extension while a specific gap is closed. Give temporary retention an exit condition so it does not become an unnoticed permanent cost.

Integrate when the existing specialist capability still adds value but analysts benefit from a common incident workflow. Identify who maintains the connector, how failures are detected and where the authoritative record lives. A consolidated interface can be worthwhile even when the underlying services remain separate.

Retire when the important uses have a proven destination or an explicit decision to stop them. Confirm historical access, export usability, custom content, downstream consumers and response permissions before the final switch-off. A backup file that nobody can query is weak evidence of a usable archive.

Count transition costs before announcing the saving

Raw data economics can differ from incident integration. Microsoft’s integration guidance says Defender XDR alerts and incidents are ingested and synchronised with Sentinel at no charge, while ingestion of other data types is charged. Apply the organisation’s actual entitlements and commercial terms to the required tables and volumes; do not assume that a connected product makes every data flow free.

Include rule conversion, connector engineering, data retention, training, parallel running and the old contract’s notice period. Distinguish a licence reduction from a cash saving that can actually be realised within the budget year.

For a hypothetical comparison, suppose the current recurring cost is £240,000 a year and the proposed steady-state cost is £180,000. The annual difference is £60,000. If migration costs £120,000 and temporary overlap costs a further £20,000, the £140,000 transition cost takes 28 months of those savings to recover, before discounting and assuming the saving begins as planned. A six-month retirement delay pushes the benefit further out.

The programme may still be justified by better coverage or reduced analyst effort. State those benefits separately and establish how they will be observed. Do not quietly count a freed hour as both a cash saving and extra investigative capacity.

Set the retirement gate before signing

Agree the evidence required to switch off the old capability: successful representative investigations, the necessary historical queries, stable collection, working response actions and trained operational owners. Give parallel running a defined purpose and end condition.

Start with a detection coverage review to establish the critical work the target must preserve. The consolidation decision should then identify exactly what will be retired, what will remain and why. That is a business case a CISO can defend after the contract is signed.