Behind the AI hype and vendor noise lies an unsustainable security mess.
Every year, as conference season approaches, I find myself struck by the sheer volume of cybersecurity products, services, and vendors crowding the market.
I’ve been writing about this trend since 2019, and if anything, the landscape has only become more fragmented. Despite expectations, there’s still no meaningful consolidation on the horizon — and that’s a red flag. A market this crowded isn’t necessarily a sign of innovation; it may be a sign of dysfunction.
The situation has worsened in recent years as countless startups have jumped aboard the AI bandwagon. While many vendors seem successful — at least in attracting investor dollars — that success is often driven more by a surge in cyber-attacks and the hype around AI than by actual market demand.
Which brings me to a fundamental question: Who is buying all these tools?
There will always be a “box-checking” market. Some tools are purchased to satisfy audit requirements or prepare for regulatory inspections — often with little to no scrutiny or competitive evaluation. That segment is alive and well.
But other areas — like Governance, Risk & Compliance (GRC) and Identity & Access Management (IAM) — are becoming painfully overcrowded. In these saturated segments, how does a vendor stand out without a clear, credible, and differentiated message? Scaling a product in this environment is nearly impossible without a sharply defined value proposition.
Worse still, many vendors fail to articulate the business problem they’re solving. Their marketing materials are often packed with technical jargon, intelligible only to those deep inside a narrow specialty. It’s as if these tools are designed by technologists for technologists, with little thought given to the broader business context.
As a result, these solutions are usually purchased in isolation — point solutions acquired by individual team leaders to solve narrow problems. But collectively, they’ve led to a bloated, chaotic cybersecurity landscape in many large enterprises, where dozens of tools are deployed with little integration or strategy.
The consequences are serious:
- Security operations are fragmented.
- Compliance and incident response become manual and inefficient.
- Costs rise as more human effort is needed to bridge gaps between tools.
- Automation and integration remain elusive.
This tool sprawl contributes directly to the skills gap plaguing the industry. Without streamlining, scaling operations to meet growing threats becomes virtually impossible.
This is the harsh reality behind all those flashy trade show booths: Even if individual tools serve a purpose, their unchecked accumulation has made it nearly impossible for enterprises to respond effectively and efficiently to evolving threats.
Buying more tools won’t help — not unless something fundamental changes.
What’s needed is a strategic shift. Cybersecurity teams must stop addressing each problem in isolation and start building coherent, streamlined, and integrated security ecosystems. This is where the CISO’s leadership is critical.
CISOs must define a clear product vision and roadmap, prioritize simplification, and lead the charge in decluttering their organizations’ cybersecurity stacks. Automation should be central to this effort — but only if it’s paired with a ruthless focus on rationalization.
This mindset is more essential than ever as AI-based solutions proliferate. Without it, we’re simply adding to the chaos.
JC Gaillard is the Founder and CEO of Corix Partners, a London-based Boutique Management Consultancy Firm and Thought-Leadership Platform, focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation and Governance challenges.
He is a leading strategic advisor and a globally-recognised cyber security thought-leader with over 25 years of experience developed in several financial institutions in the UK and continental Europe, and a track-record at driving fundamental change in the Security field across global organisations, looking beyond the technical horizon into strategy, governance, culture, and the real dynamics of transformation.
French and British national permanently established in the UK since 1993, he holds an Engineering Degree from Telecom Paris and has been co-president of the Cyber Security group of the Telecom Paris alumni association since May 2016.
Read more on our Security Transformation Leadership publication here on Medium