Don’t Buy the Cybersecurity Tool Everyone’s Selling

Clients forward me vendor emails most weeks now. The current wave promises an AI-driven security platform that detects and neutralizes threats automatically, priced per user per month, with a demo available Thursday. My advice in most cases is to hold off, and the reasoning has nothing to do with skepticism about the technology.

What detection tools assume

Detection platforms are built on an assumption: that the environment underneath them is already maintained. They assume systems are patched, that access is controlled, that backups exist and have been tested, that departed employees no longer have accounts. When those things are true, a good detection tool adds genuine value by catching what gets through. When they are false, the tool produces alerts about an environment nobody is in a position to fix, and the business has taken on a recurring cost without reducing its actual exposure.

Where the incidents come from

In 20+ years of network and security work, the incidents I have been called into have overwhelmingly traced back to maintenance rather than sophistication. A server 2 years behind on patches. Credentials shared across a team because setting up individual accounts was inconvenient. An administrator account belonging to someone who left in 2022. A backup job that had been failing silently for months because the alerts went to a mailbox nobody monitored. None of those would have been prevented by a more intelligent platform, and several of them would have been visible to anyone conducting a basic review.

4 questions to ask before signing

4 questions are worth putting to any security vendor before signing. What does this tool assume is already in place in my environment? What specifically will it do that my current setup does not? Who reviews and acts on the alerts it generates, and is that person on my payroll or yours? And what is the total cost over 3 years, including the licensing that has to sit underneath it?

Those 4 questions are a gut check on vendor honesty. Whether now is the right time to buy comes down to something else: whether the fundamentals underneath are already in place. A vendor can answer every one of the 4 cleanly and still be selling into an environment that isn’t ready for what the tool does.

When to buy

Buy the tool when the fundamentals are covered and you want better visibility on top of them. That is a sound investment. Buying it in place of the fundamentals converts a solvable operational problem into a permanent expense, and leaves the original exposure exactly where it was.