Former CISO: Middle management, not executives, must shift team mindsets to curb security tool sprawl
A former CISO argues that security tool sprawl persists because changing team mindsets is harder than swapping software licenses.
Key points
- Tool sprawl is primarily an organizational psychology issue, not just a technology problem.
- Consolidation efforts often fail because engineering teams resist changes that impact their workflow.
- Success depends on middle management, not just executive mandates from the C-suite.
Security tool consolidation initiatives frequently fail to reduce technology sprawl within organizations. A former CISO explains that these efforts stall because changing team mindsets is more difficult than swapping software tools.
What happened
A former CISO at CME Group described the common failure of security tool consolidation efforts in a report for CSO Online. The author noted that executives often identify redundant tools and select a new strategic platform to replace them. However, six months later, the original tools remain active, and the new platform simply adds to the count. The former CISO adopted the unofficial title of chief decommissioning officer at CME Group.
This role involved identifying obsolete technology, determining actual dependencies, and removing unused tools. The author stated that buying technology is easy, but killing it is hard. The report argues that tool sprawl is rarely just a technology problem. Instead, it is fundamentally an organizational psychology problem. Traditional solutions like standardizing the stack or centralizing procurement often stall. These efforts fail between the planning phase and actual production implementation.
Why it matters
Executive mandates alone do not drive successful technology consolidation. The CSO Online report highlights that CEOs and CIOs can announce standardization policies without success. Procurement teams may renegotiate contracts, and analysts may validate vendor choices. However, these top-down messages often ignore ground-level realities. Engineering teams and product owners determine whether policies become practiced behaviors. A developer might reject a new scanner if it slows their workflow by twelve minutes.
Marketing managers may depend on legacy APIs that generate revenue. These teams file exception requests to keep outdated tools running. Some of these tools are end-of-life and receive no security updates. The report emphasizes that transformation happens in the layer of engineering managers and architects. This middle layer decides whether upstairs policies translate to downstairs actions. Changing the toolset is easy, but changing the mindset is far more difficult.
What to watch
- Monitor exception requests for end-of-life tools that lack security updates.
- Track workflow impacts when introducing new security platforms to engineering teams.
- Evaluate the influence of middle management on policy adoption rates.
- Assess whether consolidation efforts are adding tools rather than removing them.
Background: APIs
APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.
Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches
What to do and how to stay safe: CME Group
- Engage engineering managers early in consolidation planning to identify workflow dependencies.
- Map actual tool usage and dependencies before attempting to decommission legacy systems.
- Review exception requests for end-of-life software to assess ongoing security risks.
- Align security policy changes with operational realities faced by product owners.
Step-by-step guide: Software Updates Best Practices: Secure Patching Without Downtime
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do security tool consolidation efforts fail?
Consolidation fails because changing team mindsets and workflows is harder than swapping software tools.
Who determines if security policies are adopted?
Engineering managers, architects, and product owners determine whether policies become practiced behaviors.
What is the root cause of tool sprawl?
Tool sprawl is primarily an organizational psychology problem, not just a technology issue.
