Lesson 1.58: Fewer, better-used tools
Security budgets often hold tools bought for a project, a merger or a past incident that nobody fully uses any more: two products doing the same job, licences sitting idle, features paid for and never turned on. Rationalising the portfolio frees money and people's attention without adding risk, as long as you check what each tool uniquely covers before removing it. In the lab you find overlapping capabilities and idle licences in Northwind's portfolio, separate real duplicates from look-alikes, and reinvest the savings in the strategy.
17 min
You will learn to
- Find capabilities covered by more than one tool
- Measure licence utilisation
- Check unique coverage before retiring a tool
- Tell under-used from under-deployed
- Reinvest savings in strategic objectives
Key terms
- Tool sprawl
- More security tools than the team can operate well.
- Licence utilisation
- Used licences divided by purchased licences.
- Unique coverage
- What only this tool protects or sees.
- Rationalisation
- Removing duplicates and idle spend, then reinvesting.
← Concentration risk: when many risks share one cause · All lessons · Kernel, shell and terminal →