Data Security: Platform or Best-of-Breed Is the Wrong Fight

Are we there yet?

A decade of consolidation promises says we should be. Simplify the stack. Reduce the vendor count. Cut the spend. Every platform vendor has been selling that story since roughly 2015, and every year the slide deck gets a little more confident.

Walk into a regulated enterprise today and count the tools. Most run somewhere between two and six for data security alone. Purview for Microsoft 365. Zscaler at the web edge. Proofpoint for email. A DSPM platform somebody bought eighteen months ago. A DAG deployment nobody wants to talk about cause it sucks. Something inherited from an acquisition that still has an owner in name only.

That is not a transitional state. That is the state.

Gartner's own read is that the hybrid tool condition persists, and that DLP, the category everyone has been predicting the death of since cloud arrived, is still growing. Meanwhile venture money keeps funding category-defining startups faster than any platform can absorb them.

So the war everyone has been fighting is running out of supplies. Which raises a better question than who won.

Why hasn't consolidation actually happened?

Because the forces working against it are structural, not cultural.

Platform vendors are themselves assembled from acquisitions. A suite is often five products with one invoice and five consoles. You consolidated the purchase order. You did not consolidate the operation.

Innovation outruns the integration cycle. By the time a platform vendor finishes absorbing the category it bought into, a new category has emerged beside it. DSPM did not exist as a procurement line item in 2019. Something will not exist in 2027 that every CISO will be asked about in 2028.

Bundled tools get adopted but rarely get retired. When a capability arrives inside a license you already own, the organization turns it on. Almost nobody runs the project to decommission the tool it was supposed to replace, because decommissioning is unfunded, politically expensive, and carries real risk if the coverage maps are not identical. So the count goes up.

Best-of-breed loyalty is rational. Security teams that chose a specialist tool usually chose it for a reason they can still articulate. "Good enough, and it came with the suite" is a hard pitch to a team that has lived through the gap between good enough and good.

None of that is going to resolve in the next three years. Plan for the hybrid state, because the hybrid state is what you have.

What did consolidation promise, and what did it deliver?

It promised three things: fewer vendors, lower cost, simpler operations.

It delivered the first one, sometimes. It delivered the second one rarely, and usually by trading a line item for a larger bundled commitment. It almost never delivered the third.

Here is why. Operational complexity in data security does not live in the vendor count. It lives in the gap between a signal arriving and a decision being made. Buying five tools from one vendor instead of five vendors does not change the fact that an alert still has to be understood, matched against an obligation, routed to someone with authority, acted on, and recorded in a way that survives an audit three years later.

Consolidation addressed the purchasing layer. The operating layer never moved.

Why is "platform versus best-of-breed" the wrong fight?

Because both positions are answers to the same question, and it is the wrong question.

Platform says: buy fewer things. Best-of-breed says: buy better things. Both are answers to "what should we buy." Neither is an answer to "how do we decide."

Think about the analyst in the middle of this. Monday morning, there is a queue. It does not matter whether those alerts came from one vendor or five. The analyst still has to work out what actually happened, which rule applies to this specific data and this specific person, who owns the data, who can authorize a response, and how to close it in a way that holds up later.

A platform does not answer those questions. A best-of-breed tool does not answer those questions. Neither architecture was designed to. Detection tools are built to find and to flag. The deciding was always assumed to be done by a person, in a meeting, with a policy document open in another window.

That assumption is what broke. Not the tooling strategy.

What does the hybrid state actually require?

If you accept that you will run multiple tools indefinitely, three requirements follow, and none of them are satisfied by picking a side.

One vocabulary. A "high severity" event in one tool is a "medium" in another. An "incident" in one is a "case" in another. Until signals resolve into a common schema with a common severity model, you cannot answer "how many data risk incidents did we have last quarter" with a number you would defend.

One place where obligation lives. Regulation sits in a GRC platform. Policy sits in a PDF. The actual response rule sits in a senior analyst's head. In a hybrid stack, none of your tools can hold all three, and none of them should try. The obligation layer has to be vendor-neutral or it becomes hostage to whichever vendor you leave next.

One record that outlives the tools. This is the requirement nobody budgets for and everybody eventually needs. When you replace a DLP, the alert history, the investigation notes, and the reasoning behind every past decision stay behind. Your retention obligation does not care. If your decision record lives inside the tool that produced the signal, every migration resets your institutional memory.

Those three requirements describe a layer that sits above the stack rather than inside it. That layer has to be neutral by design, because its whole job is to be the thing that does not change when the tools underneath it do.

What should you do instead of picking a side?

Stop measuring tool count. It is a vanity metric in both directions. Fewer tools is not a safer program and more tools is not a more capable one.

Start measuring decision velocity. Time from detection to decision. Time from decision to action. Percentage of incidents closed with a documented rationale and a named approver. Those three numbers tell you whether your program works. Tool count tells you about your procurement history.

Buy for replaceability. Assume every detection tool in your stack will be replaced within five years, because it will. Architect so that replacing one does not cost you your history or your operating model.

Put the decision layer outside the detection layer. Whatever you use to normalize signals, resolve obligations, route to owners, and keep the record should not be owned by any vendor whose detection it is also evaluating. That is not a philosophical preference. A ledger owned by a detection vendor has a structural conflict of interest in recording the limits of that vendor's detection.

The fight that is actually worth having

Platform or best-of-breed was a procurement argument dressed up as a strategy. It was always going to end in a draw, because both sides were right about the thing they were optimizing and neither was addressing the thing that actually costs enterprises time.

The hybrid state is permanent. Make peace with it.

The real question is what sits above it, who decides, and whether you can prove what you decided when somebody asks you three years from now.

That argument has barely started.