These ARE the droids you’re looking for
There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a shiny new strategic platform and declares that consolidation has begun. Six…
No other outlet followed by Zonactu reports this story yet.
The antidote is not stronger central control but rather explicit ownership. RACI matrix much? Before replacing a tool, find the people who use it and ask an embarrassingly simple question: “What do you actually use this for?” Don’t ask what the contract says. Don’t trust what the architecture diagram might show (*do* check the last modified date, though).
Take what the vendor’s customer-success representative believes with a grain of salt and more than a modicum of skepticism. What do people actually do with it on Tuesday morning? Security leaders are usually surprised by the answer. Maybe the vulnerability scanner’s primary value is not vulnerability scanning. Perhaps an engineering team depends on an obscure export function for its weekly metrics. Maybe the old SIEM has one correlation rule tied to a regulatory requirement that hasn’t been migrated. You will find these things if you look.
This is where the middle of the organization becomes your real intelligence network. The people closest to the systems know where the undocumented dependencies live. Treated as obstacles and they’ll defend their tools. But allow them to be participants and they’ll help dismantle them. A good perspective when planning to kill someone’s baby is to help them understand that they fell in love with the control the tool gave them over the chaos that reigned before it was implemented. And that a new tool can be equally comfortable and easier to support than the burden of the care and feeding that most “heritage” (I prefer this term to “legacy”) applications and solutions require.
