Picture a controller at a Grapevine company asking her IT provider a reasonable question: what are we actually paying for?

Now picture it taking eleven days to get an answer, and the answer running to nine line items. Endpoint protection from one vendor. Email filtering from another, layered on top of the filtering already included in Microsoft 365. A backup product. A second backup product, for the one system the first one couldn’t reach. A password manager nobody had rolled out past the leadership team. Two remote access tools, because a former technician preferred one of them. A dark web monitoring subscription that emailed a PDF to an address that no longer existed.

Nine products. Roughly $2,100 a month. Not one person in the building could say what happened when any of them raised an alarm.

A company like that is not under-invested. It was uncoordinated. Those are different problems, and only one of them gets solved by buying something.

The number that should bother you

Here is the statistic worth carrying into your next budget conversation.

According to IBM’s 2025 Cost of a Data Breach Report, organizations took a mean of 241 days to identify and contain a breach, the lowest figure in nine years. The 2026 report, released in July, found it has climbed back to 247 days, the first increase after five straight years of decline.

Either way, it is roughly eight months.

Eight months is not a detection problem in the sense most people mean it. The tools usually fire. Something logs the unusual login, the new mailbox rule, the file that got encrypted at 2 a.m. The gap between the alert existing and somebody acting on it is where those eight months live.

ISACA, writing about exactly this pattern, cites Ponemon research that the average security operations center takes in around 17,000 malware alerts a week, and that fewer than 20 percent are ever investigated. More than 30 percent of IT professionals admit to ignoring alerts outright because the false positive rate is so high.

Three statistics: 17,000 malware alerts reach the average security operations center each week, under 20% are investigated, and 241 days is the mean time to identify and contain a breach

Read those two facts together. The detection worked. Nobody was reading it. Adding a tenth product to that stack produces one thing reliably: more alerts nobody reads.

“More tools” is a purchasing habit, not a strategy

Nobody sets out to build a sprawling stack. It accumulates one defensible decision at a time.

The cyber insurance renewal asks whether you have endpoint detection and response, so you buy EDR. A peer gets hit with a wire fraud attempt, so you add email security. An auditor asks about privileged access, so you add a password vault. Each purchase answers a real question from a real person, and each one is easy to justify on its own.

What almost never happens is the step after: deciding who watches the thing you just bought, what they do when it speaks and whether it overlaps with something you already had.

This is not a small-business failing. Gartner found in 2022 that 75 percent of organizations were pursuing security vendor consolidation, up from 29 percent just two years earlier. The largest security budgets on earth spent the better part of a decade buying point solutions and are now spending real money unwinding them. You do not have to repeat that arc to learn from it.

Layering is legitimate. Two controls covering the same risk on purpose is defense in depth. Two controls covering the same risk because nobody noticed is waste with an alert queue attached. The difference is not the number of products. It is whether anyone chose.

The Texas part almost nobody mentions

Here is the angle that does not show up in the national write-ups, and it reframes this whole conversation.

Texas already has a cybersecurity law on the books, and it says nothing at all about what you buy.

Under Texas Government Code §2054.5191, added by House Bill 3834, any state or local government employee who uses a computer for at least 25 percent of their required duties must complete a certified cybersecurity training program at least once each year. Not “should.” Must.

And §2054.5192 extends it outward: a state agency shall require any contractor with access to a state computer system or database to complete that same certified training, both during the contract term and at any renewal.

Two details matter more than the mandate itself.

First, the training has to be certified by the Texas Department of Information Resources, which certifies at least 20 qualifying programs each year. You cannot satisfy it with a video somebody found.

Second, and this is the part worth sitting with, completion has to be verified and reported to DIR. Local governments report on their employees. Agency contract managers report on their contractors. The statute does not ask what security products were purchased. It asks for a name, a date and a record.

So if you are a Keller manufacturer with a state agency contract, or any DFW business with a login to a Texas state agency system, this can already apply to you. And the compliance question is not do you own enough tools. It is can you produce the record.

That is a useful mirror to hold up to your own stack. The one law in this state that puts a hard requirement on cybersecurity asks about people, training and accountability, not products.

We’re an IT firm, not a law firm. Check the specifics with your attorney. For private businesses under 250 employees, the related Texas safe harbor law is covered in our post on SB 2610.

You probably already own the tool you were about to buy

Before the next purchase, check what you are already paying for. This is the single highest-return hour most small businesses can spend on security, and almost nobody spends it.

If you run Microsoft 365 Business Premium, Microsoft’s own documentation confirms your subscription already includes:

  • Microsoft Entra ID P1, which means Conditional Access, the control that lets you block sign-ins from unexpected countries, require multifactor for risky logins and refuse access from unmanaged devices
  • Microsoft Defender for Office 365 Plan 1: impersonation protection, Safe Links and Safe Attachments across email, SharePoint, OneDrive and Teams
  • Microsoft Defender for Business: endpoint protection broadly equivalent to Defender for Endpoint Plan 1
  • Microsoft Intune Plan 1: device management, including macOS

That is most of a mid-market security stack, already purchased, sitting in a tenant you are paying for monthly.

And here is the practical catch. Microsoft notes that while defaults give you good baseline protection, better protection requires turning on the Standard or Strict preset security policies, and those are not on by default. In Microsoft 365 Defender, that lives under Email & collaboration → Policies & rules → Threat policies → Preset security policies.

It’s common to find Business Premium tenants where preset policies were never enabled and Conditional Access was never configured, while the company is about to sign for a third-party email security product that largely duplicates what it already owns.

Turning on what you already have is not glamorous. It is free.

The one-page inventory that settles the argument

Sample one-page security inventory with columns for tool, what it does, who watches it and last reviewed, with several tools showing nobody watching

Here is a simple way to make that conversation produce something you can act on.

Build a single table. One row per security product. Four columns:

Tool What it actually does Who watches it Last reviewed
Endpoint protection Blocks / detects malware on laptops No one 2023
Email filtering Duplicates Microsoft 365 Defender No one unknown
Backup (primary) Nightly server images Provider Apr 2026
Dark web monitoring Emails a PDF report No one never

Every dash is a subscription, not a control.

Fill it in with your provider in the room. Three things surface almost immediately:

Rows where “who watches it” is blank. That is not a tool, it is a subscription. Either assign an owner or cancel it. Both are better than the current state.

Rows that duplicate each other. Now you get to decide whether the overlap is deliberate. Sometimes it is. Often it is two answers to the same question, bought two years apart.

Rows where “last reviewed” predates something significant: a move to remote work, a new line-of-business application, an acquisition, a change of IT provider. Controls that fit the company you were don’t automatically fit the company you are.

The table is not the deliverable. The conversation it forces is. Most leadership teams have never once seen their security spend laid out next to the question of who is accountable for each line.

What “coordinated” actually looks like

An immune system is a good metaphor precisely because it is not a collection of remedies. It recognizes, escalates and responds without anyone placing an order.

Translated into something you can check, a coordinated program means four things are true:

  1. Every control has a named owner, a person, not a department and not “IT.”
  2. Alerts route somewhere a human actually looks, with an agreed response for the handful that matter.
  3. Someone reviews the whole picture on a schedule, not only when something breaks or a renewal lands.
  4. Your people know the two or three things they are expected to do: verify banking changes by phone, report the suspicious message, stop and ask.

None of those four require a purchase order. All four require a decision about who is responsible.

This is why SPOT Managed IT includes 24×7 SOC detection and response through SPOT Shield, plus a CIO dashboard that tracks Microsoft Secure Score. The question of who is watching gets a named answer. See what’s included in SPOT Managed IT.

This is the work behind Fulcrum’s First Look: an outside read of what you have, what overlaps and what nobody is watching, and then STARLight, our word for the visibility layer, and STARMap, the roadmap that sequences what to fix and in what order. It’s the same thinking behind our SPOT Shield managed security and managed IT services work: the tools matter far less than whether anyone owns the outcome. Cheap IT saves cents. Smart IT makes dollars, and a good deal of the money in this particular case is already on your invoice.

Two things worth doing this week

Ask for the list. Every security product, what it costs, what it does, who monitors it. If your provider can produce it quickly, that tells you something good. If it takes eleven days, that tells you something too.

Check your Microsoft tenant for preset security policies. One question to your IT partner: are Standard or Strict preset security policies turned on, and is Conditional Access configured? You will learn a lot from how fast the answer comes back.

Where this usually goes sideways

The common failure isn’t buying a bad product. It’s assuming that because something is installed, someone is watching it.

The second most common failure is consolidating for its own sake: ripping out four tools to buy one platform without first answering who will own the platform. That just relocates the problem and adds a migration.

Start with the inventory. Decide what each thing is for and who is accountable. Then, and only then, decide what to cut.

Eight months is how long the average organization takes to find and contain a breach. Very little of that is the tools failing. Almost all of it is the space between an alert and a person.

Frequently Asked Questions

What is security tool sprawl?

Security tool sprawl is when a business collects overlapping security products over time without deciding who monitors each one. The result is more alerts, more cost and gaps nobody owns.

Does Microsoft 365 Business Premium include security tools?

Yes. Business Premium includes Entra ID P1 with Conditional Access, Defender for Office 365 Plan 1, Defender for Business and Intune Plan 1. The Standard and Strict preset security policies are not turned on by default.

How do you reduce security tool sprawl?

Start with a one-page inventory listing every tool, what it does, who watches it and when it was last reviewed. Assign an owner or cancel each unowned tool before buying anything new.

Ready to see what you actually have?

Book a First Look and we’ll map your current security stack: what’s working, what overlaps and what nobody is watching. No products to buy at the end of it, just a clear picture.

Call 817-337-0300, email sales@fulcrumgroup.net or start with the podcast, Talk To Th3 Doc, if you’d rather listen before you talk. More like this on the blog.

The Fulcrum Group · Keller, Texas since 2002 · fulcrumgroup.net

Sources