Walk the tool inventory of most mid-size security programs and you’ll find three products doing signature and behavioral detection on the endpoint, two doing it again on the network, and nobody who can tell you, without a meeting, whether a given vulnerability class is actually covered end to end. That’s not defense-in-depth. That’s five vendors billing for the same job.
Defense-in-depth got named for a reason: depth. Layers. The idea was never “buy more of the same control so a failure is less likely,” it was “put different kinds of controls at different points in the chain, so a failure in one doesn’t cascade into a failure of the whole thing.” Network segmentation catches what endpoint detection misses. Identity controls catch what network segmentation can’t see. Data-layer controls catch what gets through when identity is compromised. Each layer earns its place by covering something the others structurally can’t. Stack three tools that all do the same job at the same layer and you haven’t added depth, you’ve added invoices and alert volume.
The data says the gap is at the layers you’re not buying for
Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation overtook stolen credentials as the leading initial access vector for the first time in the report’s 19-year history, accounting for 31% of breaches versus 13% for credential abuse, according to SecurityWeek’s coverage of the report. The same report found that only 26% of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% the year before, per Help Net Security’s summary of the DBIR findings.
Read that next to a typical tool inventory and the mismatch is obvious. Most security budgets are heavy on endpoint and network detection, the layers with the most vendors competing for the same dollar, and light on vulnerability and patch management, the layer that’s now the single biggest way attackers get in. AI-assisted exploitation is compressing the window between disclosure and exploit from months to hours, which makes an under-resourced patching layer worse every quarter, not better. No amount of redundant EDR coverage fixes a gap at the vulnerability management layer. It’s a different layer. It needs a different control, not a fourth copy of the one you already have.
Why the overlap happens anyway
Nobody sets out to buy five tools for one job. It happens one procurement cycle at a time: a new threat category gets headlines, a vendor demo looks good, the tool gets bought to close a specific gap, and eighteen months later nobody remembers that two other products already cover 80% of the same ground. Each purchase was individually defensible. The portfolio, evaluated as a whole, is not.
Gartner’s vendor consolidation survey found that 75% of organizations were actively pursuing security vendor consolidation, up from 29% in 2020, and that the leading motivation was improving risk posture and reducing operational complexity, not cutting license spend, according to Dark Reading’s report on the survey. That’s the tell. Security leaders aren’t consolidating because tools are expensive, they’re consolidating because a heterogeneous stack with unmanaged overlap is harder to operate and easier to have a gap in than a smaller, deliberately layered one. More tools watching the same layer doesn’t buy you a lower probability of missing an attack there. It buys you more consoles to tune, more false positives to triage, and more places for an analyst to assume someone else’s tool caught it.
The test that actually distinguishes depth from sprawl
Before a new security tool clears architecture review, it should answer one question cleanly: what layer does this sit at, and what does it catch that nothing else in the portfolio catches at that layer? If the honest answer is “it does the same detection as an existing tool, just better on paper,” that’s a bake-off question for the incumbent renewal, not a case for a new SKU. This is the same discipline covered in the case against best-of-breed procurement: a feature checklist win is not an architecture win if it duplicates coverage you’re already paying for elsewhere.
Practically, this only works if the control layers and the tools mapped to them live somewhere durable, not in a spreadsheet that gets updated once a year before an audit. I run this mapping in LeanIX, tied to the same portfolio view I’ve written about as the EAM system of record, specifically because it forces the question of overlap to be visible at the time a new tool is proposed, not discovered two years later during a renewal review. A layer with five tools and a layer with zero should both show up as findings, not surprises.
None of this argues for a thinner stack in the name of simplicity. It argues for spending against the actual attack chain instead of against whichever layer has the most vendors pitching this quarter. Five tools on one layer and a gap on another isn’t caution, it’s an unpriced risk sitting next to an overfunded one. Fix the allocation before you fix the count.
Photo by Prateek Katyal on Unsplash