Direct answer. Do not decide on the vendor's pitch or on the number of tools. Decide on coverage you can prove you keep, total cost on one basis over three years, and the lock-in and execution risk you take on. I would run a time-boxed evaluation and consolidate only the areas where the platform reproduces our detections and controls at lower total cost, and keep best-of-breed where a specialist tool is clearly better or where lock-in would be hard to unwind.
Terms. Best-of-breed means choosing the strongest specialist tool in each category rather than one vendor's suite. Alert fatigue is analysts missing real alerts because too many low-value ones arrive. A proof of concept (PoC) is a time-boxed trial on your own data. Price protection is a contract clause capping renewal increases. Lock-in is the cost and difficulty of leaving a vendor later.
Decision criteria
- Capability and detection coverage: map every current tool to the risks it covers and the detections it produces. A detection use case is a specific attack behaviour a rule is meant to catch. The platform must reproduce them or the gaps must be accepted explicitly.
- Total cost on one basis: licences, migration, a period of running old and new tools together, staff time, and training, over three years, including the renewal price.
- Integration and operations: fewer consoles and handoffs reduce analyst effort and alert fatigue; a single vendor also becomes one failure and one negotiation point.
- Lock-in and exit: data formats, contract term, price protection, and how hard it would be to leave.
- Vendor viability and roadmap: do not buy a roadmap promise.
Worked example (illustrative numbers). Nine tools cost $1,100,000 a year. The platform quote is $780,000 a year, plus $250,000 one-time migration, plus about two months of parallel running at the current cost ($1,100,000 / 12 x 2, about $183,000).
- Status quo over 3 years: $3,300,000.
- Platform over 3 years: 3 x $780,000 + $250,000 + $183,000, about $2,773,000, a saving of roughly $527,000.
- Year one alone costs about $1,213,000 versus $1,100,000, so year one is more expensive.
- If the platform raises its price 20% at the year-three renewal, the 3-year total is about $2,929,000 and the saving falls to about $371,000. Price protection in the contract matters. Put both options on the same basis before reading the saving: incumbent tools also renew. If the nine tools rose 20% at the same year-three renewal (year three $1,320,000), the status quo would be $3,520,000 and the saving against the $2,929,000 platform total would be about $591,000, so the platform's price rise only erodes the saving if it is steeper than what the incumbents would charge. The decision question is the relative renewal exposure and the price-protection clause, not the platform's increase in isolation.
How the coverage test is run: list every current detection rule and the attack behaviour it targets; for each one, run a scripted simulation of that behaviour (for example, creating a new admin account or dumping credentials in a test environment) against the platform in the PoC and record whether an alert fired and how fast. Rules that fire go on the reproduced list; those that do not go on the gap list. Coverage test: of 140 current detection rules, the platform reproduces 124 in a proof of concept (about 89%). The remaining 16 (about 11%) either get rebuilt, kept in a retained tool, or formally accepted as a gap by the risk owner. If those 16 include ransomware or identity attack detections, they weigh more than their count suggests.
Post-merger tool overlap. After acquisitions, the same logic applies: map each acquired tool to coverage first, retire the duplicate only after the replacement shows the same detections, and keep both for the parallel period.
Trade-offs and pitfalls
- Consolidation saves money and complexity but can quietly reduce detection. Never switch off a tool before its coverage is demonstrated, with a test (for example, replaying simulated attacks).
- Phase it: start with the area with the heaviest overlap and the lowest risk, such as duplicate endpoint or vulnerability tools.
- What would change my call: a poor coverage result, no price protection, or a team too small to run a migration safely.
