How do you get more value from the security tools you already own?

You get more value from existing security spend by mapping each tool to a risk it is supposed to reduce, then checking whether it is deployed, tuned and watched. Most waste is not in what you bought but in coverage that was never finished. Fix that before buying anything new.

Why do tools sit underused?

Because buying is an event and operating is a habit. A tool is licensed, installed on a pilot group, and then the project ends. Alerts nobody reads pile up. Features go unconfigured. Two tools get bought to solve the same problem by two teams who never compared notes.

CISA's Cross-Sector Cybersecurity Performance Goals 2.0 start from a similar observation, aimed at smaller organizations: prioritize investment in a limited number of essential actions with high-impact security outcomes. The goals are voluntary, and CISA updated them to align with the NIST Cybersecurity Framework 2.0 functions. They are a handy yardstick for whether your tools cover the basics.

How do you run a value review?

Treat it as an audit with four questions per tool.

1. Which outcome does it serve? Name it in plain words, such as "know every internet-facing asset" or "stop stolen passwords from working."
2. What share of the estate does it cover? A scanner on 40 percent of servers gives 40 percent of the answer.
3. Is anyone acting on its output? Count the findings opened and closed last quarter.
4. What would we lose if we switched it off? If the honest answer is "nothing we would notice," you have found waste.

Do this in a spreadsheet with one row per tool and one column per CSF function: Govern, Identify, Protect, Detect, Respond, Recover. The picture usually shows crowding in Detect and gaps in Identify and Govern.

What does a constructed review find?

A company of 200 staff owns an endpoint agent, a mail filter, a cloud posture scanner, a vulnerability scanner and a log platform. The review shows:

• The vulnerability scanner covers the data center but not cloud workloads, which sit in a different account nobody added.
• The log platform ingests firewall logs but not identity provider logs, so account takeover would not show.
• Two tools both flag misconfigurations in cloud storage, with different owners, and neither team closes findings.

No new purchase is needed. Add the cloud account to the scanner, connect identity logs, and merge the two cloud findings queues under one owner. The spend is the same and coverage improves in three places.

How to check or apply this

1. List every security tool, its owner, its annual cost and its renewal date. Renewal dates are your decision points.
2. Map each tool to an outcome and a CSF function.
3. Measure coverage: percent of endpoints, accounts, repositories or domains that report in.
4. Measure action: findings opened, closed and aged over 90 days.
5. Mark overlaps and gaps. Retire or merge overlaps at renewal, and fund gaps from what you free.
6. Pick three outcomes for the next quarter and report coverage on them to leadership monthly.
7. Revisit after each incident. Ask which tool should have caught it and why it did not.

What should you measure instead of tool counts?

Counts of tools and alerts say little. Prefer measures tied to outcomes: time to disable a leaver's access, share of internet-facing assets with an owner, median age of exploited vulnerabilities, time to restore a key system from backup. Pick numbers you can actually read from systems, and keep the list short.

Beware vanity coverage. "Deployed" and "healthy and reporting" are different states. Agents that stopped checking in months ago still count as deployed on most reports.

Quick check

Sources

• CISA Cross-Sector Cybersecurity Performance Goals
• NIST Cybersecurity Framework

Last reviewed: 18 October 2026.