What five consoles cost
Mar 25th, 2026 by Jesper Kråkhede
Following my post on the unified SOC portal, a question for management: how many security consoles does your SOC have?
In many organisations the answer is five or more. One for endpoints, one for email, one for identity, one for the SIEM, one for the firewall, one for vulnerability management. Often from different vendors, often with a dedicated person or team for each.
That costs more than the licences. Analysts spend time switching between tools and copying information from one to another. Each tool needs integration, maintenance and its own expertise. Incidents are investigated in pieces, and the pieces don´t always fit. And when an expert leaves, a tool is suddenly orphaned.
With AI agents, the cost of fragmentation grows. An agent can only reason about the data it can see. If your signals are spread over five platforms that don´t talk to each other, the agent sees a fifth of the picture.
That doesn´t mean one vendor for everything. Sometimes the best tool for a job is a specialised one. But every tool should earn its place, and it should integrate with the rest.
So ask your security team for the list of tools, what each one costs all in, including people, and which unique risk each one covers. Then look for overlaps.
You also save on compliance work. Fewer tools mean fewer places to collect evidence from when the auditor comes.
Best of suite beats best of breed. I wrote that in 2019. It is even more true now.