​The Tool Sprawl Problem: Why Security Leaders Are Turning To Unified Platforms

Kevin Tian, Co-Founder and CEO at Doppel, an AI-native social engineering defense platform.

gettyCybersecurity didn’t become fragmented by accident. For years, organizations built their defenses one threat at a time. A new attack emerged, a vendor addressed it and another tool entered the stack. Email phishing, security awareness training, identity and more have each developed their own products, teams, metrics and workflows.

Historically, the cybersecurity model rewarded specialization. A brand protection product tracked takedowns. An email product tracked detections. A training product tracked participation rates. Each tool could demonstrate value within its boundary.

That model had its time and place, but it wasn’t built for complex, coordinated, multichannel attacks, particularly in social engineering. Today’s security environment is filled with tools that manage isolated pieces of the same campaign. Attackers, meanwhile, operate like businesses, coordinating tactics and channels toward a single objective. As one-off attacks give way to sustained campaigns, fragmented defenses can make it harder to identify and respond to coordinated attacks.

Security leaders are now confronting the cost of fragmentation as attackers become more coordinated and effective with AI.

In social engineering, AI has intensified several challenges associated with fragmented security models. Historically, a sophisticated multichannel campaign demanded considerable time and specialized talent. An attacker had to research the target, construct a credible persona, write convincing messages and coordinate interactions. Those economics limited how many campaigns an operator could run.

AI removes that constraint. Attackers can now generate localized lures, synthetic voices, credible personas and tailored scenarios at scale. They can adapt those campaigns in real time and repeat them across email, SMS, social media, voice and video. Techniques reserved for high-value targets can now be deployed against thousands at once.

AI has widened the gap between the speed of coordinated attacks and the ability of disconnected tools to identify them. Closing that gap requires security strategies built around how these attacks actually operate: across channels, identities, and interactions. ​As AI agents take on more workflows, that defense must protect both the human and agent layers.

A modern social engineering campaign may begin with a fake domain or social profile, move into SMS or email and culminate in a voice call or video meeting. Modern attacks focus on building credibility across channels and over time.

Traditional anti-phishing guidance tells people to verify a suspicious request out of band. But when an adversary controls multiple points of contact, the second channel can reinforce the first. A spoofed executive email looks more credible when it’s followed by a text message, a LinkedIn profile and a convincing phone call.

With the legacy siloed approach, each control sees only one fragment. The email system sees a message. The digital risk tool sees a domain. The awareness platform sees a training opportunity. The full campaign becomes visible only when signals are connected across the social engineering attack chain. By the time a human analyst assembles the pieces, the attacker may have succeeded.

These scenarios make integration worth evaluating, particularly where teams struggle to correlate signals across channels. The benefits depend on the quality of the integrations, the context shared and the organization’s existing controls.

Consolidation can reduce procurement and management overhead, but those benefits do not necessarily translate into better threat detection or response. Combining products under one contract or login may simplify procurement, but it doesn’t automatically improve security. If the capabilities operate independently, the organization has changed the packaging without changing the technology.

Consolidation​ is most useful when integration provides capabilities or efficiencies that standalone tools cannot readily provide. Signals should be connected through shared context, allowing security teams to identify relationships between threats and coordinate responses across disconnected controls.

A threat detected in an inbox should enrich threat intelligence, trigger infrastructure disruption, inform simulations and improve future detection. Intelligence gathered from impersonation campaigns should strengthen email and messaging controls before the same infrastructure reaches an employee or customer.

Over time, these feedback loops may improve detection and response, provided the information is reliable and used effectively. Visibility is only the starting point. The value of consolidation depends on whether it enables meaningful information-sharing, coordinated responses and feedback across security functions.​

Consolidation also requires consideration of how capabilities are integrated and managed. When organizations rely on a single vendor for multiple security functions, they need confidence the provider can deliver across them all without introducing new gaps or dependencies.

Security leaders considering consolidation should ask three key questions.

First, will the tools share context and reduce operational complexity? That means fewer disconnected workflows, portals, less manual correlation and less time managing vendors. The intent is to reduce routine coordination work and free analysts to focus on investigation and risk reduction.

Second, will intelligence move automatically across capabilities? The platform should connect insights, apply them across controls and coordinate action without waiting for an analyst to move information between systems.

Third, does the system cover the full attack lifecycle? Social engineering leaves evidence before an incident, during it and after it occurs. Infrastructure appears before a lure is delivered. Messages, calls and identity signals emerge during the campaign. The outcome should improve future detection, training and disruption.

As I have argued before, AI has changed the speed and economics of cyberattacks, but human nature remains an attractive target. It’s cheaper than ever for attackers to create convincing personas, localized messages, synthetic voices and coordinated campaigns at enormous scale. As AI agents take on more responsibility, attackers have a growing set of non-human targets to manipulate.

Social communication is no longer limited to human-to-human interaction. Organizations must consider human-to-agent, agent-to-human and agent-to-agent exchanges, including how AI systems can be manipulated through email, collaboration tools, voice interfaces and emerging protocols. Whether the interaction involves a person or an AI agent, the objective is the same: manipulate trust to drive an action. Protecting those interactions will require shared intelligence across inbound and outbound channels.

Tool sprawl is a symptom of defenses built around isolated pieces of a connected threat. Consolidation will work only when it connects the underlying intelligence and actions, not merely the vendors. As the attack surface expands from humans to agents, the need for coordinated defense will grow. As attacks become more coordinated, organizations may need to place greater emphasis on cross-channel visibility and response.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?