Deepak Gupta

58% of Organizations Run More Than 25 Security Tools

Twenty-five tools is not a procurement failure. It is what happens when a program buys correctly for a decade: each purchase solved a real problem, each one was justified at the time, and none of them ever got a scheduled review date.

The number matters because it changes what the next dollar buys. In a five-tool program, a new purchase adds capability. In a thirty-tool program, a new purchase adds capability plus an integration, plus an alert stream somebody has to triage, plus a renewal to negotiate, plus a vendor questionnaire to answer. The marginal cost of the thirty-first tool is not its list price.

That is also why the same survey found the highest spenders reporting the lowest confidence. Sixty percent of respondents spending over twenty-five million dollars still described their budgets as short of what current threats require. Spend and coverage decoupled somewhere, and sprawl is the most defensible explanation on offer.

What this does not mean

This does not mean twenty-five is the wrong number of tools. There is no published evidence for a correct count, and a large regulated enterprise with four clouds legitimately needs more surface coverage than a single-product SaaS company. It also does not mean consolidation saves money: platform consolidation usually moves cost from many line items to one large one and trades tool count for negotiating position. The finding supports one narrower claim, which is that tool count has grown past the point where security leaders believe they can operate what they own.

Sources

Every external figure on this page, with its origin, sample, and the date it was last checked by hand.

58% of surveyed organizations operate more than 25 security tools, with large enterprises often running 50 or more, and close to half of security leaders naming cloud complexity and tool sprawl as a constraint on their program.
Wiz, 2026 CISO Budget Benchmark ReportVendor research · Published December 2025 · Sample: 300+ security leaders · Verified August 28, 2026
Self-reported survey of security leaders, skewed toward cloud-native organizations by the sponsor's customer base. Tool counts are respondent estimates, not discovered inventories, which in practice undercount.

Common questions

How many security tools does the average organization run?: Wiz's 2026 CISO Budget Benchmark, based on more than 300 security leaders, found that 58% of organizations run over 25 security tools, and that large enterprises frequently run 50 or more. These are self-reported counts, so the real figure is likely higher once shadow purchases and embedded platform features are included.
Is security tool sprawl actually a problem?: Security leaders say it is. In the same 2026 Wiz survey, close to half of respondents named cloud complexity and tool sprawl as an active constraint on their security program, ranking it alongside budget as a limiting factor. The cost is operational rather than financial: integration burden, alert volume, and renewal overhead.
Does spending more on security tools improve outcomes?: Not reliably at the top of the range. Wiz found that 60% of organizations spending over $25 million annually still reported their security budgets fell short of what current threats require, making the highest spenders among the least confident respondents in the survey.

58% of Organizations Run More Than 25 Security Tools

What this does not mean

Sources

Common questions

Go deeper