CISOs Say Security Tool Churn Is an Operating Model Problem
Summary
CISOs say tool churn and slow vulnerability response often stem from unclear ownership, coordination and corporate priorities—not inadequate technology. They recommend assigning tool owners, defining use cases and reconsidering barriers to automated response.
Key points
- Bobby Singh said security tools are often replaced because they were never fully operationalized, not because the tools were inadequate.
- Singh recommended naming a business owner for each tool and reviewing its value after 90 or 120 days.
- Aditya Gurg said a vulnerability fix took an hour, but closure took three days because teams had not agreed on notification, emergency-change approval and business communications.
- Cotiviti uses a framework of 80 questions to identify 10 priority use cases for a new tool or product, assigning an owner to each use case.
- Carey Frey argued that resistance to automated defensive actions can leave organizations analyzing attacks and responding days later.
- Larry Zelvin said CISO reporting lines can limit access to senior decision-makers and called for reconsidering whether security leadership should sit outside technology.
Article Details
- Topic
- Organizational and operational barriers to effective cybersecurity, including security-tool churn, unclear ownership, vendor relationships, and resistance to automated defensive actions.
People
Aditya GurgSenior manager for platform security engineering and operations at Cotiviti who described coordination delays in vulnerability remediation and a framework for assigning tool-use-case owners.Bobby SinghFormer global CISO of Manulife who discussed operational-model problems and strategies for improving ownership and value realization of security tools.Carey FreySenior vice president and global chief security officer at Telus who discussed vendor relationships, organizational resistance to automated defensive actions, and the need for faster response capabilities.Larry ZelvinExecutive vice president for financial crime and head of security advisory for BMO Financial Group who discussed CISO reporting structures and organizational barriers to security decision-making.