Why Tool Count Is the Wrong Security Metric

Why Tool Count Is the Wrong Security Metric CybaVerse's Oliver Spence on Matching Tools to Business Outcomes Mathew J. Schwartz (euroinfosec) • June 8, 2026     Share Post Share Credit Eligible Get Permission Oliver Spence, CEO, CybaVerse Mid-market organizations manage 30 to 40 security tools on average, yet many still struggle to define the outcomes these tools should deliver. The fix should start well before any procurement decision, said Oliver Spence, CEO of CybaVerse. See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready? "Everything should be outcome-based, not tool first," Spence said. "There's no point buying any technology. This is a problem. They have people go and buy technology first, then they go around asking these questions about what is the outcome that we've got?" Defining those outcomes requires input from across the security team, not just leadership. Engineers closest to the tools often have the clearest view of what's working, what's redundant and where the real gaps are. In this video interview with ISMG at Infosecurity Europe 2026, Spence also discussed: Why platform consolidation and best-of-breed strategies both have trade-offs; How artificial intelligence adoption can contribute to tool sprawl and governance challenges; How data sovereignty concerns are renewing interest in on-premises infrastructure. Since co-founding CybaVerse, Spence has transformed the company into an award-winning cybersecurity firm with thousands of customers worldwide. Under his leadership, CybaVerse has become a trusted name in simplifying cybersecurity for SMEs and MSPs, offering innovative, automated solutions that empower businesses to enhance their security posture.