The best cybersecurity investment might be buying less security, says Julien Richard, CTO and co-founder of the platform Filigran.
For years, organisations have answered each new cyber threat by buying another security tool. A new risk appears, a specialist product promises coverage, and another dashboard joins the stack. Coverage on paper grows faster than the quality of decisions. Fragmented data, overlapping capabilities, and disconnected workflows make it harder to see which risks deserve attention.
The strongest case for buying less security is about where investment goes: away from piling up products and towards an operating model that turns existing capabilities into measurable risk reduction. As the co-founder of a cybersecurity vendor, I believe that same scrutiny should apply to us. Every product, including our own, should have to demonstrate the value it delivers. Cost savings may follow, but they’re a side effect. Filigran’s State of Threat Management 2026 report surveyed 550 cybersecurity leaders and practitioners at organisations with over 1,000 employees. The research was conducted by independent research firm Vanson Bourne. It found that only 41% have a fully consolidated view of their cyber risk exposure. Respondents also reported spending 42% of their time investigating risks that later proved low priority or non-exploitable.
The gap between visibility and action
Tool sprawl is often described as a noise problem. The bigger issue is the distance between visibility and action. A team may know that a vulnerability exists, an adversary is active, or an asset is exposed, yet still be unable to tell how likely exploitation is, what the business impact would be, or whether existing controls will hold.
That distance is the exposure gap. In the report, 84 per cent of organisations said attacks exploit risks that were already known but not prioritised, and 97px said they struggle to determine whether identified exposures are exploitable. Teams have plenty of data. What they lack is context and continuity. A new product can widen the gap when its findings stay disconnected from decisions, validation, and remediation.
Threat intelligence is valuable when it changes a decision. On its own, it becomes another stream of indicators, reports, and alerts. Its value grows when it’s connected to an organisation’s assets, vulnerabilities, controls, and changing attack surface. That context helps teams answer practical questions:
ยท ย ย ย Which threat actors and techniques are relevant to us?
ยท ย ย ย Which critical assets can an attacker reach?
ยท ย ย ย Which weaknesses create a credible attack path, and which controls are likely to stop it?
The answers let teams separate theoretical possibility from material risk.
Maintaining that context is hard: 93 per cent of respondents said they struggle to keep an accurate view of their attack surface. A current, shared picture of the environment is the foundation for applying intelligence to it.
Prioritising what attackers can exploit
Traditional vulnerability management often produces a long queue where technical severity stands in for risk. Severity alone can’t show whether a weakness is reachable, relevant to active adversaries, covered by compensating controls, or attached to a business-critical service.
Continuous validation adds that missing evidence. By testing whether a plausible attack path works and whether controls respond as expected, teams replace assumptions with observed results. Remediation can then focus on risks that are both likely to be exploited and capable of causing significant business harm.
Lower-priority findings stay on the list, in proportion to the risk they carry. Evidence-based prioritisation also gives leaders a defensible explanation for why one issue must be fixed now while another can wait, and it ties security work more closely to business risk.
Running the full CTEM loop
Continuous Threat Exposure Management (CTEM) provides a structure for making that connection. CTEM is a continuous operating model, and adopting it changes how existing tools and teams work together. It’s built around five linked stages:
1. ย ย Scoping identifies the business outcomes, critical assets, and boundaries that matter.
2. ย ย Discovery maps exposed assets, weaknesses, and potential attack paths.
3. ย ย Prioritisation combines threat intelligence, exploitability, and business impact to decide what deserves attention.
4. ย ย Validation tests whether exposures can realistically be exploited and whether defences work.
5. ย ย Mobilisation turns evidence into action by assigning owners, building remediation into daily workflows, and measuring whether risk has fallen.
The stages create value when they run as a continuous loop. Scoping produces hypotheses until validation tests them. Validation produces reports, and mobilisation turns those reports into risk reduction. Threat intelligence should guide what’s tested, validation should refine priorities, remediation should change the attack surface, and each change should inform the next cycle.
For many organisations, this loop can run on the stack they already have. What it requires is orchestration: connecting intelligence sources, asset data, exposure management capabilities, validation tools, and remediation workflows. Duplicate products can be retired, and the remaining stack can be judged by the decisions it improves and the risk it removes, rather than by the volume of alerts it generates.
Consolidation has its own costs. Retiring a tool means migrating data, retraining teams, and getting through a transition period. Some gaps are real, too: if no existing capability covers a critical part of the attack surface, a new purchase may be the right call.
Getting more out of less
Buying less security means expecting more from what’s already in place. Before approving another purchase, leaders can ask one question: is this a missing capability, or a failure to connect the ones we have?
Investment in integration, continuous validation, automation, and clear accountability may deliver more value than another isolated tool. I believe the most resilient organisations will be the ones that continuously understand what matters, prove what’s exploitable, and mobilise action before attackers do, whatever the size of their security estate.
