The 'Too Many Tools' Webinar Is a Sales Pitch. The Numbers Behind It Are Harder to Find.
Vendors keep telling network teams that consolidation and AI will fix incident response. I asked four of them for the data. None sent any.
A webinar making the rounds this month argues that network incident response is broken because analysts swivel between monitoring dashboards, infrastructure consoles, ticketing systems, and chat tools during outages. The pitch: automation and AI-assisted workflows cut mean time to resolution. The webinar does not name the products. It does not cite a study. It does not say who paid for the slot.
That is the part worth examining.
The underlying claim — that tool sprawl slows response — is not controversial. The 2024 IBM Cost of a Data Breach report put the average breach lifecycle at 258 days and flagged "security system complexity" as a cost amplifier worth roughly $241,000 per incident. Gartner's 2023 SOC survey, which I have a copy of but cannot link because it sits behind a client paywall, found the median enterprise SOC runs between 25 and 49 discrete tools. So far, so familiar.
What the webinar abstract does not say is which vendor is sponsoring it. I asked the organisers on 4 November. I asked again on 7 November. A third email on 11 November went unanswered. (The contact address bounced a delivery receipt but no reply.) The landing page lists no sponsor logo, which is unusual for a free industry webinar and, in my experience, usually means the sponsor would prefer not to be quoted in coverage of their own event.
The AI-assisted-workflow claim is the one that deserves pushback. "Automation reduces manual coordination" is a true sentence and a useless one. It does not say whether the automation is rules-based playbooks (which have existed since Phantom shipped in 2016, before Splunk bought it for $350 million in 2018) or LLM-driven triage, which is newer and has a worse track record. Tines, Torq, and Palo Alto's XSOAR all sell into this category. None of them, when I checked their public case studies last week, publish a controlled before-and-after MTTR figure with methodology attached. The numbers that exist are customer-supplied and unverified.
I put three questions to a researcher who studies SOC workflow design, Allie Mellen at Forrester. Does consolidating tools actually reduce MTTR, or does it reduce the number of vendor invoices? Is there peer-reviewed data on AI-assisted triage accuracy in live incidents? And who is auditing the auditors? Mellen has written publicly that "tool consolidation" is often a procurement story dressed up as an engineering one. She has not yet responded to my follow-up on the webinar specifically.
The webinar runs next week. The replay will presumably be gated behind a lead form.
Who, exactly, is buying the leads?
