By Sumera Riaz, VP of Cybersecurity
Your clients are buying recommended security tools. They’re running assessments and passing audits. Yet their security environments are changing faster than they can keep up, with AI sprawl, shadow IT and unmonitored edge devices creating blind spots. As a result, many security leaders are questioning whether they have the security in place to support their broader technology decisions.
That lack of trust in the tech stack was the focus of a recent HITT discussion I had with Telarus VP of Cloud Chad Muckenfuss. Chad and I see this every week from two different seats—cybersecurity and cloud—and we’ve realized that it is not two separate problems, it’s the same view from both perspectives.
When companies lose confidence in their IT stack, the consequences don’t show up on a security dashboard. They show up as a frozen budget, a stalled migration, a product roadmap slipping another quarter, and a competitor getting to market first.
Nobody ever calls that a security problem. It gets logged as slowed growth.
That gap—between what’s actually wrong and what the company thinks is wrong—is the single best opportunity technology advisors have to bring clarity in a complex environment.
What Trust Actually Means to IT Leaders
Trust is the confidence to move in a consistently verified state. That’s it.
It’s not a feeling, and it’s not a vendor logo on a slide. Trust is the ability of an IT leader to say, “I know what’s running, I know it works, and I can build on top of it.”
“When that confidence breaks, the first thing I see slow down is production, and it doesn’t matter what vertical we’re talking about,” Chad says “Manufacturing, sales, reporting, all of it crawls, because nobody trusts that what they put into the network is producing what’s supposed to come out the other side. The technology usually works fine. The willingness to lean on it is what’s gone.”
I’ve lived the other side of it. Years ago as a CISO, I had 278 line items of security software on my books after a couple of mergers. At one point we had three email security solutions; two of them not even turned on. I was paying for all three.
None of that was careless. Every line got bought for a good reason at a moment when it solved a real problem. They just accumulated faster than anyone could keep up, until no one could tell you with confidence what was protecting what. Our speed to market slowed, and for far too long I read that as a growth problem instead of a stack problem.
More tools did not fix this.
According to research from IBM and Palo Alto Networks, the average 500-person business is now running 83 different security tool sets from 29 vendors, generating roughly 4,330 alerts a day, managed by about two and a half people.
That’s possibly a company paying for redundancy in coverage, drowning in noise, with a team too small to work the queue. Every one of those environments contains duplicate spend that could be reallocated into something that improves their posture—a penetration test, a managed service, or real visibility.
It is not a rip-and-replace conversation. It’s a right tech, right size, and the right time conversation. It is one most companies are receptive to right now, because vendor loyalty is at an all-time low.
The tools aren’t delivering, and buyers know it.
The Threat Landscape Changed. The Architecture Hasn’t.
Here’s the structural problem underneath all of it.
30+ years of security tooling was designed around human psychology—stopping internal and external threats. None of it was built for an AI identity that switches credentials in the ordinary course of completing a task, or overrides existing guardrails.
Meanwhile, attackers have industrialized. They’re using AI to scale volume and speed in ways a human defender simply cannot match.
This isn’t a question of intellect. We’re smart—we built AI. It’s a question of speed. You can’t outrun a car on foot. You need AI to fight AI. And as Chad points out, the economics are brutally asymmetric.
“The cost of launching an attack has collapsed while the cost of absorbing one hasn’t moved at all,” Chad explains. “That imbalance is why ‘we’ll handle it internally’ stopped being a viable answer somewhere in the last 18 months.
Why Technology Leaders Are Losing Confidence in Their Security Stacks
From the client side, the picture is consistent:
- Threats are accelerating: According to KPMG, 83% of organizations reported an increase in cyberattacks over the past 12 months. Yet many companies have stale security stacks, while only 24% have fully integrated AI into cybersecurity. That’s your assessment conversation.
- The cyber skills gap persists: According to SANS, 60% of organizations say the skills gap is their primary cybersecurity concern. That’s your managed services conversation, and a pathway to recurring revenue.
- AI risks are rising: In CSC’s CISO Outlook 2026 Survey, 98% of respondents expressed concern about the risks of giving third-party AI-based systems access to company data. That’s your visibility conversation, opening the door to cloud security, device discovery and endpoint management.
Tool longevity used to run about five years. This past year, we’ve watched it compress to roughly one. Which means the renewal sitting on your client’s calendar next quarter is no longer a renewal. It’s a reset — and resets are where footprints expand.
The Five Architectural Elements Your Clients Can’t Ignore
As you engage your clients about consolidation, keep in mind that fewer tools alone won’t rebuild trust. It’s also important to ensure that the underlying security architecture is built for the way today’s threats operate.
This starts with five core architectural elements:
- Identity-first/ Zero Trust: Continuous verification, least privilege, microsegmentation
- Quantified risk: Governance and metrics in board-level risk language
- AI as defense: SOC automation, behavioral analytics, augmented detection
- Data-centric protection: Classification, encryption, DLP that travels with the data
- Assume-breach resilience: Tested IR playbooks, recovery objectives, tabletop exercises
Three Discovery Questions to Bring to Your Cybersecurity Conversations
The best part of this opportunity is that it doesn’t require prospecting, and it doesn’t require you to be a security specialist.
Pick whichever one matches the practice you already sell into:
- From cloud: When your data moved to the cloud, who took over securing it: you, or the provider? Most clients assume Microsoft, AWS, or Google covers all of it. They don’t. Endpoints, identities, and the data itself still need a wrapper around them.
- From networking : How many devices touch your company data today? They won’t know. That opens the door to a scanning tool, a configuration management database (CMDB), a security assessment, and a cloud assessment, usually in that order.
- From CX : On customer calls, how do your agents know whose voice is on the line? Voice fraud has evolved faster than most contact center security has.
Remember: You don’t necessarily need new prospects. You need to be asking the right questions inside of the meetings you’re already having.
Don’t write off the small accounts
As Chad reminds us, “It’s not the big logos getting hit most often. It’s the mechanic’s shop and the pizza place down the street, because they have minimal tooling, minimal protocols, and they’re far more likely to pay a $5,000 or $10,000 ransom than fight it. They assume nobody wants their tire receipts. Anything making money today is a target.
We’ve built the portfolio deliberately so this isn’t a coverage problem for you—five users up to tens of thousands. If you’ve been passing on SMB security conversations because you assumed the economics didn’t work, they do now.
Where This Goes Next: Consolidation
The direction of travel across the industry is platform consolidation, fewer panes of glass doing more work.
That’s the same message Telarus Chief Revenue Officer Dan Foster delivered on the 2026 Partner Summit stage about modern enterprise architecture, and the security architecture that complements it is heading the same way.
And as Graeme Scott, Telarus VP of Advanced Networking and Mobility puts it: companies have two objectives—save money and make money. A consolidation conversation does both, by taking cost out of a bloated stack and giving the client back the confidence to move faster. You get to be the advisor who delivers both benefits.
So bring us into the conversation. Leverage our expert engineering team, and let’s work together to close the trust gap
Our motto on the security and cloud side hasn’t changed: We want to leave people and companies better than we found them.
Watch the full HITT session → | Browse the HITT series → | Subscribe to the BizTech podcast →
ABOUT THE AUTHOR
Sumera Riaz
Sumera Riaz is Vice President of Cybersecurity at Telarus, a CISSP-certified former Chief Information Security Officer turned industry advocate on a mission to change how cybersecurity is sold. Based in the Dallas–Fort Worth area, she empowers technology advisors to confidently guide their clients through AI risk, enterprise security, and what’s coming next—including the quantum computing shift organizations can’t afford to ignore. A Forbes Council member and sought-after speaker, Sumera translates technical complexity into human clarity, making the scary feel manageable and the stakes impossible to ignore. Her mission is simple: to leave every company better protected than she found it.