At a glance

• Organisation: a UK health-tech company handling regulated health data
• My role: led the review, the vendor evaluation, the recommendation, and the rollout
• Estate: endpoints across Windows, macOS, and Linux, plus cloud workloads
• Result: around 60% lower annual security tooling spend, with wider coverage than before

The problem

The organisation was paying a significant annual fee for its security tooling. The question wasn't just "can we pay less?" It was whether we were paying for the right coverage for the estate we actually had. With endpoints on three operating systems and workloads running in the cloud, the tooling needed to protect all of it without the team juggling several consoles.

How I approached it

1. Mapped what we actually had to protect: every operating system in the estate and the cloud environment, rather than starting from vendor feature lists.
2. Set the requirements the replacement had to meet:
   • native protection for Windows, macOS, and Linux
   • cloud-native security for our workloads
   • detection and response the team could run day to day
   • a total annual cost that made sense for an organisation of our size
3. Researched the market and liaised with several vendors, comparing each against those requirements rather than against each other's marketing.
4. Recommended one platform that met all the requirements, and ran the migration.

The trade-off

Consolidating onto one platform brought everything into a single console at a much lower cost. But it didn't cover everything. Patch and vulnerability management needed dedicated tooling. Rather than accept that gap, I onboarded a specialist patch and vulnerability management platform to sit alongside endpoint protection. Remediation now runs continuously instead of as a periodic exercise.

Results

• Around 60% saved every year on security tooling
• One platform covering every operating system in the estate, plus the cloud
• Continuous patching and vulnerability remediation, closing the one gap consolidation left
• A simpler day-to-day operation for the team, with fewer consoles to watch