When the Security Stack Outgrows the Strategy

By Martin Buck · October 19, 2026 · 10 min read

Guest article by Martin Buck, CISO and Head of Consulting Services at Axians BNC

On average, companies run 83 security solutions from 29 vendors. More than half of those responsible say that this very fragmentation slows down their defenses.

Key Takeaways

More tools, few connections: According to IBM and Palo Alto Networks, 52 percent of the executives surveyed say a fragmented security stack limits their defenses.
Three layers drive results: Strategy defines protection needs and risk, architecture plans the lines of defense and design determines each individual control.
AI belongs in the same strategy: Where an AI agent combines private data, untrusted content and an outbound connection, the decision is made before rollout.

After a security incident, many companies follow a familiar routine. A product is evaluated, procured and deployed and the specific gap is then considered closed. The new tool lands in an environment that already consists of dozens of such one-off decisions.

The result is a patchwork. Many tools run side by side. Hardly any are connected to the others and their combined effect remains unclear.

Every Incident Lengthens the Shopping List

Martin Buck, CISO and Head of Consulting Services at Axians BNC — **Martin Buck** is CISO and Head of Consulting Services at Axians BNC. His focus areas are information security, ISMS (information security management systems) and security architecture. View LinkedIn profile.

Switzerland shows just how intense the pressure has become. Since April 2025, operators of critical infrastructure have been required to report cyberattacks to the Federal Office for Cybersecurity (BACS). By February 2026, the BACS had logged more than 260 such reports.

The attack surface is growing in Germany too. According to the 2025 situation report from the BSI (Federal Office for Information Security), the number of newly discovered vulnerabilities per day rose by 24 percent within a year. For almost every new attack technique, the market has a matching product ready.

The result can be quantified. A study by the IBM Institute for Business Value with Palo Alto Networks put the average at 83 security solutions from 29 vendors per company in early 2025. Palo Alto Networks sells platforms itself, so the finding comes from an interested party.

Security solutions per company on average, IBM IBV and Palo Alto Networks 2025

12%

Swiss companies cut measures due to lack of budget, Sophos 2025 (n=50)

+24%

Increase in newly discovered vulnerabilities per day in Germany, BSI Situation Report 2025

The money for additional tools is limited. In the same Sophos survey from spring 2025, 10.5 percent of the executives surveyed in Germany said they had cut planned security measures due to lack of budget. Every purchase without a clear mandate therefore displaces another measure from the same pot.

What the Strategy Settles Before the First Tool

The bottleneck is rarely the technology. What’s missing is a strategy that defines what deserves protection, which level of protection applies and in what order measures are implemented with the resources at hand.

Definition · Security Strategy

What is a security strategy? A security strategy defines which systems and data need the highest level of protection, which risks a company knowingly accepts and in what order it closes gaps. It reconciles that sequence with budget and staffing and it provides the yardstick for every later architecture and product decision.

This reconciliation determines the impact. The biggest security gain comes from the right measure at the right time, even if it is smaller than the most extensive project on offer.

Teams that skip this step and jump straight into architecture and implementation lose that yardstick. Security audits then produce findings with no strategic context. Individual measures get implemented while other risks are left untouched.

Three Layers, Each with Its Own Guiding Question

Security delivers results when three layers are kept cleanly separate and then aligned with one another. Each layer answers its own question and passes its requirements on to the next.

1. Strategy: What Needs to Be Protected?

This is the layer where the fundamental decisions are made. Which processes must never fail? Which data must never leave the organization? What residual risk is the company knowingly willing to carry? The outcome is a documented protection requirement with priorities, agreed with executive management.

2. Architecture: How Are the Lines of Defense Planned?

Architecture translates the protection requirement into structure. It defines zones, identities and trust boundaries and determines where detection and response come in. This is where it becomes clear whether a planned tool closes a gap or duplicates a function that already exists.

3. Design: Which Measure Is Implemented Where?

Only at this layer do products, configurations and operational procedures come into play. Every design decision can be checked against the two layers above it: it serves a documented protection requirement and fits into the planned structure.

In many companies the sequence runs the other way around. The product decision comes first and architecture and strategy are explained after the fact to fit it. The overview below shows what is missing when a layer is skipped.

Layer	Guiding question	Output	Consequence if it is missing
Strategy	What needs to be protected and what risk is accepted?	Protection requirement, risk appetite, priorities	Audits without a benchmark, budgets driven by gut-feel urgency
Architecture	How are lines of defense and systems structured?	Zones, identity model, detection points	Duplicate functions, gaps between tools
Design	Which measure is implemented where and how?	Products, configurations, operational processes	Tools without operations, alerts without an owner

NIS2 Makes the Sequence Auditable

In Germany, the question of strategy has also been a legal one since December 6, 2025. That was the day the NIS2 Implementation Act entered into force, bringing with it the new BSI Act (BSIG), named after the Federal Office for Information Security (BSI).

Section 30 BSIG requires affected entities to adopt appropriate, proportionate and effective risk management measures. Proportionality can only be justified against a documented protection requirement. A list of purchased products hardly proves it on its own.

Section 38 BSIG places responsibility squarely on senior management. Management must implement the measures, oversee their implementation and take part in regular training. If it breaches these duties, it is liable to the entity.

For Swiss companies with branches in Germany, this applies directly, provided those branches fall under the law. In Switzerland itself, the reporting obligation for critical infrastructure creates a similar impetus: anyone who has to report needs clarity about their own critical systems.

AI Opens New Data Paths Through the Architecture

Artificial intelligence raises the pressure to get this right. Every assistant, analysis function and automated workflow creates data paths that appear on no existing network diagram.

Some of these paths appear unplanned. According to a summer 2025 survey by Bitkom (Germany’s digital industry association), employees using personal AI tools for work is widespread in 8 percent of German companies and occurs in isolated cases in a further 17 percent.

AI agents are especially delicate. The developer Simon Willison calls it the “lethal trifecta” when an agent has access to private data, processes content from untrusted sources and can communicate externally. When all three properties coincide, a doctored web page or email can trick the agent into leaking data.

AI security therefore belongs in the same strategy as any other critical system. Before rollout, it must be settled which data flows where, who has access and who is accountable when something goes wrong. Governance, transparency and clear responsibilities apply to AI systems just as they do to the rest of critical infrastructure.

Five Questions to Ask Before the Next Purchase

The three layers yield a simple filter for every new purchase. It fits on a single page and can be built into the procurement process.

Before signing off on a security tool

✓Which documented protection requirement does the tool address?
✓Which line of defense does it fit into and which existing function does it duplicate?
✓Who runs it day to day, triages its alerts and responds to them?
✓What data does it process and does it use AI features that connect to external services?
✓Which measure slips down the priority list if the budget goes to this tool?

A tool that can answer these questions strengthens existing defenses. If two or more answers remain open, the decision belongs back at the strategy level.

For CISOs, this changes the conversation with executive management and procurement. It centers on protection requirements and sequencing, with the product coming last. Every investment then becomes defensible to auditors and regulators.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

Is tool consolidation the same thing as a security strategy?

Consolidation reduces the number of tools and contracts. Whether the right capabilities remain afterward depends on one thing: a documented assessment of protection requirements. Without it, decommissioning can strip out controls that auditors will later find missing.

Who is responsible for security strategy in your organization?

It is usually drafted by the CISO (Chief Information Security Officer) together with the business units. Risk decisions, however, rest with executive management. In organizations covered by NIS2, management also bears legal responsibility for those decisions.

Do AI applications need their own security strategy?

You need dedicated rules within your existing strategy: approved tools, permitted data classes, logging and a named owner for each use case. For AI agents, there is an added question: which combinations of data access and external communication are acceptable?

What Do Security Audits Achieve Without a Strategy?

Audits and penetration tests uncover specific vulnerabilities. Deciding which ones to fix first, however, is only possible once protection requirements have been defined. A security strategy turns the audit report into a prioritized action list.