--- title: "Why cybersecurity still needs specialized tools" description: "Should organizations put their faith in specialized best-of-breed tools built to solve a specific problem or opt for more general end-to-end suites?" locale: "en" updated_at: "2026-09-03T12:48:31.625Z" canonical: "https://www.isdecisions.com/en/blog/it-security/why-cybersecurity-still-needs-specialized-tools" --- # Big tech can't solve every problem: Why cybersecurity still needs specialized tools _Should organizations put their faith in specialized best of breed tools built to solve a specific problem or opt for more general end-to-end suites?_ **The tension between the strength of a behemoth platform vs. a sturdy point solution has been an issue in IT since the 1990s. No category of enterprise software has escaped the debate, which lives on today in the pros and cons of traditional on-premises applications, open-source tools, and AI agents, versus the all-in-one capabilities of cloud and SaaS platforms.** A lot of the time this boils down to an argument about how software evolves. Most of today's popular software ideas began life as specialist standalone applications that were eventually acquired by larger platforms offering more features. The point of moving to a larger platform was simpler management. It's just a lot easier to have one integrated system or service to manage than running lots of individual applications side by side. Everyone assumed cybersecurity would work in the same way. Startups funded by venture capital would invent solutions to often complex, niche security problems and larger companies would eventually acquire the best of these to integrate and sell as part of larger do-it-all platforms. To some extent, this has turned out to be true; many smaller cybersecurity vendors have been bought by larger vendors for this reason. Over time, this should have made cybersecurity a less fragmented industry focused on a core of large companies.  And yet the opposite has happened. The small specialist companies continued to appear at a steady rate while larger platforms were still trying to integrate their last round of acquisitions, Today's cybersecurity market remains as fragmented and confusing as ever. Big companies have thrived, of course, but so have smaller ones. Open-source tools from smaller developers, meanwhile, have added to the mix, innovating in ways that larger platforms will always struggle to match. ## Cybersecurity's long tail The first and most often-cited explanation is that larger companies are less inclined to innovate. As soon as an innovative security application has been absorbed, its founders and engineers drift away and the product loses momentum. It becomes all about managing existing accounts and customers. This doesn't always happen but there are well-documented cybersecurity acquisitions where this has been the case. Cybersecurity is also a complex and demanding sector. Threats evolve more rapidly than traditional product development and R&D cycles can keep up with. Being innovative in a market where a new security threat might appear at any moment is inherently difficult. This makes new, more focused companies an inevitability, a pattern the recent boom in startups addressing AI risks would appear to continue. However, an intriguing third possibility is that small companies just do a better job than larger ones at a more competitive price.  Being small ensures you stay close to customers and their problems in ways the market values. This applies to startups but also, importantly, to SME security companies that expand organically over time. On paper, growing slowly and steadily should be a hard path because it forces small tech vendors to stay competitive without investor cash to accelerate product development. This isn't supposed to be how the tech industry works where the whole point is to innovate, find a partner channel to expand sales, and acquire other small companies by grabbing their customers and IP. ## Authentication evolution In the background, as more investment has flowed towards the cloud and other outsourced services, including cybersecurity, investment by tech vendors in traditional datacenter technology has almost collapsed. It's not no money at all – Microsoft still releases small improvements to Windows Server Active Directory, for example - but it's nothing like enough to meet the problems faced by customers. This is despite datacenter or on-premise networks remaining a critical piece of infrastructure - every single customer of cloud services will still have a significant on-premise presence somewhere in its infrastructure.  Dismissed by cloud vendors as a legacy stack, these environments host numerous important applications that won't work on cloud platforms. Importantly, they also give organizations a way of countering the risk of vendor over-dependency and lock-in.  If large tech companies have lost interest in the on-premise sector, how do organizations cope? The answer in cybersecurity is by assembling a collection of tools and systems from smaller, innovative companies. The relationship between this tier of cybersecurity developers and their customers is necessarily very close. Their development model operates on a simple principle; every feature is developed to meet customer feedback and released in a cycle that doesn't impose jumps they can't keep up with. IS Decisions is a good example of this model. Founded nearly a quarter of a century ago, the company was set up after its founders noticed that organizations were struggling with the problem of concurrent logins. This is a major security risk that Active Directory offered no way of controlling.  [UserLock](/userlock/) was born to fill this gap. This wasn't a product or feature chasing a problem; the problem preceded the product's existence. And this wasn't the only problem that needed solving. Active Directory turned out to have lots of small weaknesses security teams were forced to fix for themselves, usually through time-consuming manual processes or simply by accepting the risk. As the IT security challenge ballooned, UserLock added more complex features missing from Active Directory such as [multi-factor authentication (MFA)](/userlock/features/multi-factor-authentication-mfa-active-directory), SSO, and session-level and contextual access controls. ## Adapting to a messy world The solution to one problem led to a solution for a separate problem in a cycle of continuous improvement. This never reaches a conclusion because improvement is always necessary as threats evolve. For example, simply implementing MFA is no longer sufficient on its own. In an era of credential harvesting, defenders must also track user accounts after they have authenticated. This requires a secondary layer of user account monitoring and privilege management. What started as concurrent access control had now turned into a much bigger undertaking. This is the messy world that larger cloud IAM providers avoid. In a cloud system, there is one point of access, the login or SSO redirect and a risk scoring system to assess each event. In an on-premise environment, other things matter too such as whether the connection is via a remote workstation, server, RDP connection, RemoteApp, or even happening inside an air-gapped network. What matters to Active Directory is session management against a policy, not a binary judgement about whether something is good or bad. Cloud IAM can take over the authentication process for Active Directory networks but can't fill the other gaps in native capabilities in the way that UserLock can. Nor can it monitor the authentication process when there is no Internet connection or in an air-gapped environment. That's because while UserLock adds security to the authentication process, it also solves the many contextual problems around it from inside the on-premise network itself. For UserLock, authentication is just one part of the problem. This is what it means to be close to a problem: building a custom product from the bottom up to address a specific issue rather than from the top down as part of a platform or system.  The lesson is that in cybersecurity no single system can do it all. It's hard to imagine that this will ever change. Securing an expanding enterprise attack surface is about assembling different-sized pieces of an immense puzzle.