Buying tools is not security

Nov 03, 2026 (updated on Nov 09, 2026)

Most SMEs already have the tools: firewalls, scanners, mail filtering, patch management. The most expensive misconception in security is that the purchase does the work. In this article: why tools without follow-up give false confidence, how you recognise that, and what rhythm it takes to do something about it.

The purchase is not the work

Tools are necessary, and sometimes they are simply missing, more on that in a moment. But a scanner that produces reports nobody reads is a doorbell ringing at the neighbours. It rings, someone glances over, but nobody is home. Tools without follow-up give false confidence, and false confidence is more dangerous than no confidence.

An anonymised situation from a few years ago stuck with me precisely because everything seemed to be in place. A solid environment, mostly on-premises: firewalls, scanners, mail filtering, patch management. Tick every box on the checklist. Until you start asking: who is actually looking at this? The scanners produced a monthly report nobody opened. Logging had gone silent without anyone noticing. Alerts had come in that nobody responded to, not out of bad will, but because nobody knew it was their task.

Set and forget, it is called. The tools ran on autopilot, and a tool that says nothing feels, to everyone, like a tool that is content.

Rarely bad will, usually a missing rhythm

This happens to motivated, capable teams. What is missing is ownership and rhythm. The tools were often bought in different periods: one came from a project, another from audit advice, a third from a promotion. Nobody ever drew up an overall picture afterwards of everything that now rings, let alone who is supposed to respond.

And to be honest: follow-up is work without glamour. Triaging an alert rarely wins from the director's broken printer. So the follow-up quietly shuffles to the bottom of the priorities, until nobody remembers it existed.

Sometimes the tool is precisely what is missing

The other side of the story is often forgotten. At that same organisation, the world had changed in the meantime. The architecture was designed for an on-prem era, but the organisation had long been spread out: parts of the environment sat outside its own walls, with a cloud party, in collaboration with external partners. And the security had never followed that move. For what stood outside, the basic tools were missing entirely. Had everything stayed on-prem, the security level would have been quite acceptable. But that is no longer the world, and you see this seam everywhere: the bricks are secured, the move is not.

An empty log is a blind spot

You notice it in the incident log. The one from this organisation counted a handful of reports per year. That is impossible. Not because nothing happens, but because nobody looks. Whoever starts following up seriously for the first time almost always sees the number of incidents rise. That feels like deterioration, and it is exactly the beginning of insight. Before that rise, the same was already happening, only nobody knew.

At a security conference I recently heard it summed up sharply: we know nothing. Something else stayed with me: a playbook you never rehearse is a theory. That applies just as much to tools: a follow-up rhythm that nobody executes is not a rhythm.

How to repair it without replacing everything

You start from what is already there, because it tells you enough if you listen:

1. Every tool gets an owner. Someone who knows, by name, that they follow up that tool's alerts and reports.
2. Every working day gets a fixed moment. A half-hour morning glance through yesterday's alerts, logs and reports.
3. A finding? Then an action follows, not a folder. Whatever you pick up also gets a resolution.
4. Where knowledge is missing, training follows. Understanding a tool is part of following it up.
5. No new tool comes in without an answer to the question of who is going to follow it up.

Standardisation helps: the fewer exceptions and loose islands, the smaller the blind spots. That rhythm does not need to be impressive. It needs to exist, and it needs to happen every working day.

So when is a new tool the answer?

When the measurement proves there is a gap you cannot close with the means you already have. At that organisation that was the case for the parts outside the walls: the tooling was simply missing there. But the order is not upside down: measure and follow up first, buy only then. Purchasing a tool because a vendor called, or because a competitor tweeted about it, is the world turned inside out.

Take the test

Open the console of your most important security tool and check when someone last looked at an alert or opened a report. If the answer is uncomfortable, you have just taken your baseline measurement. Those who have no time for it, or no person who can be freed up for it, do what more and more SMEs do: outsource it to a party for whom this is the core of the work. At Dunetrails that is part of the daily service: we monitor the scores and signals of your Microsoft 365 environment and follow them up, without you having to keep a helpdesk for it. And whoever wants to know how that becomes measurable, first reads our article on Secure Score and Exposure Score.

Earlier we wrote about why "we do security already" is usually a feeling rather than a measurement: We do security already?

Or first test for free whether your e-mail domain can be spoofed: the email scan takes 2 seconds.