Ask a security operations analyst how many consoles they open during a routine data investigation, and the number is rarely small. Ask how confident they feel that they’ve successfully assembled a comprehensive picture, and the number drops further. For a majority of security teams it isn’t a lack of data that erodes both efficiency and confidence: quite the opposite in fact.
58% of organizations now run 11 or more separate data security tools. Only 7% describe that stack as fully unified. The gap between those two numbers is where the real cost of tool sprawl lives.
What does security tool sprawl look like?
The data I am using here comes from a very up-to-date piece of research, conducted by Cybersecurity Insiders. Every organization in the survey has 2,500 or more employees, and most have built layered defenses across email, cloud, endpoint, and SaaS over several budget cycles. That investment shows up positively as coverage, but what it hasn’t produced is coordination. 60% of respondents describe their approach to protecting sensitive data as moderately or highly fragmented, and 23% say their tools share almost no context with each other.
Buying an eleventh tool to close a gap the first ten couldn’t close is not obviously progress, even when each purchase made sense on its own. Each additional tool carries its own log format, retention window, and level of detail, and someone has to reconcile all of it before an investigation can even begin.
Investigations are where tool sprawl hurts
The report puts a number on that reconciliation work when you look through the lens of investigations. 45% of security teams query six or more separate systems per investigation, and 16% query more than 10. A single external-sharing incident can require CASB access logs, endpoint DLP events, email metadata, and identity provider activity (each with its own timestamp format and export process) before an analyst can even start assessing what was exposed.
When practitioners were asked what fragmentation actually costs them, you could almost hear the burnout. The manual effort of correlating data across systems was cited by 44%, followed by inconsistent policy enforcement (42%) and visibility gaps between tools (40%). That manual effort has a direct effect on capacity: only 9% of organizations can fully investigate “nearly all” sensitive-data alerts, and 56% investigate half or fewer. Automation should be closing that gap, but only 10% describe their automation as extensive.
The blind spots concentrate exactly where risk is growing
Fragmentation would potentially be a manageable inefficiency if it were spread evenly, but it isn’t. The researchers found visibility strongest in email, at 36%, and weakest in AI tools, at 10%. Only 7% of organizations can track sensitive data moving between applications in real time, and a single workflow that crosses from SaaS to a private app and onto an AI assistant can cross three of those visibility boundaries before anyone notices.
The same pattern holds for data that changes form. Only 9% of security teams can reliably recognize sensitive data once it has been copied, summarized, or rewritten (often by the same AI tools employees adopted faster than security teams could govern them). A file blocked from upload can reappear minutes later as pasted text or an AI-generated summary, and 17% of organizations still rely on exact-match detection that misses exactly that scenario.
Fragmentation becomes a legal problem under deadline
The cost of uncoordinated tooling doesn’t stay inside the security team. It resurfaces the moment a regulator, auditor, or legal team asks what happened. Only 12% of organizations can quickly produce a comprehensive, auditable chain of custody, and 46% require significant manual effort across systems or struggle to produce sufficient evidence at all.
That matters because breach notification clocks don’t pause for reconciliation work. GDPR gives organizations 72 hours. The report found that 27% of organizations either take weeks to reconstruct a sensitive data path, or never have enough evidence to do so at all, meaning legal and privacy teams are sometimes forced to make notification decisions before the technical picture is clear.
Coordination (not just consolidation) is the fix
None of this is a case for buying fewer tools, and it isn’t a case for treating consolidation as a cure-all either. A single connected platform (well connected within a healthy and live partner ecosystem) provides for a unified approach to data security that works to solve all these challenges.
What separates the organizations that investigate in hours instead of days isn’t the number of products in their stack. It’s whether classification, policy, and evidence travel with sensitive data as it moves, changes form, and lands somewhere new, so analysts spend their time assessing exposure instead of reconstructing it. That’s an architecture question long before it becomes a shopping list. Anyone building next year’s data security roadmap should start by asking how many consoles their analysts open during a routine investigation, and whether that number is going up or down.
Read the full 2026 Unified Data Security Report from Cybersecurity Insiders and Netskope for the complete data set.
* Cybersecurity Insiders and Netskope, 2026 Unified Data Security Report, June 2026
