Microsoft and Omdia report the cost of a fragmented security desk

A Microsoft and Omdia report published in February described security operations teams switching between an average of 10.9 consoles. Its release also said only about 59% of tools fed data into the organisation’s SIEM, leaving manual ingestion and investigation work. These are findings from the commissioned research, not universal measurements of every security team.

The report argues that disconnected signals slow the reconstruction of an incident. That is a more specific problem than simply owning a large number of products. An organisation assessing the claim can examine whether its tools share relevant identity, endpoint and cloud context, and whether an analyst can retrieve it during an investigation. Microsoft also uses the findings to support its integrated-platform offering.