Security Complexity Is an Operational Risk by Heath Gieson Most organizations do not set out to create a complex security environment. It usually happens one reasonable decision at a time. A new tool is added after an incident. Another is purchased to satisfy an audit finding. A third comes bundled with a platform refresh. Each decision makes sense on its own. Over time, though, the environment becomes harder to operate, not more secure. What often gets labeled as “tool fatigue” is really...















