What If Complexity Is Our Biggest Security Risk?

Having worked in telecommunications for a long time, one thing I’ve seen repeatedly is how easily complexity accumulates. A business starts with one system. Then it needs another. A new service requires additional software. Expansion into another market introduces new integrations. Different teams choose different tools.

Each decision makes sense at the time. And eventually, the company finds itself operating an entire collection of technologies that were never really designed to work together.

Now consider what that means for cybersecurity. Every system has its own users, permissions, configurations, updates and security controls. Each may be well protected individually.

But who is responsible for making sure they are all protected consistently? That, to me, is where the conversation becomes interesting.

When every system is secure, is the business secure?

Imagine a messaging provider running several different platforms.

One handles SMS traffic. Another manages signalling. A third takes care of number portability. Others support enterprise messaging, routing, reporting or number inventory.

Each platform may come from a different vendor, have its own architecture and operate according to its own security model.

Individually, they may all meet the required standards. But what happens when they need to work together?

Who manages access across the entire environment? Who ensures security policies are applied consistently? Who monitors the connections between systems? And who has a complete picture when something goes wrong?

Suddenly, security is no longer just about protecting individual platforms. It’s about protecting the relationships between them.

And the more fragmented the environment becomes, the more difficult those relationships can be to manage.

This doesn’t mean that using different technologies is inherently unsafe. There are good reasons to work with specialised solutions and multiple vendors.

But every additional system introduces something else that needs to be understood, configured, maintained and protected.

The challenge is not simply the number of technologies involved.

It’s the number of places where security can become inconsistent without anyone immediately noticing.

The security gaps between good decisions

I find it interesting how complexity develops in organisations.

Nobody sits down and decides to build an unnecessarily complicated technology environment. Usually, the opposite happens.

A company wants to improve its services, so it introduces a better platform. It needs new capabilities, so it adds another solution. It wants more flexibility, so it integrates a different provider. These are reasonable business decisions.

But when each new technology brings its own way of managing users, permissions, configurations, monitoring and updates, the organisation also inherits another set of security responsibilities.

Over time, those responsibilities become distributed across different systems and teams.

One platform is updated. Another follows a different maintenance schedule. Access permissions change in one application but not necessarily in another. Monitoring tools provide information about individual systems without always showing how an issue might affect the wider environment.

None of this automatically means there is a vulnerability. But it creates more opportunities for oversight, inconsistency and human error. And cybersecurity is particularly unforgiving when it comes to the things we overlook.

Sometimes the greatest challenge isn’t protecting each individual system. It’s understanding everything that happens between them.

Complexity doesn’t disappear. Someone has to manage it.

There is an interesting principle in software design called Tesler’s Law, also known as the Law of Conservation of Complexity.

The idea is that every system contains a certain amount of complexity that cannot simply be eliminated. Someone has to deal with it. And I think this raises an important question for technology companies.

Should we expect businesses to manage the complexity of every individual technology they use, or should we design systems that take on more of that responsibility themselves?

Of course, we cannot eliminate all complexity. Telecommunications is a sophisticated industry. Messaging environments involve multiple technologies, networks, protocols, regulations and operational requirements. Security adds another layer of responsibility, and rightly so.

But there’s a difference between complexity that is necessary and complexity that exists because systems were never designed to operate as one. A security team shouldn’t need to navigate five different administration environments to understand who has access to critical services. An operations team shouldn’t have to piece together information from disconnected monitoring tools to understand what’s happening across its infrastructure. And a business shouldn’t have to depend entirely on manual coordination to maintain consistent security policies.

The more complexity we transfer to the people managing technology, the more we depend on those people never overlooking anything.

I have enormous respect for the engineers and operations teams who keep complex systems running every day. But I don’t believe good technology should make their jobs unnecessarily difficult.

The responsibility of technology developers is not only to build sophisticated systems. It’s to make that sophistication manageable.

What if we stopped treating every platform as an island?

This is where I think we need to reconsider how we approach technology architecture.

For years, businesses have often expanded by adding individual solutions to address individual needs. And there is nothing inherently wrong with that approach.

But as the number of systems grows, the question changes. Instead of asking only what each new platform can do, perhaps we should also ask how it will work with everything we already have.

What if the different technologies supporting a messaging business could operate within a more coherent environment? What if identity management, authentication, permissions and administration could be aligned across multiple platforms? What if teams could manage different technologies through a common operating layer rather than maintaining completely separate operational environments?

And what if security policies could be applied more consistently across the business instead of being recreated independently for every new system?

That is the thinking behind the concept of a Messaging Operating System. Not simply putting several products together, but creating an architecture in which different technologies can work as part of a connected ecosystem. For me, the important part isn’t the name.

It’s the principle.

Technology should become more capable without becoming unnecessarily more complicated to operate and secure.

A common operating layer doesn’t automatically make a business secure. Shared services need strong protection, clear responsibilities and appropriate safeguards. A problem in a central component can affect multiple systems, which makes resilient design especially important.

But a coherent architecture can make it easier to establish consistent controls, improve visibility and reduce the operational fragmentation that creates opportunities for mistakes.

And that is a meaningful improvement.

Security is also about how everything works together

There’s another aspect of this discussion that I find particularly important.

We often talk about cybersecurity in terms of individual technologies: firewalls, authentication, monitoring, encryption and DDoS protection. All of them have their place.

But real resilience depends on how these different layers work together.

A messaging platform may be well protected at the application level, but it still depends on networks, connectivity, infrastructure and the people operating them. That is also why technology partnerships matter.

No company can realistically build and operate every part of its technology environment entirely on its own. Specialized partners bring expertise and capabilities that complement what we develop internally. The important question is how those capabilities fit together.

For example, infrastructure-level protection against DDoS attacks and application-level security address different risks. They are not interchangeable, and neither makes the other unnecessary. They need to complement one another.

The same principle applies to software platforms, networks and operational processes.

Security becomes stronger when responsibilities are clear, different layers are coordinated and everyone involved understands how their part contributes to the whole.

A collection of security measures is not necessarily the same thing as a security strategy.

And a collection of secure technologies is not automatically a secure ecosystem.

Perhaps the next step isn’t adding another layer

I don’t think cybersecurity will ever become simple. Threats evolve. Technology changes. Businesses expand. New risks appear as quickly as we learn to address existing ones. We will continue to need specialized expertise, sophisticated protection and continuous investment in security.

But I do think we should question the assumption that more systems, more tools and more layers automatically mean better protection.

Sometimes they do. Sometimes they introduce additional complexity that we then need even more tools and processes to manage. And that is a cycle worth questioning.

What interests me is the possibility of building technology environments that are sophisticated where they need to be, but coherent enough for people to understand, operate and protect.

Environments where security is considered across the entire architecture, not addressed separately every time another platform is introduced. Where the people responsible for operations have a clearer view of the systems they manage. And where adding new capabilities doesn’t automatically mean adding another disconnected set of security responsibilities.

We have become exceptionally good at adding capabilities. We have also developed increasingly sophisticated ways to protect them. But perhaps the next stage of innovation isn’t simply about adding another layer.

Perhaps it’s about making all those capabilities work together more intelligently, with security considered from the beginning.

Because the question isn’t only how secure each technology is.

It’s how secure the entire business remains when all those technologies work together.

And that is why I believe complexity deserves a much bigger place in our cybersecurity conversations.

Fabrizio Salanitri

Founder & CEO, HORISEN