What's wrong with that picture? "At that point, you've commoditized those critical parts of the security infrastructure," says the head of a security software vendor who requested anonymity. "The problem is, the perception of C-level execs is that security is a commodity. One is the same as the other."

It's not that those vendors aren't good. It's just that they're not good at everything. Symantec AV has a stellar reputation, for example, but some security professionals consider its antispam functionality to be less than best of breed.

Repercussions from one vendor's successful sale into the U.S. Department of Defense are still being felt. "[This particular vendor] won the DoD contract. Then we start hearing from guys at various DoD installations saying 'Oh, God, this is horrible stuff. We can't use this,'" says the anonymous vendor.

Organizations whose C-level execs buy bundles do save money — lots of it. Unfortunately, they often get "really subpar security; sometimes dangerously so," says the vendor.

But how to get that through the head of the C-level exec who's sold on a bundle? By getting security personnel in on the decision-making process, before the money has a chance to drift out of the C-exec's hot little hands.

Bob Maley's lucky that way — his employer fixed the problem shortly before he came on board. Before he took on the job of chief information security officer for the Commonwealth of Pennsylvania in late 2005, the Commonwealth had developed an enterprise architecture process patterned after that of the National Association of State Chief Information Officers (NASCIO). Part of that process, now in place for some more than four years, is a clear set of standards for security product selection.

As Maley puts it, some other parts of the government may have unlimited resources to purchase security tools, but not his. So he and his group have gotten good at collaborating with peers — not only through NASCIO but also through the Multi-State Information Sharing and Analysis Center (MS-ISAC).

Under the MS-ISAC, which is run through the U.S. Department of Homeland Security, all 50 states share best practices. As well, the organization recently has hitched a ride on the federal government's SmartBUY purchasing initiative, designed to leverage the government's hefty buying clout to save money through aggregate purchasing.

What works for one sector — the government — in this case works for others: Network with peers, find out what security tools they use and trust, and find out which are clunkers to avoid.