How many vendors does a bank need for secure infrastructure?

A customer opens an app to make an instant transfer. For them, it takes seconds — but behind the screen, that transaction may pass through technology from six, seven, or more vendors before reaching its destination.

CDN for delivery. WAF for application protection. DDoS mitigation. Bot management. API Gateway. Observability. Some layer of edge processing. Now, AI inference is entering that architecture too.

Each solution was purchased to solve a legitimate problem on its own. The difficulty shows up when all of them need to behave as if they were one. In that scenario, vendor count stops being a procurement conversation and becomes an architecture question.

For CIOs and CTOs at financial institutions, the math needs to account for more than licenses and infrastructure consumption. Every vendor adds policies to manage, data to correlate, access to control, integrations to maintain, and one more environment to investigate when something breaks.

And at a bank, a few minutes of something going wrong is already expensive.

---

Why infrastructure fragmentation increases operational risk for banks

Financial institutions have spent years eliminating fragmentation from the customer experience.

Customers don’t want to open one app to check their balance, another to make a payment, a third to invest, and a fourth to talk to the bank. The answer was to consolidate more and more services into a single digital experience.

Infrastructure hasn’t always kept pace with that shift. A request might arrive through a CDN, pass through a security solution, get analyzed by a separate bot management tool, hit APIs managed in another environment, and generate data sent to yet another observability platform.

The design works. But it comes with an operational cost.

Consider a relatively simple change to an authentication journey. A new rule may need to be replicated across more than one tool. Each vendor’s criteria aren’t necessarily the same, and neither are interfaces, configuration languages, or release cycles.

After months or years of changes, exceptions, and emergency fixes, an institution risks ending up with policies that were supposed to be equivalent but no longer produce the same behavior — what security operations already calls policy drift.

For the CIO and the CTO, what matters here isn’t the name of the problem, but where the cost comes from: every additional vendor in the journey means one more console to check, one more support team to loop in, and one more policy to keep in sync with the rest. The effect of that misalignment on incident investigation time is covered in more depth in WAF, Bot, and DDoS Security: The Case for a Shared Control Plane.

Every vendor also enters the audit

A vendor needs to go through security assessment, access management, architecture review, compliance processes, and contract oversight. Depending on the service and the data involved, additional governance requirements come into play.

Now multiply that work by the number of vendors sitting in the path of a single transaction.

A solution that looks cheaper in isolation can turn expensive once it requires new integrations, more hours from internal teams, and another set of controls to manage.

How Azion helps reduce the complexity of banking infrastructure

Reducing vendor count isn’t enough on its own. If security, delivery, processing, and data keep operating in silos, complexity remains inside the architecture.

Azion’s approach is to consolidate these capabilities on a single platform. WAF, Bot Manager, DDoS Protection, and Network Shield run alongside Cache, Functions, Data Stream, and AI Inference within a common architecture — covering the same list of fragmented layers described at the start of this article, without requiring a separate vendor for each one.

In practice, a request can be inspected by WAF and served by Cache without ever reaching the origin. Functions lets teams run logic close to the user, while Data Stream sends events to the systems the institution already relies on. For AI applications, AI Inference adds inference capacity without requiring a separate, isolated infrastructure for every new use case.

The most important effect shows up in operations. Policy, processing, and data start sharing more context throughout the request, reducing integration points and the work needed to correlate information across tools — the same kind of gain covered in more depth in Why a Unified WAAP Platform Reduces SOC Risk, from the perspective of teams investigating incidents day to day.

For a financial institution, consolidating infrastructure doesn’t just mean fewer contracts. It means reducing the operational boundaries teams have to manage.

What changes when infrastructure stops being a puzzle

Zoop’s results help put numbers behind this discussion. With Azion, iFood’s fintech recorded a 30% reduction in operating costs, 50% less latency, and 99.99% availability.

Looking only at the 30% cost reduction would miss part of the story. That drop came alongside lower latency and high availability. For a financial operation, those indicators need to move together. Cutting infrastructure costs at the expense of experience or availability would just shift the problem elsewhere.

Consolidation also shows up in how Zoop handles fraud. Through the Azion Marketplace, the fintech integrated Azion with Axur to detect compromised cards before transaction authorization, while Data Stream fed the company’s monitoring platforms and let it adjust risk policies dynamically. In other words: delivery, security, and data running on the same platform, without requiring a new, isolated vendor for every new detection capability.

At FourBank, the platform makes it possible to apply controls based on URL and context. That gives the institution more precision in deciding how different requests should be treated, instead of relying only on generic rules across the entire application.

At Banco de la Nación, Peru’s public financial institution, unifying acceleration, caching, and security on a single platform cut average response time by 97.6% and reduced data transfer from origin by 75% — with cloud data transfer costs down as much as 96%. The gain didn’t come from replacing one vendor with a cheaper one. It came from removing the seams between performance and security that a multi-vendor setup would have kept in place.

These are three cases with different needs. What they share is operational: the platform needs to reduce the work, not just the number of logos on the architecture diagram.

The TCO that never shows up in the sales proposal

Comparing CDN pricing to CDN pricing, or WAF to WAF, is relatively simple. Comparing the cost of operating different architectures takes a different kind of math — one that belongs to procurement and architecture, not day-to-day security operations.

How many times does the same policy need to be configured across different vendors?

How many vendors get pulled into a root-cause analysis, and how many of them need to be contacted individually?

How much security, compliance, and audit work does each new vendor add to the annual review cycle?

And how much does it cost to bring a new capability into production when it requires one more integration, one more contract, and one more environment to operate?

These questions change the TCO conversation.

Licensing and consumption still matter, of course. But integration, contractual governance, and the time architecture and compliance teams spend reviewing each vendor also consume budget — often less visibly, spread across hours that should be going toward product, security, or engineering work.

For banks, this point is likely to matter even more as AI enters digital journeys. If every new generation of technology results in one more vendor, one more layer, and one more console, the architecture accumulates complexity faster than it can eliminate it.

A different metric for CIOs and CTOs

Banks are already working to reduce fragmentation in the customer experience. Infrastructure needs to follow the same direction.

The question isn’t eliminating every vendor, but understanding where specialization creates value and where it only adds complexity, cost, and new operational boundaries.

Azion brings security, delivery, processing, observability, and AI inference together on a single platform, helping financial institutions simplify that architecture without giving up performance and control.

---

Want to map how many vendors are currently in the path of a critical journey at your institution? Talk to an Azion specialist and see how WAF, Cache, Functions, Data Stream, and AI Inference operate as a single architecture.