We Audited a Client's Tool Sprawl, Found Six Redundant Subscriptions

The client asked for a security review of their stack, which is how most of these audits start — someone worried about data access, not cost. Twenty minutes into pulling the vendor list, cost became the more interesting finding. Forty-one active subscriptions. Six of them were paying for a capability another tool in the stack already provided.

How the overlap actually happened

None of the six were bought maliciously or carelessly. A heatmap tool got added by the growth team in 2023 to validate a landing page redesign. A different heatmap tool got added by the product team in 2024 because they didn't know growth already had one — different Slack channel, different budget line, same capability. Multiply that across session replay, form analytics, and two separate A/B testing platforms, and you get a stack where every purchase was locally rational and the sum was obviously not.

Tool sprawl isn't a procurement failure. It's what happens when nobody owns the full picture and every team can see only their own slice of it.

What found the overlap

• A simple spreadsheet of every active vendor, who requested it, what data it touches, and what it's used for — most companies don't have this at all.
• Grouping by capability rather than by tool name, which is what surfaced the duplicate heatmap and A/B testing tools immediately.
• Checking actual login activity per tool, not just subscription status — two tools were paid for but had zero logins in 90 days.
• Asking each team what would break if a tool were cut, and treating 'nothing, we just liked the dashboard' as a cut signal.

Annual savings from the audit:
- 2 duplicate heatmap/replay tools cut:      $18k
- 1 zero-login analytics subscription cut:   $9k
- 2 A/B testing platforms consolidated to 1: $22k
- 1 unused CDP add-on removed:               $11k
----------------------------------------------
Total:                                       $60k/yr

Sixty thousand dollars a year, found in an afternoon of spreadsheet work, for a company that genuinely wasn't being careless about spend — they just never had a single view of the whole stack. That's the actual argument for running this audit on a cadence rather than waiting for someone to ask for a security review first.