Security tool overlap during transition

Overview

Two EDR agents or both legacy AV + MDE cause blue screens and SOC noise. Map overlap day -14.

Matrix

Tool, coverage (server/workstation), telemetry destination, contract owner, uninstall order.

Rule

Generally remove outgoing tool after incoming reports healthy + exclusions replicated—never parallel on SQL clusters without vendor blessing.

Logging

Capture Event Viewer baseline before swap—helps disprove “you broke printing” when driver filter vanished.

Licensing

True-down old seats on vendor’s billing date—finance argument smoother with uninstall CSV proof.

Client messaging

“Two cops in one car argue” analogy lands better than technical stack traces.

Completion

Security sign-off checklist: one EDR, one RMM (if contracted), one spam filter edge—exceptions documented.