Unloved, but not unnecessary
Few categories carry as many negative connotations as the SIEM: slow, expensive, hard to operate, and painful to migrate from. The exorbitant pricing has even become a meme.
Unsurprisingly, the startup world has been mulling over what's next: a fabric? A mesh? An agentic cyber defense platform?
Word salads aside, the problem is real. You need full visibility into your environment, and legacy SIEMs are too slow and expensive to deliver. No wonder you're shopping around for options.
Our hot take: you don't want a mesh, fabric, or agentic defense platform. You want a SIEM.
Why SIEMs matter
The core problem you need to solve is cross-source visibility and near real-time detection. You have tens of thousands of identities, assets, and applications producing billions of events daily. On top of that sit 10-50 security point solutions that monitor slices of that activity. Detections, investigations, and reporting frequently need to span multiple sources, usually under time pressure. Without a unified access mechanism coupled with low-latency detection capabilities, this is painful and time-consuming. At AI scale, it becomes impossible.
But cross-source visibility and near real-time detection are exactly the problems SIEMs were meant to solve.
Why do we need to invent a new category?
Why people don't like their SIEM
The underlying issue is that the SIEM incumbents have been unable to deliver on the promise of SIEM.
And they don't have the capabilities or incentives to improve.
On the capability side, their core technology is so old and bloated that they cannot make meaningful improvements to their platforms' performance, scalability, or efficiency.
On the incentive side, they are making bank by keeping prices high and ingest volumes low. As long as their customers keep ingesting more data and remain unable to migrate, why change?
The SIEM is not dead!
AI adoption is making SIEMs more important than ever: more systems to monitor, higher activity volumes, and faster attacks. Full visibility and near real-time detection across the entire environment is becoming table stakes for a modern SOC. Forget the mesh - only a SIEM can deliver that.
The SIEM is not dead. We just need better SIEMs.
FAQ
Why is it hard for incumbents to improve their existing technology?
As a platform ages, a few things happen that make it harder to change. The main ones are:
- The people who built the system leave. They are replaced by people who know how to maintain or extend it, but not how to fundamentally upgrade it.
- You've added a bunch of legacy features that a subset of your customers depend on. Upgrading requires an expensive, time-consuming, and high-risk migration.
- Different parts of the system are owned by different teams, such as the ingestion, detection, and search teams. These teams have conflicting incentives. No owner is accountable for the end-to-end user experience and has direct control over the resources needed to make the required changes.
We expect most, if not all, of these are true for the incumbent SIEMs today.
Why wouldn't the SIEM vendors just lower prices?
The main reason is that they believe they will make more money by keeping prices high. Since they already have a large customer base, providing aggressive discounts would likely cut more revenue than the resulting growth would replace. Moreover, existing customers have gotten used to the pricing and are convinced they are "paying for quality" rather than paying an exorbitant markup. SIEMs are not the only category where this happens. In fact, it's such a pervasive phenomenon that it even has a name: the innovator's dilemma.
What does "better SIEM" mean?
In short: faster search, cheaper ingestion, lower detection latency, and lower operational overhead. For more details, see our description of a Modern SIEM.
