We recently conducted an informal poll on LinkedIn in order to help us shape an industry aligned dinner discussion with data and cybersecurity leads, at Bletchley Park, together with Sir Dermot Turing.

First up, we asked industry leaders, decision makers and influencers about the state of SIEM.

In summary, the poll and the dinner discussion revealed:

• SIEMs that worked when ingest volumes were around 100GB/day no longer work now that data is 10 to 100TB/day.

• It is more important to understand what data we can throw away rather than what we can ingest.

• SIEMs are too prescriptive. We need SIEM to be more predictive. Agentic AI could be a big help here.

• We can no longer use legacy products for large-scale SIEM.
• Object Storage is great for a data lake, being 10x cheaper, but lacks the fast retrieval that SIEM typically requires.
• The “collect everything from anywhere” approach gets too expensive too quickly.
• We need to disconnect the storage of the data from the analysis of the data. Storage needs to be affordable at scale. Analytics, whether SIEM or otherwise, needs to be on selected data only.
• Another approach is to be more proactive at the edge, but there is some concern that this would mean missing seeing important data. Is it safer to send all data to a lake and then take selective data for SIEM analysis?
• Data for Security can be reused for other things like BI.
• SIEM tools are used by IT. BI tools are used by the business. Often in large enterprises, these two teams don’t communicate. There are SIEM tools that can turn their hand to useful BI use cases, beyond what a lot of BI tools can.
• Too many incidents/alerts to analyse often result in Analyst Fatigue. User Behavioural Analytics is harder than it looks. Again, AI needs to help here.
• To use SIEM effectively, it comes down to defining the use cases well. This, however, is easier said than done, and most SIEMs can’t scale beyond tens of use cases.
• There is a trade-off between quality and quantity.

We plan to explore these in more depth in future blogs and at events we are currently planning.

Are you seeing these challenges too? If a 20 minute conversation to talk them through with us would be helpful please get in touch here.