The SIEM market attracts attention for a variety of reasons. First, it is dominated by a number of large players but there are a range of smaller companies vying for market share. It is also a market generally accessible to new entrants. There’s always a new company pitching a different spin on SIEM, whether it’s a new architectural model in the cloud, faster analytics from running on a third-party data warehouse, or leaning into new, undefined terms like a security data fabric.
Recently, SIEM has gained attention because of the number of acquisitions and mergers in the space. Exabeam and LogRhythm are merging, which took everyone by surprise. Existing customers of both companies will have questions around merged products, ongoing sales and support relationships, and even partnerships as the two companies combine operations and products. More interesting is Palo Alto’s acquisition of IBM’s QRadar product, with the intent of migrating QRadar customers to Cortex XSIAM. In this case, QRadar customers didn’t ask for– and likely don’t want–a forced migration to a tool they didn’t evaluate and have no choice in adopting.
Speak with security teams–the people in the trenches with these tools–and you’ll get a mixed bag of sentiment. Most see their SIEM as a necessary evil. Others see it as a cumbersome tool that lacks, well, something. It’s either too difficult to manage, not automated enough, doesn’t meet regulatory requirements, or the customer service is subpar.
Complicating the issue for security teams is the scope of today’s SIEM. A SIEM product is expected to do everything from automation to data aggregation to threat hunting and more. It’s difficult for a single product to do all of these things well. Frequently, teams may seek out best-of-breed solutions rather than continuing with a consolidated platform.
This lackluster sentiment is why, according to IDC, roughly 27% of North American survey respondents conduct a formal review of the SIEM every six months, with another 26% reviewing every twelve months. However, the overwhelming majority of users stick with their existing SIEM due to the high cost of migration. Once you’ve built out your SIEM deployment, changing it out is a cumbersome and time consuming process.
If changing SIEMs was easier, would end users test and adopt new products? In Cribl’s inaugural “Navigating the data current” report, we’re seeing this trend gather steam among Cribl.Cloud users as they search for products that better adapt to their changing needs. By analyzing anonymized data from Cribl.Cloud, we’re seeing more companies sending data to multiple SIEM products. Some are cloud native, like Microsoft Sentinel and Google SecOps. Others offer robust platform options or more cost effective operation. What’s clear is that, when companies have options over where they can send their data, they’ll take advantage of them to break out of onerous contracts and data silos.
This is only one of the data points we uncovered during our research. You can download the report to learn more.
For more insights into data management and security trends, and to learn more about the rise of multi-SIEM strategies, preview our report in our next webinar: “Navigating the Data Current: Exploring Cribl Cloud Analytics and Customer Insights.”
