Forgepoint Forward Q2 2025: What’s Ahead in Security Log Data Management
Preisha Agarwal, Rey Kirton
April 30, 2025
- Blog Post
-
“The architecture has collapsed: the ecosystem utilizes 18 different tools and costs hundreds of dollars per GB. How will you start to automate or improve the decision-making capabilities of a human when you’re dealing with billions of events? Something must change: a disruptor needs to come in because the market is broken.”
George Webster CEO - Ziggiz -
“The cost for cyber logs sent to the SIEM can be 10x higher than the cost in the retention realm, where the operational or business intelligence log is simply retained for auditors and not analyzed for security benefit.”
David Emerson CTO - SolCyber -
“The effort to move SIEMs at a 5,000-person enterprise takes multiple years and millions of dollars. This amount of spent time and money for moderate cost savings does not make sense– the SIEM is a very difficult product to pull out [and replace].”
Ramin Safai CISO - Point 72 Ventures
“The externalization of configuration is beneficial– it serves as an abstraction layer. You can now make security-focused decisions about what is being routed into security infrastructure. It is simpler and more delegable for the security team.”
David Emerson CTO - SolCyber
“Large companies often have years of investment in Splunk. Displacement is possible, but it is going to be expensive from a time investment perspective. It requires two platforms to run at the same time- use cases have to be moved over to a new platform one at a time.”
Jerry Kowalski CISO - Jefferies
“From working with hundreds of thousands of SMBs and the MSPs who serve them, it became obvious the industry needed a better SIEM solution that eliminates unnecessary data and alerts, streamlines complexity, and cuts out unpredictable costs. In this era of mounting threats and vulnerabilities, focus is everything: on just the data you need, paying only for what you’ve used.”
Chris Bisnett CTO and Co-Founder - Huntress
-
“Standards like OTel and OCSF provide a certain comfort level that you can change tools- or have ten tools- because you have a standard way of collecting data.”
Jerry Kowalski CISO - Jefferies -
“You must have data in a form where you eventually have a human investigation because you do not know the process and the method of an attacker. It is not as simple as ignoring logs by dropping them in cold storage to reduce log growth. If you don’t have a system that allows flexibility or agility, none of that important information is being processed or collected for analysis.”
George Webster CEO - Ziggiz -
“The difficulty we face is to control the data quality; the performance indicators related to that are the most relevant [to selecting a SLDM solution]. The analyst who has to interpret the data system often does so in near-real time, not real-time. Thousands of alerts may not be reviewed, and for low-urgency alerts there can be minutes or hours between detection and analysis.”
Joaquin Sanchez Iglesias Security Monitoring & Analytics - Santander