I’ve done most things you can do in SecOps, but SIEM projects were always my favorite. Hell, I like SIEM so much that I recently joined a SIEM company.
I don’t know, I just enjoy the idea of a central security monitoring hub that becomes this single pane of glass where me and my SOC friends can detect, investigate and respond to threats. I can almost see it: big screens on the wall, me catching APTs with the boys in our trusty SIEM, our CISO giving me a smartwatch for my efforts, me hopping on my bike and riding off into the sunset with my SIEM’s logo tattooed on my arm… but wait, what’s this:
Oh HELL NO.
Product Updates
Your SIEM Shouldn’t Hold You Hostage
Security data grows every year, and so does the bill. Legacy SIEMs bind collection, detection and storage together, so you pay premium prices for logs nobody queries while real threats wait in an indexing queue.
Abstract takes a different approach. Its composable platform combines a security data pipeline with an agentic SIEM. You can shape and filter data before it hits the meter, catch threats in-stream, and store each log in the tier it deserves. AI is woven into triage, investigation and hunting from the start.
Keep the tools you have. Fix what hurts most. Get Abstracted.
The role of a SIEM in late 2026
In our recent practitioner-led State of the SOC 2026 survey, we asked 125 SOC leaders how many actual security incidents are surfaced in the SIEM vs in upstream security tools. For the vast majority of SOC leaders, the bulk of threat detection happens outside of a SIEM.
We sort of expected this answer. As practitioners, and based on our own observations and industry knowledge, we’ve seen firsthand how SIEMs have been ceding ground to more specialized threat detection tools like CDRs, EDRs, ITDRs and so on.
These days, with a fully decked-out security stack, what is the role of your SIEM?
Many would say it’s correlation. Cool, but how much are you willing to pay just to correlate? And how many of your detections actually rely on correlation? Is it 5%? 10%? 20%? And finally, can’t we just correlate alerts? If we get a phishing alert from Microsoft Defender for Office 365 followed by a CrowdStrike alert about a suspicious scheduled task for the same user or machine, surely we can connect those dots?
I’m playing devil’s advocate a bit here, because I do think correlation is important. At the same time, I wonder how much an organization should be willing to pay just to be able to correlate events.
You could say we need a SIEM for compliance reasons. That’s fine, but again, that’s not the original purpose of a SIEM, and being downgraded to a compliance checkbox doesn’t sit well with me:
You could also say we need a SIEM to do IOC matching against our network logs, because NDRs don’t exist anymore and we need to get some value out of those network logs, am I right? You could say that, but then I’d throw a shoe at you…
My point is, there are use cases for keeping a SIEM around, but SIEMs no longer seem to be the must-have single pane of glass they were a couple of years ago. SIEMs have been losing on the threat detection front to more specialized tools. They’ve been relegated to tasks that typically don’t warrant the big spend, or turned into expensive, queryable security data stores. And now that data lakes and object storage are easy to query, the valid use cases for running a hefty SIEM simply aren’t there.
Why is SIEM losing ground?
OK, but what’s causing all that? Are dedicated threat detection tools like CDRs or ITDRs so good that you couldn’t possibly copy them in a SIEM?
I’d argue not at all. Yes, you can’t rewrite an EDR in your SIEM no matter how hard you try, but cloud and identity detection and response tools detect things you could also detect in a SIEM with some detection engineering work, obviously.
I believe SIEMs are losing ground simply because they’re user-hostile, expensive and rely on their users operating them well to deliver value. If you think about it, a CDR is a pre-configured, cloud-shaped SIEM. Meaning, a threat detection tool already built for a specific purpose and useful out of the box. Meanwhile, SIEMs are those blank security analytics platforms that do nothing on day one and require substantial knowledge and investment to get going.
(My conspiracy theory is that some SIEMs are the way they are to make room for professional services.)
And since a SIEM is a blank platform you have to configure yourself, your success depends more on your process and skill than on the technology. This is not to say SIEMs are interchangeable, just that SIEM failures can be traced back to a handful of very common mistakes almost every time.
This is a topic I discussed with Filip recently: should SIEMs come pre-tailored to their clients? Or be easier to configure in line with each client’s needs? After all, if the SIEM is the security tool that requires the most up-front work to get going, doesn’t it make sense for SIEM vendors to help out?
I think it’s a fair question, because it’s hard to find a team that’s happy with their SIEM. In my experience, there are three types of SOCs: the minority that’s happy with their SIEM, the ones with a SIEM so big they’re stuck with it for good, and the ones stuck in the perpetual SIEM migration cycle.
What should SIEM vendors do?
SIEMs are sticky. You deploy one, and it stays for at least a couple of years. They’re the opposite of plug-and-play: the setup is painful, and migrations even more so. I believe this stickiness is the reason SIEM vendors don’t feel the need to innovate. If renewals are coming in, why bother?
But if this continues, the marketing meme of “SIEM is DEAD” will finally come to life.
What I’d do (and working for a SIEM company, I get to do just that) is put all the effort I can into making sure the SIEM I’m selling comes pre-built for specific clients. You know, the part typically covered by professional services, but baked into the product instead. My dream scenario is SIEMs that are more like EDRs: useful out of the box and then configurable further. A tailored experience of sorts, rather than a blank data analytics platform and a thumbs-up from the vendor.
As for how to do that, there are many ways. I recommend the threat-driven approach I go over in this article:
Regardless of the approach, I believe delivering a blank SIEM is no longer enough, and if SIEM vendors don’t want their lunch eaten by the competition, they need to step up.
I don’t think SIEM is dead, but I do think the “blank SIEM” is on its way out. You know, the kind that does nothing until you’ve thrown a year of engineering time and professional services at it. Teams have options now, and our survey shows they’re using them.
As for me, I still want my big screens on the wall and my trusty SIEM. I’d just like it to catch something on day one. And if that happens we can talk about the tattoo :)
Have a siemless weekend ahead!