Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Switching to On-Prem SIEM
Transcript
- Lucas: So there's this quiet migration happening in security operations that you don't hear much about because it goes against the whole cloud-first narrative of the past decade. I'm talking about security teams moving their SIEM, their security information and event management platform, back on-premise. Luna: Wait, on-prem? I thought the whole industry was moving to the cloud. Isn't that, like, a step backward? Lucas: That's exactly what I'd have said two years ago. But look at the math. A lot of these cloud SIEMs charge per gigabyte of data ingested. And the ingestion rates have just exploded as companies log more and more — every API call, every endpoint event, every identity check. Data volumes are growing maybe thirty, forty percent a year for some firms. Luna: So the bill just keeps climbing, even if nothing bad happens. Lucas: Right. And the overage fees when you exceed your commitment — those are brutal. There were stories of companies getting hit with six-figure surprise bills just from a spike in log volume. So some CISOs started doing the math on what it would cost to run their own cluster. And for a certain profile of company, the answer surprised them. Luna: What profile is that? It's not like a startup with five employees is going to run their own SIEM. Lucas: No, definitely not. This is for mid-market to enterprise companies that have a certain volume of logs, say, a few terabytes a day, and a team that can manage infrastructure. There was a case I read about — a mid-sized regional bank in the Midwest. They were on a popular cloud SIEM, paying by the gigabyte. Their ingestion went up, their bill went up, and they decided to run an on-prem stack using open-source tools and a commercial support contract. They cut their SIEM spend by about forty percent. Luna: Forty percent is a big number. But what about all the things you lose? Like the automatic scaling, the managed service, not having to patch your own stuff? Lucas: Those are real trade-offs. But here's the thing — the gap has narrowed a lot. The open-source query engines that these on-prem stacks use, like ClickHouse or Druid, they've gotten really fast and really good at handling large volumes of logs. And you can get support from vendors who specialize in, you know, 'self-managed SIEM with a safety net'. Luna: So it's not 2015 anymore where you have to glue together a bunch of fragile tools. There's now a viable middle ground. Lucas: Exactly. And the cost conversation isn't just about the software. It's about egress fees. When you're in the cloud, you pay to get your data in, and you pay to get it out. If you're constantly querying large volumes of logs and pulling them into your own analytics or your own threat hunting tools, those egress charges add up. On-prem, once you've bought the hardware, the marginal cost of a query is basically electricity. Luna: That makes sense. But what about the agility? If you suddenly need to double your storage, with a cloud SIEM you just click a button. On-prem, you have to order hardware, wait for delivery... Lucas: Right, that's the classic trade-off. But some companies are doing a hybrid thing. They keep a small footprint in the cloud for spikes, but their core SIEM is on-prem. And they use cloud object storage for long-term retention — like, they'll store logs in Amazon S3 or Azure Blob, and only load what they need into the on-prem cluster for active analysis. That gives them the scalability for compliance, but they control the day-to-day query costs. Luna: So is this a trend that's going to reshape the whole SIEM market? Or is it just a niche for companies with the infrastructure chops? Lucas: I think it's bigger than a niche. I mean, a couple of the major SIEM vendors have noticed and started offering 'bring your own storage' options, where you can use your own cloud bucket instead of their proprietary storage. That's a direct response to customers saying, 'The cost is out of control.' But also, there's a new generation of startups building siem like platforms that are designed to run on your own infrastructure, or in a hybrid fashion, from day one. Luna: Interesting. It feels like the pendulum is swinging back a bit from 'everything in the cloud' to 'what's the right tool for the job.' Lucas: Yeah, and that's a healthy sign. It means security teams are actually thinking about cost and control, not just following the herd. And it's not just about money, either. Some CISOs say that having the data on-prem gives them more flexibility for integrating with their other internal tools, and it can satisfy certain data residency requirements. Some industries, like healthcare or government, have strict rules about where data can live. Luna: Right, and that's a huge driver that's not going away. So if I'm a CISO and I'm thinking about this, what's the first thing I should evaluate? Lucas: I'd look at your ingestion curve. Plot your log volume over the last eighteen months, and project it forward. Then get a realistic quote from your cloud SIEM vendor — and they're not always transparent about overage costs. Then do a total cost of ownership for an on-prem solution, including hardware, power, cooling, and the staff time to maintain it. You might find that the break-even is a lot sooner than you think, especially if your volume is growing fast. Luna: And I guess the team has to have the skills to run it. You can't just throw hardware at it and hope for the best. Lucas: Absolutely. The people factor is probably the biggest barrier. A lot of security analysts grew up in the cloud era and have never had to think about cluster health or disk space. But that's changing too. I've seen more security job postings that include 'experience with Linux and Kubernetes' as a plus. The skill set is becoming more common. Luna: It's like the whole industry is getting a second education in infrastructure. Lucas: Exactly. And you know, this kind of practical, cost-driven conversation reminds me of what keeps this show going. It's the kind of thing you can't always get from a vendor webinar. If this discussion helped you think about your own security stack, honestly, if today was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. It's the smallest possible ask, and it keeps these conversations ad-free. Luna: Yeah, it's a nice way to say thanks if you've gotten value out of the show. No pressure, though. Lucas: So, beyond the cost angle, there's another reason I'm hearing for the on-prem shift: performance. Some teams say that for certain high-speed search and correlation workloads, having the data close to the CPU makes a real difference. The latency you get from a cloud API call, even in the same region, can add up when you're running complex queries across billions of events. Luna: So it's not just about money, it's about speed. Especially for threat hunting where you're iterating through large datasets. Lucas: Right. A threat hunter might run dozens of exploratory queries in a session. If each one has a few hundred milliseconds of network overhead, that's not a huge deal, but if the dataset is massive and the query is complex, it can be the difference between a quick pivot and a waiting game. And in an active incident, minutes matter. Luna: So what does this mean for the big SIEM vendors? Are they going to see their growth slow down? Lucas: I don't think it's going to kill the cloud SIEM market, but it's definitely a headwind. The vendors are adapting, like I said, by offering more flexible storage options and even open-source versions of their engines. But I think we'll see more companies doing a hybrid approach — keeping the cloud for some things, but running the core on-prem. The key is that CISOs are now in the driver's seat when it comes to the architecture. They're not just accepting the default. Luna: That's a good thing. I think the days of 'just put it in the cloud because that's what everyone does' are numbered. Lucas: Yeah, and that's a healthy sign for the industry. It means security decisions are being made with a clear-eyed view of the trade-offs. And that's something we'll continue to follow. If you have a story about your own SIEM journey, we'd love to hear it. Luna: You can reach us on social media. But for now, that's our look at the on-prem SIEM renaissance. Lucas: Thanks for listening. We'll see you next time.