SJA hears from Matteo Rebeschini, Strategic Solutions Engineer of Hydrolix about agentic AI and legacy SIEMs.
It isn’t really a technical scaling limit.
Modern SIEMs (Security Information and Event Management) can scale horizontally by adding more indexing nodes to ingest additional data.
The challenge is that scaling out becomes increasingly expensive and operationally complex.
As clusters grow, teams spend more time tuning performance, balancing data evenly across nodes, adding indexers simply to maintain query performance and managing longer recovery times when nodes fail.
Some vendors even recommend splitting deployments into multiple smaller clusters to keep them manageable, adding further operational overhead.
The commercial model compounds the problem.
Most SIEMs still charge by ingesting volume while tightly coupling compute and storage, so ingesting more data means paying significantly more.
Once volumes reach several terabytes per day, retaining everything becomes financially difficult, especially as security telemetry continues to grow year after year.
To control costs, organizations are forced into compromises.
Only the most recent week or two of data typically remains “hot” and instantly searchable.
Older data is tiered into warm or cold storage.
That reduces storage costs but changes the analyst experience.
When an investigation or audit requires historical data, it often has to be rehydrated back into the SIEM before it can be searched.
That process can take hours or even days, incurs additional costs and introduces operational friction.
Many organizations also filter, sample or drop high-volume data sources simply to stay within budget.
Industry analysis suggests that most organizations actively query less than a third of the data they ingest.
The result is predictable: blind spots, limited hot retention and slow access to historical evidence.
The issue isn’t that SIEMs can’t scale.
It’s that scaling and retaining data using traditional architecture becomes too expensive and operationally inefficient.
Legacy SIEMs were designed around human analysts.
The workflow assumes a person sitting in front of dashboards, writing queries and relying on automation that follows predefined, if-this-then-that playbooks.
That model worked because humans were the bottleneck.
A query that takes a minute to complete and a sampled dataset are often sufficient when an analyst is driving the investigation.
Agentic AI removes that bottleneck.
Instead of executing fixed playbooks, autonomous agents conduct multi-step investigations, correlate evidence across systems, adapt their reasoning as new information emerges and continuously iterate until they reach a conclusion.
This shift is one reason the industry is moving beyond traditional SOAR.
To operate effectively, those agents need immediate, programmatic access to complete, full-fidelity data across every source and every timeframe.
Tiered storage sampled datasets and rehydrated-first architecture don’t just slow investigations, they prevent agents from operating at their full potential.
Agentic AI therefore changes where the bottleneck exists.
The limiting factor is no longer analyst productivity.
It’s the speed and completeness of the underlying data platform.
Your autonomous SOC is only ever as capable as the speed and fidelity with which it can access its data.
MSSPs tend to feel the economics of security data before anyone else because the cost of storing and querying telemetry comes directly off their margins across every customer they support.
With ingest-priced SIEMs, each new tenant increases operating costs, so profitability shrinks as the business grows.
They’re also structurally different from most enterprises.
Many MSSPs operate more like software companies than IT departments, building their own collectors, customer portals and operational tooling while rarely exposing the underlying SIEM to customers.
Detection content is scripted once and deployed consistently across every tenant, which means the SIEM is already treated primarily as a platform for ingesting, storing and querying data rather than the user-facing product.
That makes adopting a dedicated security data layer a relatively low-friction change.
The detections, customer dashboards and operational workflows remain the same, while only the storage layer underneath is replaced.
The benefits are immediate: lower cost per tenant, significantly longer hot retention and enough economic headroom to introduce AI-driven services.
Because MSSPs own their entire technology stack, they can also make these architectural changes much faster than most enterprises.
For most organizations, modernizing doesn’t require replacing the SIEM.
The simplest approach is to move historical data into a dedicated security data layer while continuing to use the SIEM for recent operational data.
That means detections, dashboards, alert triage and day-to-day investigations continue exactly as they do today with the SIEM retaining the most recent data needed for active operations.
Older data is stored in a purpose-built data layer backed by low-cost object storage, where it remains hot, fully quarriable and stored in open formats instead of being archived into cold tiers.
The practical difference is that analysts no longer have to restore or rehydrate historical data before they can investigate it.
Whether the data is 30 days old or 18 months old, it can be queried immediately using the same workflows.
Regulation is accelerating this shift.
Requirements such as DORA expect financial institutions to reconstruct incidents and produce historical evidence quickly, making recovery processes that take hours or days increasingly difficult to justify.
For larger organizations, the transition is often even more straightforward.
Many have already moved detection, response and automated investigations into specialized security tools and emerging agentic AI platforms, leaving the SIEM primarily responsible for storing telemetry.
In those environments, replacing an expensive storage tier with a lower-cost, always-hot security data layer is a natural evolution that delivers immediate savings without disrupting security operations.
Increasingly, yes. Security architectures are becoming more modular, with responsibilities separating rather than remaining bundled into a single platform.
In this model, the SIEM – and increasingly AI agents – provide the interface for detection, investigation and response, while the security data layer becomes the long-term system of record.
That data layer is responsible for ingesting and retaining complete, full-fidelity telemetry, keeping it continuously queryable at low cost and serving both human analysts and autonomous agents.
Analysts continue using familiar query languages, while AI systems access the same data programmatically through open standards such as MCP.
This “SIEM as the query layer” model is already gaining traction, with bulk telemetry residing in object storage while the SIEM queries it as needed.
Modern security data layers have demonstrated that they can sustain extremely high ingest rates while still delivering sub-second query performance, proving that this architecture is practical today rather than a future vision.
The detection logic doesn’t need to change.
What changes is the foundation beneath it: a data layer that is faster, significantly more economical and designed for both human investigators and AI agents.
In an agentic SOC, that foundation is no longer just infrastructure, it’s a core part of the security platform itself.