Reports of SIEM's Death Have Been Greatly Exaggerated
Huntress, Thursday, October 29th, 2026
Huntress argues SIEM is not dead but the ingest-based pricing model is, and discusses AI and smarter logging strategy.
In this vendor post, the author says 'X is dead' is an old marketing trick and that SIEM's job of visibility, detection, investigation and compliance records is still needed.
Legacy vendors like Splunk and QRadar priced on data ingested and stored, encouraging teams to send everything, which produced large bills and unread alerts.
The market is shifting, with Cisco buying Splunk and IBM selling its QRadar SaaS business to Palo Alto Networks, opening the door for AI-native SIEMs and security data lakes.
The post weighs pitches such as leaving logs where they are and discusses a cost-effective logging approach.