This is a guest post by industry analyst Andrew Green, who has covered the SIEM and SecOps markets since 2020. Vega commissioned his whitepaper on what makes a security architecture next-generation; the analysis and the words, here and in the paper, are his.
For six years, “next-gen SIEM” has mostly meant new pricing on the same product, and maybe using a third-party security data lake. Unsurprisingly, SIEM bills get bigger and query times longer.
But instead of putting lipstick on a pig, we should be thinking about “hey, how about we change the architecture instead of the price list”? And it turns out there are plenty of things you can do better than centralized SIEM has been doing for the past 20 years.
I go over the low-level stuff in the full paper, but without boring you with too many details, here are the highlights:
- 1.Keep data where it lives. Instead of ingesting (and basically making a copy of the) data for the SIEM, you store it in your own object storage and run detection and queries there. Kind of obvious in retrospect.
- 2.Fast search at cold-storage prices. Vega builds searchable indexes on ordinary low-cost object storage. There’s no premium hot tier, so you’re not taxed for wanting access to your own data.
- 3.Query across everything. Defenders search the data lake, the EDR, and the SIEM in a single pass and get one consolidated answer.
You can move a legacy SIEM to the cloud or put it in a container, but you can’t refactor a centralized product into a distributed one. It has to be built that way from day one.
Sounds cool, but why bother?
Cost! Multi-cloud and multi-region organizations also stop paying egress fees to move data to a central location. Anthropic’s case study puts Vega at up to 82% lower data costs than legacy SIEM ingestion.
Speed. The same study shows a scan of more than 1 billion CloudTrail logs across 17 AWS regions completing in 41 seconds. Results stream back as they arrive, so investigations don’t stall on the slowest source.
AI!!! Because data is searchable in place, agents investigate across every source instead of a budget-trimmed subset. Detection stays deterministic and auditable, and AI handles triage, investigation, and optimization around it.
Next-Genness is an ongoing exercise
You may think that you just index-in-place and call it a day. But this new type of SIEM-like product is only beginning and will grow into the wider SOC use cases. For example, I thought Vega was a cloud-native product for cloud-native enterprises. Well, the guys were ahead of me: the product hadn’t yet caught up with their overall vision.
So when Vega II was launched in September 2026, I was not surprised to see Vega Gateway for streaming sources from wherever they run into object storage, using OpenTelemetry, webhooks, or APIs, and Vega indexes them there. Any source, on-prem systems and orphaned logs included, can now join the same search and detection as everything else.
Other cool stuff from the launch includes a proprietary, open-weight model trained specifically for agentic cyber defense, and Vega Memory for learning across cases.
Canary your way out of legacy SIEM
Centralized and distributed SIEMs will share the market for years, and enterprises wanting to move away from the legacy SIEM will run both for a while, often called ‘SIEM Augmentation’. That’s one way to use Vega.
Put it alongside what you have, prove the cost and speed gains on real data, and shimmy your way out of the legacy SIEM without pulling the rug out from under your SOC.
Read the full analysis. Andrew’s whitepaper, Vega Actually Earns Its Next-Gen Label, defines what makes an architecture next-generation, measures Vega against it, and says where Vega can still improve. Download the whitepaper.
About the author: Andrew Green is an industry analyst who has covered the SIEM and SecOps markets since 2020. He works with technology providers on competitive analysis and thought leadership through Precism, and writes Green Abstracts on Substack. Reach him at andrew.green@precism.co or on LinkedIn.