Security Logs in a Data Lake Are Now Searchable — a Cost Problem for the SIEM Giants

On September 14, a small private software company called Imply said its newest product was now generally available: Lumi Loglake, which lets security teams search the raw logs sitting in their data lakes instantly — no schema setup, no moving data, no upfront indexing. The press release sounds narrow and technical. The part worth a retail investor's attention is the cost claim attached to it, because it points at the pricing model of one of the most expensive categories of business software in existence.

The first thing to know is that there is no Imply stock to buy. Founded in 2015 by the original creators of the open-source analytics database Apache Druid, Imply last raised a $100 million Series D at a $1.1 billion valuation in May 2022 and has collected about $215 million across its rounds. It's private. So this isn't an investable event in its own right. What it is, is a window into the economics of a market that big public companies fight over.

The cost model under attack

That market is called SIEM — security information and event management. A SIEM is the system that pulls logs from servers, apps, and networks into one place, indexes them, and lets analysts search and alert on them to catch an attack. The dominant incumbent is Splunk, which Cisco bought in 2024. Elastic runs a lower-cost rival, as does Microsoft Sentinel.

Traditional SIEM pricing runs on volume. Splunk charges on the order of $150 per gigabyte ingested per day at list price, so a terabyte-per-day deployment runs roughly $800,000 to $1.5 million a year in license fees alone — before you pay for the dedicated computer hardware that does the indexing, which for a terabyte per day typically means 15 to 25 indexer servers. The uncomfortable part of the model is that you're billed for every gigabyte you take in whether or not anyone ever looks at it. Analyses of real deployments keep finding that 60% to 80% of ingested data is never searched within the first 30 days.

The per-unit flip

Loglake is built on a different per-unit logic. Leave the logs in cheap object storage like Amazon S3, don't index them up front, spin up compute only when someone actually runs a search, and charge for what you query rather than what you store. Imply claims this cuts software costs by 70% or more and infrastructure costs by 40% or more versus always-on indexed systems, and it describes the philosophy as "query first, optimize later." The effect flips the incentive: instead of a bill that grows with every hoarded gigabyte regardless of use, you pay mostly for the searches you actually run — and if most logs are never searched, most of that volume becomes cheap to keep.

That arithmetic is the reason to care. Security teams are drowning in machine data, and AI workloads now churn out more telemetry than organizations can afford to index on the old model. Software that lets them retain everything in cheap storage and search it only when needed attacks the volume-priced incumbent business at its weakest point — the direct link between data growth and cost. It's the same data-lake economics that have already squeezed other software categories: keep everything cheap, and pay for expensive compute only when you use it.

Read it as a signal, not a trade

Now the parts that should restrain how much to read into one event. First, Imply is private and those 70% and 40% savings are vendor claims, not independently audited numbers with named customers and reproducible benchmarks — treat them as a marketing asset, which is what they are. Second, and this keeps it from being a clean "Splunk is dying" story, the product doesn't replace a SIEM; it extends one. Imply's own materials show Loglake querying logs through Splunk's search language and its Enterprise Security app, and through Databricks and Grafana. It's selling cheaper infrastructure under the incumbent's front end, plus the ability to reach lake data from other tools. Third, the "security data" in the headline overstates the scope: interactive search is the first and cheapest stage of security analysis. Detection, correlation, and investigation workflows — where a SIEM's real value and margins live — are a harder, separate problem, and that's where Splunk and Elastic defend their pricing. Searchability of a lake is not the same as securing it.

For the ordinary investor, the honest takeaway is directional rather than a call to act. The GA confirms the direction of pressure on a very large, very expensive software category: the per-gigabyte-ingest model is structurally exposed to data-lake economics, and any vendor whose revenue depends on charging for hoarded, mostly-unsearched logs faces a slow cost-discovery problem as this approach matures. If you hold the public names that carry that end-market — Cisco, which is folding Splunk into its security portfolio, or Elastic with its own per-gigabyte model — this is worth watching as real deployments and real cost data accumulate, not something to trade on today. The mechanism is clear; the evidence of who wins at SIEM scale is not yet.