Security teams continue using outdated SIEM (Security Information and Event Management) tools because replacing them requires massive data migration, retraining staff, and justifying capital expenditure to leadership. Legacy SIEMs hold years of historical logs that newer systems can’t easily import, creating institutional lock-in despite poor detection rates.
Pithy Security | Cybersecurity FAQs – The Details
Question: Why do security teams still use outdated SIEM tools when they miss 70% of attacks?
Asked by: Microsoft Copilot.
Answered by: Mike D (MrComputerScience) from Pithy Security.
The Migration Problem Is Worse Than The Tool Problem
Legacy SIEMs like ArcSight and QRadar contain 5-10 years of security logs that compliance frameworks require organizations to retain. Migrating terabytes of historical data to a new platform like Splunk Enterprise Security or Elastic Security takes months and costs six figures in professional services alone. Most security teams lack the budget and downtime windows to pull this off without disrupting operations.
The tools also embed deep institutional knowledge. Security analysts spent years building custom correlation rules, dashboards, and playbooks specific to their environment. These aren’t portable. Moving to a new SIEM means rebuilding detection logic from scratch, which explains why teams tolerate 30% detection rates rather than face a 6-12 month capability gap during migration. The devil you know beats the devil you’re learning.
Vendor Lock-In By Design
SIEM vendors intentionally make migration painful. Proprietary query languages (ArcSight’s CEF vs Splunk’s SPL vs Microsoft’s KQL) ensure your analysts’ skills don’t transfer between platforms. Log normalization schemas differ across vendors, so the same Windows event looks different in QRadar versus Sentinel. Integration libraries aren’t compatible, meaning every third-party security tool connection needs reconfiguration.
The subscription model makes this worse. Organizations already paying $200,000 annually for an underperforming SIEM face another $300,000+ to switch vendors, plus the original contract’s early termination penalties. CFOs see this as paying twice for the same capability. Security teams get stuck arguing ROI on detection improvements that won’t materialize for 18 months post-migration, by which time the new SIEM vendor has already started its own feature stagnation cycle.
When Legacy SIEMs Actually Make Sense
Some environments benefit from keeping older SIEMs. Highly regulated industries (finance, healthcare, government) prioritize compliance logging over threat detection. If your primary SIEM use case is “prove to auditors we collected these 47 log types for 7 years,” legacy tools excel at cheap storage and basic reporting. They fail at detecting sophisticated attacks, but that’s a secondary concern when regulatory fines cost more than breaches.
Air-gapped or classified networks can’t adopt cloud-native SIEMs like Chronicle or Sentinel. On-premises legacy tools remain the only viable option. Teams in these environments accept detection limitations as the price of operational constraints. The real failure isn’t using old SIEMs but pretending they provide adequate threat detection when they clearly don’t.
What This Means For You
- Audit your SIEM’s actual detection rate by comparing alerts generated against known incidents from tabletop exercises or red team engagements.
- Implement complementary tools like EDR (CrowdStrike, SentinelOne) and NDR (Darktrace, ExtraHop) to cover gaps your legacy SIEM misses.
- Budget migration as a multi-year project with overlapping tool licenses during transition periods to avoid security visibility gaps.
- Prioritize SIEM modernization in leadership conversations by quantifying breach costs versus migration investment using frameworks like FAIR or NIST CSF.
Related Questions
- 1
- 2
- 3
Want Cybersecurity Breakdowns Like This Every Week?
Subscribe to Pithy Security (Cybersecurity news made simple. No ads. No hype. Just signal.)
Subscribe (Free) → pithysecurity.substack.com
Read archives (Free) → pithysecurity.substack.com/archive
You’re reading Ask Pithy Security. Got a question? Email ask@pithysecurity.com (include your Substack pub URL for a free backlink).