Imply is attempting to decouple security data storage from traditional SIEM processing to address the escalating costs and storage demands driven by artificial intelligence. By introducing Imply Lumi, the company is positioning a shared data layer that sits beneath existing security tools and modern AI agents. This strategic shift aims to resolve the tension between the massive data volumes required for AI-driven investigations and the prohibitive scaling costs of legacy architectures that require ingesting and indexing every log within a single, monolithic system.
Decoupling Storage and Compute for AI-Driven Security
The company is targeting a fundamental architectural flaw in traditional SIEM platforms, which often force security teams to choose between data retention periods and budget constraints. As AI agents increase the demand for deep, historical data searches to validate alerts, the pressure on these legacy systems intensifies. Imply Lumi addresses this by separating low-cost object storage from compute resources, a model borrowed from modern data platforms. This allows organizations to retain significantly more security history in cost-efficient storage while scaling search capabilities based on real-time demand. Rather than requiring a total migration, the platform enables teams to search both indexed data and unstructured logs in object storage using familiar languages like SQL and SPL. This approach is designed to make data accessible to both human analysts and autonomous AI agents without forcing all telemetry into the primary SIEM first.
BTG Pactual Implementation and Scalability Results
The practical application of this architecture is evidenced by BTG Pactual, a major Latin American investment bank, which utilized Lumi to modernize its security operations. The bank successfully extended its searchable data retention from 90 days to one full year while simultaneously adding 45 new data sources to its environment. This expansion included bringing seven additional companies from the BTG group into its Security Operations Center (SOC), supporting more than 15 business units. The implementation resulted in the processing of more than 17 terabytes of additional data per day. Crucially, the bank reported reducing its security data costs by more than 70% during this transition. According to Rafael Hass, security information manager at BTG Pactual, the platform allowed the organization to ingest more data and pull telemetry from platforms beyond Splunk while maintaining predictable cost scaling as the environment grows.
Key Takeaways
- Imply Lumi provides a shared data layer that separates storage, compute, and access to support both existing SIEM tools and AI agents.
- BTG Pactual extended its searchable data retention from 90 days to one year while reducing security data costs by more than 70%.
- The platform supports searching unstructured logs in object storage using standard languages such as SPL and SQL.
TechInsyte's Take
In our view, Imply is betting that the "agentic" era of cybersecurity will break the economics of traditional SIEMs. As AI agents move from simple detection to iterative, deep-dive investigations, the unpredictable surge in search demand will make monolithic, all-in-one ingestion models financially unsustainable for the enterprise. By positioning Lumi as a modular data layer rather than a SIEM replacement, Imply is lowering the barrier to entry for architectural modernization. This strategy allows CISOs to retain their existing workflows and investments in tools like Splunk while solving the underlying data gravity and cost problems that AI-driven security demands.
Questions & Answers
How does Imply Lumi address the rising costs of security data retention?
Lumi utilizes a decoupled architecture that separates low-cost object storage from compute resources. This allows organizations to store vast amounts of historical data in inexpensive object storage rather than paying the premium associated with ingesting and indexing everything directly within a traditional SIEM.
Can existing security workflows be maintained with this new architecture?
Yes. The platform is designed to work beneath existing SIEM tools, allowing teams to use familiar languages like SQL and SPL to search both indexed data and unstructured logs stored in object storage without requiring a complete change in workflow.
What specific impact did this have on BTG Pactual's operations?
BTG Pactual extended its searchable data retention from 90 days to one year, added 45 data sources, and integrated seven additional companies into its SOC. This expansion allowed them to process over 17 terabytes of additional daily data while reducing costs by more than 70%.
Why is AI considered a primary driver for this architectural change?
AI agents do not stop at initial findings; they perform iterative searches that reach into different data sources and further back in time than standard detection rules. This creates unpredictable, high-volume search demands that traditional, monolithic SIEM architectures struggle to absorb cost-effectively.
Source: Imply
