Forrester finds 264% ROI from Gravwell security platform

A Forrester Consulting study commissioned by Gravwell found that customers using its Security Data Platform achieved a 264% return on investment over three years, with average benefits of USD $1 million for a composite organisation.

The analysis drew on interviews with decision-makers at organisations using the platform. Forrester used those interviews to model a composite mid-sized regulated enterprise supporting tens of thousands of users. That organisation recorded USD $743,000 in net present value and recouped its investment in less than six months.

The figures add to a broader cyber security debate over the cost of storing and searching the growing volume of machine data generated by artificial intelligence systems, cloud infrastructure and operational technology environments. Security teams are under pressure to retain more telemetry for longer while still investigating incidents efficiently.

Forrester's model found total benefits of USD $1 million against costs of USD $282,000 over three years. The largest quantified gains were a USD $694,000 reduction in security information and event management licensing and platform costs, along with USD $288,000 in productivity gains for security analysts.

Gravwell sells a security data platform for data management, log analytics and investigations. Its system is designed to collect and analyse logs, network traffic and event streams across security, IT and OT environments.

Cost pressure

As data volumes rise, organisations have increasingly questioned traditional SIEM pricing models. In many environments, licensing costs increase with ingest volumes, creating tension between the need to keep complete records and the cost of retaining them.

User interviews cited in the study reflected those concerns. One participant described cost as a central issue when comparing newer approaches with older security data tools.

"We're getting a million-dollar product for a fraction of the price. And it meets all our needs: data retention, data analytics, data alerting and real-time alerting. It's been great for us," said a Director of Information Security at a private academic institution.

Another participant focused on the operational risk of not retaining enough data, pointing to the difficulties some teams face when forced to discard logs because of storage or licensing limits.

"It was kind of scary when you really think about it, because we were dropping logs and wondering if the bad stuff was in those logs. Now we can ingest everything and know we're not missing anything important. Things don't always get discovered right away, so having the ability to retain more log data and go back further really improves how we investigate and respond to incidents," said a Senior Threat Response Engineer at a financial services organisation.

Vendor response

Corey Thuen, Chief Executive Officer and Co-Founder of Gravwell, said the company viewed the findings as evidence from customers using the platform in production. He linked the results to efforts by organisations to change how they manage security data and control spending.

"Independent analysis like this carries real weight because, for us, it reflects the experiences of organizations using our platform in production. We believe Forrester's findings demonstrate the measurable value organizations can achieve by modernizing their security data architecture. Whether the objective is to reduce costs, interrogate more data, or improve the efficiency of security operations, the study shows that they don't have to compromise," said Thuen.

Technology suppliers and buyers widely use Forrester's Total Economic Impact framework to estimate the financial effect of software and service investments. The methodology examines costs, benefits, flexibility and risk to model likely economic outcomes.

Studies of this type are commissioned and rely on a composite organisation rather than audited financial accounts from a single named customer. Even so, the figures provide a benchmark for buyers assessing whether alternatives to conventional SIEM tools can lower data retention costs while improving analysts' access to information.

The issue has become more pressing as companies collect telemetry from a wider range of systems and face tougher expectations around incident response, investigations and compliance. The findings suggest that for some users, the economics of security data storage and search are becoming as important as detection itself.