Imply has outlined an expanded strategy for the security information and event management market centred on its Lumi platform, which it says will serve as the data foundation for an agentic SIEM.
The move targets security teams facing rising data volumes, higher storage and search costs, and growing demand from AI-led investigations. Rather than replace existing SIEM tools, the approach is designed to sit beneath them, allowing organisations to keep current workflows while widening access to security data.
Security information and event management systems have traditionally combined ingestion, indexing, storage and query functions within a single platform. Imply argues this model is coming under strain as organisations generate more logs and telemetry, forcing teams to decide which data to keep and how long to retain it.
AI is adding to that pressure, the company argues, because automated agents handling security alerts may query multiple datasets and look further back into historical records than fixed detection rules typically do. That can create more variable search demand and increase the volume of data that must remain accessible.
Data layer
Lumi is being positioned as a shared security data layer beneath existing SIEM products and newer AI tools. Imply says the system gives security teams access to both indexed data and unstructured logs held in object storage, without requiring all of that data to be moved into a SIEM platform first.
Users can search this data using SPL and SQL, according to Imply. It says separating storage, compute and access allows organisations to keep more historical security data in lower-cost object storage while scaling search resources when demand rises.
Eric Tschetter, Chief Architect at Imply, set out the company's case for changing the underlying design. "The SIEM isn't going away, but the architecture underneath it has to change," he said.
"The opportunity isn't simply to make SIEM cheaper, but to enable organizations to retain and access significantly more security data while preserving the tools and workflows analysts already rely on," Tschetter said.
That view reflects a broader shift in enterprise data infrastructure, where storage and compute have increasingly been separated so organisations can keep larger volumes of data without matching increases in processing costs at all times. In the security market, suppliers have been trying to adapt that model to support investigations, compliance retention needs and automated analysis.
Bank deployment
Imply also cited a customer deployment at BTG Pactual, one of Latin America's largest investment banks. The bank said it used Lumi to extend searchable data retention from 90 days to one year and add 45 data sources.
Imply says the project also brought seven more BTG group businesses into the bank's security operations centre. The SOC now supports more than 15 business units and group companies and handles more than 17 terabytes of additional data each day.
BTG Pactual reduced its security data costs by more than 70% during the process, according to Imply. The figures are one of the clearest examples the company has offered of how its architecture is intended to change the economics of security data management.
Rafael Hass, Security Information Manager at BTG Pactual, described the effect on the bank's operating model. "With Imply Lumi, we can ingest more data, retain it longer, pull in telemetry from platforms beyond Splunk, and still understand what our costs will look like as we scale," he said.
Imply was founded by the original creators of Apache Druid and focuses on software for searching and analysing high-volume machine data. Its latest push into SIEM architecture comes as security teams reassess how they store, query and retain growing volumes of logs while trying to integrate AI tools into established security operations.