TL;DR: Next-gen SIEM is separating from legacy SIEM as ingest-based pricing, manual tuning, and single-tenant operations turn visibility into a margin problem for MSPs, even as stolen credentials and exploited vulnerabilities drive more logging demand, according to Todyl. The real divide is whether detection scale stays manageable as environments and log sources keep expanding.
At a glance
What this is: This article compares next-gen SIEM with legacy SIEM and finds that pricing model, tuning burden, and tenancy design are now the main operational fault lines.
Why it matters: For IAM and security teams, the SIEM decision now affects log coverage, detection quality, and the cost of proving security across identities, workloads, and clients.
Context
SIEM programs break when visibility growth and cost growth are tied together. More log sources improve detection, but they also increase storage, tuning effort, and operational complexity, especially when a platform is built around ingest pricing and single-tenant administration.
For MSPs and multi-client security teams, that tension is not abstract. Each new tenant or environment adds another layer of log onboarding, field normalization, retention decisions, and alert handling, which makes the architecture choice as important as the detection content itself.
Key questions
A: Security teams should evaluate whether the platform reduces ingestion costs without sacrificing detection fidelity, supports flexible deployment across cloud and on premises, and integrates analytics with response workflows. The right test is operational, not just architectural: can the SIEM lower noise, preserve context, and keep investigation speed high as data grows and skills remain scarce?
Q: Why do legacy SIEMs become harder to manage as tenant count rises?
A: Because every tenant adds its own ingestion rules, compliance boundaries, and storage decisions. The result is not just more data, but more exceptions, more schema maintenance, and more operational risk. Once those custom paths multiply, the organisation is spending capacity preserving telemetry architecture instead of using telemetry for detection.
Q: What breaks when SIEM log coverage is reduced to control cost?
A: Detection fidelity breaks first, then investigations become slower and less complete. If the platform does not receive the right sources, it cannot correlate identity, endpoint, and cloud activity reliably. Cost control that trims telemetry too far often produces blind spots in exactly the places where stolen credentials, exploited systems, or lateral movement are most likely to appear.
Q: What should SOC leaders do if their SIEM vendor strategy is changing?
A: They should re-check telemetry portability, rule ownership, and response dependencies before the market shift narrows their options. If critical logs, detections, or workflows are trapped in one vendor-controlled path, switching later becomes more expensive and operationally risky. Build exit assumptions now, not after consolidation has already limited your leverage.
Technical breakdown
Why ingest-based SIEM pricing changes the security model
Ingest-based pricing makes every additional log source a financial decision as well as a detection decision. The more data you send, the more visibility you gain, but the more you pay and the more pressure you place on the platform's processing and retention layers. In practice, this pushes teams to ration telemetry, which can leave blind spots exactly where investigators need depth. A next-gen model tries to break that trade-off by shifting infrastructure and much of the operating burden into the platform layer. See the SIEM Guide.
Practical implication: Treat pricing as part of your control design, not just procurement, because telemetry economics shape what you can actually see.
How behavioural analytics changes detection engineering
Legacy SIEM deployments often depend on teams writing, tuning, and maintaining most detection logic themselves. Behavioural analytics and continuously maintained content reduce that burden by looking for deviations across users, devices, and accounts rather than relying only on static rules. That matters when attackers use legitimate tools or stolen credentials, because conventional signature logic can miss activity that resembles administration. The real architectural shift is from manually curated detection libraries to a model where the platform contributes ongoing detection maintenance. See the SIEM Buyer's Guide.
Practical implication: Validate whether the platform can detect abnormal account behaviour without forcing your team to hand-author every rule.
Why multi-tenant SIEM design matters for service providers
A single-tenant SIEM multiplies onboarding, suppression, and investigation work for every client, while a multi-tenant design centralises management without collapsing tenant boundaries. That distinction affects more than convenience. It determines whether detection content can be deployed once and updated everywhere, whether analysts can search safely across environments, and whether one client's telemetry remains isolated from another's answers. For MSPs, tenancy architecture is a governance control as much as an operational feature.
Practical implication: Require explicit tenant isolation and central management before you scale SIEM across multiple clients or business units.
Threat narrative
Attacker objective: The attacker wants to move through legitimate-looking access paths without triggering timely detection, increasing dwell time and reach before defenders can respond.
- Entry frequently begins with exploited vulnerabilities or stolen credentials, which the article identifies as a rising breach path that demands broader log coverage.
- Escalation becomes harder to spot when detection content is static or when noisy telemetry is suppressed to control cost, allowing attacker behaviour to blend into normal administration.
- Impact follows when teams miss the signal because the SIEM lacks the right sources, the right tuning, or the capacity to keep pace with environment growth.
Breaches seen in the wild
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SIEM economics now shape security outcomes: When platform pricing rises with every added log source, teams begin to negotiate with visibility itself. That creates a governance problem, not just a budget problem, because the organisation may knowingly leave telemetry gaps to protect margin. The result is a control environment where detection depth becomes uneven across tenants, regions, or business units. Practitioners should treat the commercial model as part of the security architecture.
Detection debt: Legacy SIEMs accumulate tuning exceptions faster than most teams can revisit them. Every suppression rule created to quiet noise becomes a permanent governance decision unless there is a disciplined review cycle. Over time, that debt hides real activity and makes the control harder to explain in audit or incident review. Practitioners should assume that unmanaged tuning history is itself an exposure.
Multi-tenant visibility is an identity governance issue: For MSPs, the question is not only whether a SIEM can isolate tenants, but whether it can preserve per-client evidence, detections, and search boundaries without fragmenting operations. That is directly relevant to SIEM guide thinking because log architecture determines how well identities, endpoints, and cloud activity can be correlated at scale. Practitioners should verify that tenant separation does not weaken investigation fidelity.
Next-gen SIEM is really a control-plane shift: The important change is not that the vendor hosts the stack, but that the platform begins to absorb tuning, analytics, and retention labour that used to sit with the customer. That changes staffing assumptions, incident handoff patterns, and how quickly a new environment can be brought under monitoring. Practitioners should reassess which SIEM tasks must remain in-house and which can be safely delegated.
Read next: SIEM Guide
What this signals
SIEM modernisation is becoming a governance decision, not just a tooling refresh: Teams that treat pricing, tenancy, and detection ownership as architectural issues will be better positioned than teams that only compare features. The practical question is whether the platform can preserve evidence, tuning quality, and operational clarity as log volume and tenant count grow.
Behavioural detection will keep displacing rule-only operations: As more threats arrive through legitimate credentials and low-signal activity, static detection content becomes a weaker default. Security teams should prepare for a model where the platform contributes more of the detection maintenance, while the organisation focuses on source quality, response paths, and governance.
Retention and search boundaries will matter more as investigations span identity, cloud, and endpoint data: SIEM value increasingly comes from how well it can correlate across domains without exposing one tenant or business unit to another. Practitioners should expect architecture reviews to focus more on isolation, portability, and evidence handling than on dashboard count.
For practitioners
- Define telemetry as a governed security requirement Set minimum log-source coverage, retention periods, and alerting expectations per environment before you compare platforms or renew contracts.
- Test onboarding effort against real tenants Measure how long it takes to add a new client or business unit, normalize fields, and make detections usable end to end.
- Run parallel validation before migration Forward high-value log sources to both platforms for a controlled period so you can compare missed alerts, false positives, and investigation quality.
- Contract for tenant isolation and data portability Require explicit answers on search boundaries, exportability, retained data access, and what happens if the product direction changes.
- Align SIEM retention to detection timelines Write retention to match how long your organisation can realistically take to detect threats, then extend for regulatory obligations where needed.
Key takeaways
- SIEM choice now affects both detection quality and the economics of running security operations across growing environments.
- The article ties rising log demand to a breach landscape where stolen credentials and exploited vulnerabilities are still central entry paths.
- Practitioners should evaluate multi-tenant isolation, retention, and portability before a renewal or migration forces the decision.
Related NHI Mgmt Group resources: SIEM Guide · Incident Response Guide · SIEM Buyer's Guide · SonicWall SSL VPN account compromises 2025
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on stolen credentials and the need to detect follow-on movement across environments. |
| Recommendation — Map SIEM detections to credential access and lateral movement so stolen-logon activity is easier to spot. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and environments are monitored to detect potential cybersecurity events | The post is fundamentally about monitoring scope, log coverage, and detection fidelity. |
| Recommendation — Use DE.CM-01 to define which logs must be monitored before you accept a SIEM design. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article discusses log onboarding, retention, normalization, and evidence preservation at scale. |
| Recommendation — Apply CIS-8 to standardize logging, retention, and review expectations across all tenants. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The core issue is how teams review and act on growing audit data without losing signal. |
| Recommendation — Use AU-6 to define how SIEM alerts are reviewed, correlated, and escalated. | ||
| CSA Cloud Controls Matrix | LOG — Logging and Monitoring | The article is explicitly about SIEM logging, monitoring, and retention in cloud and multi-tenant operations. |
| Recommendation — Align cloud logging and monitoring practices to the LOG domain before scaling SIEM across tenants. | ||
Key terms
- Next-Gen SIEM: Next-Gen SIEM is a security analytics platform that ingests telemetry, applies correlation and behavioural detection, and helps teams investigate threats across multiple environments. Compared with legacy log management, it is designed to handle higher data volumes, more varied sources, and faster analyst workflows without losing detection quality.
- Ingest-Based Pricing: A billing model where security cost scales with the amount of data sent into a platform. It changes the economics of SIEM operations because every unnecessary byte increases cost, making upstream filtering and enrichment a governance decision as much as a technical one.
- Detection debt: Detection debt is the cumulative risk created when noisy, unmaintained, or poorly governed detections remain in place because teams lack time or ownership to fix them. It behaves like technical debt, except the cost is reduced visibility and slower incident response rather than code quality.
- Tenant Isolation: Tenant isolation is the practice of separating identities, tokens, sessions, logs, and data so one tenant cannot access another tenant's resources. It can range from full physical or logical separation to carefully controlled shared services with strict tenant-aware policy enforcement.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, machine identity security, IAM, and secrets management as part of the industry's only accredited NHI security programme. It gives security practitioners a common governance baseline for programmes that depend on identities, credentials, and access control.
Published by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org