Topic starter
19/08/2026 3:52 pm
TL;DR: Noisy telemetry and incomplete records are driving observability cost and making analysis harder, according to Sawmills. Telemetry governance has to treat signal quality as an operational control problem, because low-value data still consumes budget and weakens detection and response.
Editorial analysis by NHI Mgmt Group, based on content published by Sawmills: “We built Sawmills to fix observability's two biggest problems: cost and quality. Here's what year one looked like.”.
By the numbers:
- Across its customer base, the vendor says it is delivering 50% to 80% observability cost reductions.
Key questions
Q: Why does noisy telemetry increase security and engineering costs?
A: Noisy telemetry increases cost because observability platforms charge for ingest, processing, indexing, and retention even when the data is low value.
Q: How do organisations know if telemetry governance is working?
A: Look for fewer unnecessary ingestions, higher-value events reaching the SIEM, and clearer ownership of collection rules and routing logic.
Q: What breaks when observability pipelines do not filter telemetry aggressively enough?
A: When pipelines do not filter aggressively enough, data volume can overwhelm the monitoring stack and make meaningful analysis harder.
Practitioner guidance
- Define telemetry quality standards for security-critical logs Specify required fields, naming conventions, and event structure for workload, service, and API telemetry so downstream tools can correlate activity reliably.
- Filter noise before it reaches observability platforms Apply upstream transformation and suppression rules to duplicate, low-value, and malformed events so ingest cost falls before storage and indexing.
- Prioritise identity context in machine-generated logs Preserve service account, workload, token, and request metadata in telemetry so investigators can distinguish expected automation from suspicious activity.
Bottom line: Telemetry cost and telemetry quality are now linked problems, because organisations pay for data even when it never becomes useful evidence.
Glossary terms: Telemetry-driven governance, Signal Noise, Security Observability Sprawl, Evidence Quality
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:29 pm
Telemetry governance is becoming a control plane, not a cost tactic. The article shows that organisations are no longer paying mainly for data volume, but for the operational consequences of collecting unusable telemetry. Once telemetry quality determines whether incidents can be detected and understood, the governance question shifts from storage efficiency to control integrity. Practitioners should treat telemetry standards as part of security architecture, not an afterthought.
A question worth separating out:
Q: What should security teams do when machine identity logs are incomplete?
A: Security teams should treat incomplete machine identity logs as an evidence-quality problem, not a logging nuisance. Fix the event schema first, then preserve service account, workload, and request context so investigations can separate routine automation from suspicious activity. Without that context, identity-related detections become unreliable and costly to prove.
👉 Read our full editorial: AI-driven telemetry governance cuts observability cost and noise