Topic starter
19/08/2026 3:52 pm
TL;DR: AI-led telemetry management cut observability spend by 50% to 80% across its customer base while reducing noisy, low-quality data that slows incident response, according to Sawmills. The broader lesson is that telemetry governance is now a control problem, not just a data-volume problem, because signal quality directly shapes detection, response, and cost.
Editorial analysis by NHI Mgmt Group, based on content published by Sawmills: “We built Sawmills to fix observability's two biggest problems: cost and quality. Here's what year one looked like.”.
By the numbers:
- Across its customer base, the vendor says it is delivering 50% to 80% observability cost reductions.
Key questions
Q: What breaks when observability pipelines do not filter telemetry aggressively enough?
A: When pipelines do not filter aggressively enough, data volume can overwhelm the monitoring stack and make meaningful analysis harder.
Q: Why does noisy telemetry increase security and engineering costs?
A: Noisy telemetry increases cost because observability platforms charge for ingest, processing, indexing, and retention even when the data is low value.
Q: How do organisations know if telemetry governance is working?
A: Look for fewer unnecessary ingestions, higher-value events reaching the SIEM, and clearer ownership of collection rules and routing logic.
Practitioner guidance
- Define telemetry quality standards for security-critical logs Specify required fields, naming conventions, and event structure for workload, service, and API telemetry so downstream tools can correlate activity reliably.
- Filter noise before it reaches observability platforms Apply upstream transformation and suppression rules to duplicate, low-value, and malformed events so ingest cost falls before storage and indexing.
- Prioritise identity context in machine-generated logs Preserve service account, workload, token, and request metadata in telemetry so investigators can distinguish expected automation from suspicious activity.
Bottom line: Telemetry cost and telemetry quality are now linked problems, because organisations pay for data even when it never becomes useful evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:29 pm
Telemetry governance is becoming a control plane, not a cost tactic. The article shows that organisations are no longer paying mainly for data volume, but for the operational consequences of collecting unusable telemetry. Once telemetry quality determines whether incidents can be detected and understood, the governance question shifts from storage efficiency to control integrity. Practitioners should treat telemetry standards as part of security architecture, not an afterthought.
A question worth separating out:
Q: What should security teams do when machine identity logs are incomplete?
A: Security teams should treat incomplete machine identity logs as an evidence-quality problem, not a logging nuisance. Fix the event schema first, then preserve service account, workload, and request context so investigations can separate routine automation from suspicious activity. Without that context, identity-related detections become unreliable and costly to prove.
👉 Read our full editorial: AI-driven telemetry governance cuts observability cost and noise