Topic starter
02/08/2026 12:16 pm
TL;DR: Security teams are collecting far more telemetry than they can use, with medium environments now processing around 50,000 events per second and large ones reaching 1 million, according to Abstract Security. The real governance issue is not just detection quality but whether expensive real-time storage is being used for data that could sit elsewhere without reducing visibility.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “Shrinking the Stack of Needles”.
Key questions
Q: How should security teams decide which telemetry belongs in hot storage?
A: Teams should keep only the telemetry that supports a real detection, investigation, or response decision in hot storage.
Q: Why does collecting everything make security operations harder?
A: Collecting everything expands search scope, increases storage cost, and slows investigations because analysts must query through far more low-value data.
Q: What are the signs that telemetry collection is out of control?
A: Common signs include soaring event volume, analysts complaining about slow searches, and large amounts of system telemetry sitting in premium analytics without a clear detection use case.
Practitioner guidance
- Define detection-backed ingestion rules Require each telemetry source to map to at least one named detection, investigation, or compliance purpose before it enters the primary analytics stack.
- Split hot and cold telemetry paths Route high-value security events into real-time analytics and move low-value system telemetry to cheaper object storage for retention and forensics.
- Prune low-value system noise Remove CPU, memory, and other operational logs from expensive security analytics when they do not support active detections.
Bottom line: Security operations degrade when telemetry collection grows faster than the team's ability to use it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:18 pm
Telemetry sprawl is a governance failure before it is a tooling problem. Security teams often chase broader collection because it feels safer, but the outcome is an oversized analytic stack that slows investigations and obscures the signals that matter. The core issue is not the absence of data but the absence of collection discipline tied to a clear detection model. Practitioners should treat telemetry scope as a control boundary, not a default setting.
A question worth separating out:
Q: How do security teams balance compliance retention with detection needs?
A: Use tiered storage. Keep only time-sensitive security signals in the fastest analytics layer, then preserve the rest in lower-cost storage that still satisfies retention, audit, and forensic requirements. That approach maintains accountability without forcing every event through the same expensive operational path.
👉 Read our full editorial: Shrinking the telemetry stack of needles in security operations