They often treat cost as a retention problem or a quarterly cleanup task. In reality, the main issue is governance over what gets emitted, indexed, and retained, especially when agent-generated code can replicate expensive patterns across many services.
Why This Matters for Security Teams
Telemetry spend is not just a finance issue. It is a control design issue that affects incident detection, forensic readiness, and the quality of security decision-making. When security and platform teams optimise only for storage cost, they often create blind spots by trimming signals that matter most during incident response. The better question is whether the organisation has clear governance over emission, indexing, routing, and retention across logs, metrics, traces, and security events.
That governance matters even more when platform automation and agentic systems generate infrastructure or application patterns at scale. A single bad logging default can multiply across services, inflate cost, and still fail to capture the evidence needed for investigation. Current guidance from the NIST Cybersecurity Framework 2.0 reinforces that resilience depends on visibility, detection, and continuous improvement, not just data accumulation.
In practice, many security teams encounter telemetry waste only after an outage, an investigation, or a cloud bill spike has already exposed the gap, rather than through intentional governance of what should be collected.
How It Works in Practice
Effective telemetry governance starts with deciding which signals are security-critical, which are operationally useful, and which are simply noisy. That distinction should be made at design time, not after a cost review. Teams should define event classes, severity thresholds, and routing rules so high-value security records reach the right analytics platform, while low-value debug output stays local or expires quickly.
Security and platform teams usually need shared control points across application code, observability pipelines, and detection engineering. In mature environments, this includes standards for structured logging, field-level redaction, sampling rules, and separate retention policies for compliance evidence versus troubleshooting data. The objective is to preserve investigative value without paying to index everything forever.
- Classify telemetry by purpose: detection, forensics, debugging, compliance, or product analytics.
- Set defaults for retention, sampling, and indexing at the platform layer rather than service by service.
- Review whether secrets, tokens, and personal data are being emitted into logs or traces.
- Track the cost of noisy sources so engineering teams can see which systems drive avoidable spend.
- Use alerting on unusual telemetry growth, because cost spikes often indicate a broken release or runaway agent behaviour.
For identity and access investigations, logging must preserve enough context to reconstruct who did what, from where, and under which privilege conditions. The NIST Guide to Computer Security Log Management remains useful for thinking about log generation, storage, and review as a lifecycle problem, while the OWASP Logging Cheat Sheet is a practical reference for reducing sensitive data exposure in telemetry. These controls tend to break down when teams outsource telemetry decisions entirely to application defaults in highly distributed microservice environments because the volume and variety of signals exceed manual review capacity.
Common Variations and Edge Cases
Tighter telemetry controls often reduce visibility or developer convenience, requiring organisations to balance forensic depth against storage, indexing, and privacy constraints. That tradeoff is real, especially in regulated environments or during active threat hunting. Best practice is evolving here, and there is no universal standard for how much observability is enough for every workload.
Some environments need heavier retention than others. Payment systems, identity platforms, and high-risk administrative planes usually justify longer retention and more precise audit trails, while ephemeral workloads may only need short-lived diagnostic data. The key is to differentiate between telemetry that supports security evidence and telemetry that exists mainly to help developers debug transient issues.
Agentic systems create a further edge case. If an AI agent can deploy services, modify code, or call tools, its actions may generate telemetry at a scale that quickly distorts budgets and alerting. In those cases, current guidance suggests adding policy checks around tool usage, logging verbosity, and secret handling before deployment, not after cost overruns appear. The MITRE ATT&CK framework is helpful for mapping which events matter for detection, while logging standards should be validated against operational needs rather than assumed by default.
Telemetry spend gets mismanaged most often when teams treat visibility as an unlimited utility instead of a designed control surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATT&CK and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM | Telemetry governance supports continuous monitoring and detection effectiveness. |
| OWASP Agentic AI Top 10 | A09 | Agentic systems can amplify logging volume and unsafe data emission patterns. |
| MITRE ATT&CK | T1078 | Identity abuse investigations depend on telemetry that preserves auth and access context. |
| NIST AI RMF | AI systems need governance over generated outputs and telemetry side effects. | |
| CSA MAESTRO | Agentic AI security requires policy control over tool use, observability, and data handling. |
Define telemetry requirements so monitoring covers critical events without uncontrolled collection growth.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
