Sending all telemetry into a legacy SIEM creates cost and control risk because the organization pays ingestion, storage, and analytics fees on data it may not need. It also hands the vendor control over proprietary formats and limits reuse of the underlying telemetry. That dependency makes investigations slower, increases lock-in, and weakens the organization’s ability to operate on its own data.
Why legacy SIEM centralisation becomes expensive and restrictive
When an enterprise sends every log, event, and packet-derived signal into a legacy SIEM, it is often paying premium rates for data that does not all need full-fidelity indexing or immediate search. The cost problem is not just storage. It also includes ingestion, normalisation, retention, and the operational overhead of keeping data pipelines tuned to a vendor-specific model. That creates a control problem as well, because the organisation’s visibility becomes tied to the SIEM’s schema, query language, and licensing assumptions. For broader guidance on security governance and control outcomes, NIST Cybersecurity Framework 2.0 is a useful reference point.
Legacy SIEM architectures are especially problematic in large enterprises because telemetry volume grows faster than the platform’s economics and operating model. Teams then start filtering, sampling, or dropping data under budget pressure, which means the enterprise no longer has a consistent view of its own environment. In practice, many security teams discover the real dependency only after investigations slow down and telemetry choices have already been constrained by vendor cost rules.
How telemetry economics and platform dependence work in practice
Legacy SIEM risk usually emerges in three linked stages. First, raw telemetry is forced through a single high-cost pipeline even when different data types have different retention or search needs. Authentication logs, endpoint events, cloud control-plane records, and application traces do not all deserve the same treatment, yet centralised SIEM designs often price them as if they do. Second, the enterprise becomes dependent on vendor-specific parsing, field mapping, and content packs. That dependency makes migrations, cross-tool analysis, and independent reuse of the data harder than they should be.
Third, operational control starts to weaken. Security teams may be forced to trade visibility for budget, or budget for visibility, rather than deciding deliberately which telemetry needs hot search, which needs cheap archive, and which needs only targeted collection. A more sustainable model is to separate collection, storage, and analytics decisions so that the enterprise can preserve high-value telemetry without paying legacy-SIEM rates for everything. NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant here because it treats logging, retention, and monitoring as control outcomes rather than a single product purchase.
- High-value security events can stay searchable, while lower-value telemetry can be routed to cheaper storage.
- Normalisation should support investigation needs, not force every source into the same vendor taxonomy.
- Query performance and retention objectives should be defined before the data lands in the SIEM.
This guidance breaks down when an organisation treats the SIEM as the only admissible system of record and refuses to design a separate telemetry strategy.
Where the trade-offs become material for large environments
Tighter telemetry centralisation often increases operational drag, requiring organisations to balance investigatory convenience against cost, portability, and governance. The trade-off becomes most visible in large enterprises with many cloud accounts, business units, or subsidiaries, because not every team needs the same data depth or retention window. In that environment, forcing all telemetry into one platform often creates noisy search spaces, uneven retention decisions, and uneven service levels for incident response.
The edge cases matter. Some regulated or high-assurance datasets do justify central, long-retention handling, but that does not mean every telemetry stream should receive the same treatment. Another common exception is where a legacy SIEM is retained for specific detection content while other telemetry is analysed elsewhere. That is usually a pragmatic compromise, not a failure of principle. The governance question is whether the organisation can still move, query, and reprocess its telemetry without the vendor becoming the gatekeeper.
For large enterprises, the real control risk is not merely spending too much. It is losing optionality: the ability to change tools, optimise retention, and run independent analysis without rebuilding the entire telemetry pipeline. That is where the cost problem turns into a structural dependency problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.SC-01 — Supply Chain Risk Management | Legacy SIEM dependency creates platform and vendor concentration risk. |
| DE.CM-01 — Continuous Monitoring | Telemetry pipelines exist to support monitoring, but cost pressure distorts coverage. | |
| PR.PT-01 — Protective Technology | SIEM is a protective technology whose design affects visibility and control. | |
| Recommendation — Assess vendor dependence and reduce concentration in telemetry processing. Define monitoring coverage by risk, not by blanket ingestion. Separate collection, storage, and analytics to preserve control over telemetry. | ||
| CIS Controls v8 | 8.2 — Audit Log Management | Central log handling and retention are directly implicated by SIEM design. |
| 7.2 — Data Recovery | Telemetry portability and reuse support recovery of investigative evidence. | |
| Recommendation — Right-size log retention and routing so high-value logs remain usable. Keep telemetry exportable so investigations do not depend on one platform. | ||
Practitioner Guidance
What to prioritise: Treat telemetry by purpose, not by source. Security operations should distinguish between data that must be searchable now, data that can be archived cheaply, and data that only needs to exist for targeted forensic retrieval.
What to verify: Confirm that the enterprise can still access original telemetry outside the SIEM’s proprietary workflows. If export, re-query, or reprocessing requires the vendor’s tooling, the organisation already has a control dependency that should be measured as part of platform risk.
Practitioner takeaway: The decisive issue is not whether a SIEM can ingest everything, but whether the enterprise can preserve security value without surrendering cost control and data autonomy to the platform.
Related resources from NHI Mgmt Group
- Why does identity provider sprawl create security risk in large enterprises?
- Why do legacy RADIUS deployments create access control risk?
- Why do password resets create compliance and security risk in large enterprises?
- Why do legacy loyalty platforms create control risk for customer engagement programmes?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
