A New Bet Against the Old SIEM
For more than two decades, the SIEM has been the backbone of security operations. But a growing number of startups are betting that architecture is due for a reset. The latest to make that case is Abstract, which just closed a $25 million funding round to push its composable security operations platform further into the mainstream.
The round, announced Thursday, brings Abstract’s total raised to nearly $50 million. The company says its valuation has tripled since the last round — though it won’t say by how much.
Cheyenne Ventures and AVP co-led the investment, with participation from Olive Hill Ventures, Crosslink Capital, and Rally Ventures.
What ‘Composable’ Actually Means Here
The term gets thrown around a lot in cybersecurity. But Abstract has a specific definition. The company’s platform separates where security data comes from from where it ends up. That might sound simple, but it’s a break from the traditional SIEM model, where data ingestion, storage, detection, and analysis are tightly coupled inside a single vendor’s system.
Instead, Abstract lets organizations pick and choose components for collection, detection, retention, and AI-driven operations. Want to use one tool for detection and another for storage? That’s the idea. The platform is designed to mix and match without forcing a rip-and-replace of the entire stack.
It’s a modular approach — and one that a growing number of security teams are asking for as they grow tired of being locked into expensive, rigid SIEM contracts.
Streaming Detection: Catching Threats Before They Land
A key piece of the pitch is what Abstract calls streaming-first detection. Instead of waiting for data to be indexed and written to disk, the platform analyzes it while it’s still in motion. That means threats can be spotted in real time, not minutes or hours later when the logs finally finish processing.
Once data exits the pipeline, Abstract tiers and routes it to different storage destinations based on how it will be used. The platform converts data into standard schemas like OCSF, ECS, and CIM — formats that downstream tools can actually read. The goal: cut storage costs by keeping only what matters in expensive hot storage, while still retaining full visibility.
That kind of data routing flexibility is a direct challenge to legacy SIEM vendors, who often charge by the gigabyte for ingestion and storage alike.
AI Isn’t a Bolt-On — It’s the Architecture
Abstract’s CEO and co-founder Colby DeRodeff is blunt about where the industry is headed. “For more than two decades, SIEM has been the foundation of security operations. AI-Gen Security Operations is what’s next,” DeRodeff said in a statement.
He argues that AI can’t just be layered on top of an old system. “It’s woven into every layer of security operations,” he said. The platform embeds AI into detection, triage, investigation, and response — not as a chatbot sidebar, but as a core part of how the system processes and prioritizes data.
That’s a different bet than vendors who are retrofitting AI onto aging SIEM architectures. Abstract was built from scratch in 2023 with that vision in mind.
A Founding Team With Deep Roots
The company was founded by a team with backgrounds at ArcSight, Bank of America, Palo Alto Networks, and Mandiant. That pedigree matters. These are people who have spent years inside the SIEM ecosystem — and who know exactly where it falls short.
DeRodeff himself is a veteran of the security operations space, and his co-founders bring deep experience in both building detection engines and running SOCs at scale.
The new capital will go toward expanding Abstract’s in-stream detection coverage, building out more of the security operations workflow, and hiring for the go-to-market team. That last part is key: the company has a strong product story, but it needs to sell it to enterprises that are deeply invested in existing SIEM infrastructure.
The Funding Context
Abstract’s $25 million round lands in a market that is hungry for SIEM alternatives. Legacy vendors like Splunk and IBM have dominated for years, but their pricing models and architectural limitations have opened the door for challengers. Startups like Panther, Devo, and now Abstract are all vying for a piece of the pie.
The composable security operations approach is still relatively new, but it’s gaining traction. Organizations are tired of being locked into monolithic platforms that charge by the terabyte and take months to reconfigure. Abstract’s bet is that modularity — and the cost savings that come with it — will win the day.
Whether that bet pays off depends on execution. But with nearly $50 million in the bank and a valuation that’s tripled, the market is signaling that it likes what it sees.
