Writing · Pillar
Economics & measurement.
The cost optimization paradox in security data, the storage-media economics under the bill, and the cloud-versus-on-prem case for security telemetry. How to run a benchmark that doesn't lie, including the license clauses that leave vendor benchmarks as the only ones published.
Depth tier for ch1 (Manageability) and ch3 (benchmarking honesty) · 10 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are about to read the frame (Orientation), the argument (Depth), or the narrowest first-party finding (Evidence). The durability tag flags whether a number is durable architecture or an Evidence-pinned result tied to a version or price and meant to be re-run. The last tag is the provenance state, meaning who held the pen and who checked the work, which is explained in full on how these are made.
Method
How the evidence on this site is weighed and measured, which the cost essays below lean on.
- Start here OrientationDurableAI-drafted, observed
The two cultures: evidence and marketing.
Data engineering built a culture of evidence (public benchmarks, open architectures, documented failures, quantified trade-offs) while security decides on vendor marketing, analyst reports, anecdote, and compliance checklists. The five principles of modern data architecture framed for a security reader, and what they become when you build them for security.
Read →
- DepthDurableAI-drafted, observed
How to run a benchmark that doesn't lie.
Rule zero, learned the hard way: verify the answer before you trust the clock, because one engine returned a filtered count tens of rows short over byte-identical Parquet and a timing-only run would have published it as a win. The rest of the method follows from that: report the CV, scale until the signal clears the noise, register identical bytes, isolate the run, control the power plan, hash logical rows not file bytes.
Read →
Economics
- DepthDurableAI-drafted, observed
We are our own worst enemy.
Reed's Law says a set of N members can form 2^N − N − 1 subgroups, and read backwards over a security stack that is the bill nobody budgets, because what you end up paying for is the combinations between the tools. Walks the lineage from Schneier and Geer through Perrow and Conway, takes Venables's objection that bad design is the real enemy at full strength, and answers it, since the design failure is collective and combinatorial rather than lazy. Ends on the two fixes: an open narrow waist in the stack, and what the same logic asks of a new domain owner.
Read →
- DepthEvidence-pinnedAI-drafted, observed
Why modern data stacks haven't replaced SIEMs.
The technical case for the modern data stack is settled and the SIEM persists anyway, because the barrier was never technical. The four real barriers to leaving (risk aversion and 2am blame, a skills-timeline mismatch, the migration rebuild itself, status-quo bias), why the team defending the SIEM is a rational actor managing operational risk, and what actually moves it.
Read →
- DepthEvidence-pinnedAI-drafted, observed
The write endurance security data never spends.
Drive media is the majority of a security data platform's bill, which makes the NVMe endurance tier a first-order cost decision. The contrarian read: mixed-use and write-intensive drives are sold at a premium a write-once-read-rarely security lake almost never consumes, and the industry stopped publishing the data that would let you check.
Read →
- DepthEvidence-pinnedAI-drafted, observed
The repatriation case for security data.
Cloud repatriation is well-covered macro ground. The narrower, stronger claim: security telemetry is the textbook workload to bring home, because it's steady-state, write-heavy, retained for years and increasingly bound by sovereignty rules, which is exactly the profile cloud's variable pricing overcharges. The cheap, correctly-specced on-prem media is what closes the math.
Read →
- DepthEvidence-pinnedAI-drafted, observed
The index in your bucket.
A tip said a category called 'scanners' was having a moment. The category name turned out not to exist, the architecture is real and older than its supposed leader, and between index-as-store and open-table sits a third build nobody has fully priced: raw logs in your bucket at S3 economics, searchability in a proprietary sidecar only the vendor's engine can read. Where the lock-in actually goes at exit, and the correctness question a closed index makes unanswerable.
Read →
- DepthDurableAI-drafted, observed
The storage is moving, the engine isn't (yet).
The loud off-Splunk story says the open lakehouse is replacing the SIEM analytics engine at scale, now. The quieter, better-sourced read: storage and pipeline are moving fast and measurably while the engine stays put, and the gap between the two is where a buyer gets oversold.
Read →
- DepthEvidence-pinnedAI-drafted, observed
The cost optimization paradox in security data.
Practitioner surveys rank cost optimization near the bottom of the priority list while boards and markets force it first. The collision between those two timescales, and why it keeps producing the same SIEM cost conversation even as the tooling around it improves.
Read →
- EvidenceEvidence-pinnedHuman vetted
The index pays twice.
A hot search index stores 4.2× the bytes at 3.5× the price per byte, so it costs about 14.8× a warm Iceberg-on-S3 lakehouse for the same events. At thirty days the gap is a rounding error; at the seven-year retention horizon a regulated firm has to plan for, it is the difference between a line item and a project. A measured storage floor, Tier B and first-party single-host, explicitly not a TCO model.
Read →
