Arancia and DarkSense Recognized in Gartner® Research on SIEM Cost Reduction

In the September 2026 Gartner® research report SIEM Cost Reduction: Four Strategies for Balancing Visibility & Budget (Document ID: G00861204), Gartner recognized Arancia and DarkSense  Platform as part of it’s research exploring how organizations can optimize Security Information and Event Management (SIEM) costs while maintaining critical security visibility and detection capabilities.

We’re Proud to Share That Arancia and Its DarkSense Platform Have Been Included in Gartner’s September 2026 Research, SIEM Cost Reduction: Four Strategies for Balancing Visibility & Budget

The report includes Arancia among examples of vendor-specific detection engineering automation solutions and DarkSense Data Pipeline among examples of embedded commercial telemetry pipelines.

For our team, this inclusion marks an exciting milestone and reflects our continued commitment to helping organizations build smarter, more efficient, and resilient security operations.

It also highlights a challenge our customers face every day: how to control SIEM costs without compromising the visibility and evidence needed to detect, investigate, and respond to threats.

Addressing the Growing Challenge of SIEM Costs

As organizations generate increasing volumes of security data across cloud services, identity platforms, endpoints, network controls, and business applications, managing SIEM costs has become a growing challenge. Retention requirements extend the bill. A collection policy that once seemed prudent can become a recurring expense that few security leaders can defend source by source.

According to Gartner’s research, a commitment based on one terabyte of daily log volume can approach $1 million annually. However, reducing costs shouldn’t come at the expense of security visibility.

The report presents four related approaches to SIEM cost reduction: detection engineering, distributed detection, telemetry pipelines, and multi-tier storage. Its central argument is that cost control starts with technical and operational decisions about data, not simply with a licensing negotiation. Arancia and DarkSense appear as vendor examples in two of those areas. Gartner does not endorse any vendor named in the report. The inclusion is encouraging because this is the work our team has chosen to focus on: making detection requirements explicit and managing telemetry before it reaches an expensive destination.

Why “Collect Everything” No Longer Works

Most security leaders understand why teams collect as much as they can. During an incident, nobody wants to discover that the decisive record was discarded six weeks earlier. Centralizing data also makes search, correlation, and reporting easier. Those are real benefits, and any cost program that ignores them will create risk.

But collecting a log is not the same as using it. Some data supports real-time detection. Some is useful only during an investigation. Some must be retained for legal or regulatory reasons. Some duplicates information already available elsewhere. Treating all four categories the same is convenient, but it is rarely economical.

The better question is not “How much can we ingest?” It is “Which security decisions depend on this data, and how quickly must we make them?” Answering it requires cooperation across the SOC, architecture, cloud, privacy, compliance, and finance. It also requires someone to accept responsibility for the trade-off. Cost reduction without a named risk owner is just an unrecorded loss of visibility.

Detection Engineering Ties Cost to Coverage

Detection engineering connects a threat scenario to a testable rule and then to the data that rule needs. That chain gives a security leader something concrete to review. If a high-volume source supports no active detection, no investigation requirement, and no retention obligation, its place in the SIEM should be challenged. If a critical rule depends on a particular field, that field should be protected through every parsing and routing change.

Tools alone will not provide that discipline. Rules need owners, testing, peer review, change history, and regular measurement. False positives should be reduced; stale rules should be retired; coverage gaps should be documented. This is ordinary engineering work, and it is how a team can lower spend without relying on guesswork.

Example from a DarkSense demo environment: detection rules are managed with status, severity, version, log source, and run frequency visible in one place. That kind of rule-to-source mapping is what lets cost decisions stay connected to coverage decisions.

A Telemetry Pipeline Is Also a Security Control

A telemetry pipeline sits between log sources and destinations such as a SIEM, an MDR service, or a data lake. It can parse records, standardize fields, remove duplicates, enrich events, and route different data to different storage tiers. Used carefully, it keeps expensive real-time systems focused on the records they need while preserving other evidence at a lower cost.

The word “filter” should still make a CISO pause. A pipeline can remove cost, but a careless change can also remove the evidence behind an alert. Filtering and routing policies therefore need the same controls as detection rules: an owner, a stated purpose, testing, approval, monitoring, and a way to roll back. Savings should be measured alongside coverage and investigation outcomes, not reported on their own.

A pipeline is not a substitute for knowing your data. Before changing a route or dropping a field, document which detections, investigations, reports, and retention duties depend on it. Where the answer is uncertain, test first and keep a recoverable copy until the effect is understood.

The AI Point, Without the Hype

Gartner also connects structured security data with AI-assisted operations. The underlying point is sensible: an automated system cannot compensate reliably for missing context, inconsistent fields, or poor source data. It will process what it receives, including the mistakes.

That does not make “AI-ready” a useful buying criterion on its own. The immediate return on consistent fields, a documented path from source to destination, and tested detection logic is better day-to-day security operations. If that work later supports dependable automation, so much the better. A CISO should ask for evidence of both before approving another technology investment.

Five Questions Before Changing SIEM Ingestion

Which threats and active detections depend on this source? Does the data need to be searchable in real time, or can it be retrieved from a lower-cost tier? What legal, regulatory, insurance, or incident-response requirement governs retention? What would we fail to see if we filtered it? Who owns the decision, and how will we know if it was wrong?

If the team cannot answer those questions, the immediate job is discovery. Do not approve a blanket reduction target and leave analysts to decide, under time pressure, which evidence the organization can live without.

A Practical Place to Start

Start with a focused review of the highest-volume log sources and the detections they support. A first pass can be completed without redesigning the entire SOC.

Example from a DarkSense demo environment: asset and log-source visibility gives teams a practical starting point for deciding which telemetry deserves real-time treatment, which needs retention, and which should be reviewed for waste.

• List the ten largest sources by daily volume and annual cost.
• Record the detections, investigations, reports, and retention duties each source supports.
• Separate data needed in real time from data that can be retrieved later.
• Test duplicate, unused, and excessively verbose records for filtering or lower-cost storage.
• Name an owner for every rule and routing policy, with a review date and rollback plan.

The objective is to tack more than dollars. Record ingestion volume, storage and compute cost, alert quality, detection coverage, investigation time, and retrieval time for archived data. The aim is a defensible reduction in waste, with evidence that the team can still see and investigate the threats that matter to the business.

A Milestone for Arancia and DarkSense

We’re incredibly proud to see Arancia and DarkSense included in this Gartner research.

Behind these references are our engineering, product, and cybersecurity teams, who have worked through the complex challenges of inconsistent data formats, fragile integrations, false positives, platform limitations, and budgets that do not expand with growing telemetry volumes.

This milestone also reflects the valuable collaboration of our customers and partners, whose feedback and real-world experiences continue to shape the evolution of our platform.

As we continue to advance DarkSense, our focus remains the same: help security teams make careful, explainable decisions about their data, reduce avoidable cost, and preserve the ability to respond when something goes wrong.

How Arancia Can Help

Review The Evidence Before Reducing Ingestion

Arancia helps security teams connect SIEM spending to detections, investigations, and retention requirements, then make changes with clear ownership and tested controls.

• Review high-volume sources and the detections that depend on them
• Test and improve detection rules, ownership, and change control
• Design routing, filtering, enrichment, and rollback policies
• Place investigation and retention data in appropriate storage tiers

If your SIEM bill is growing faster than your confidence in what it collects, talk with Arancia.

Read the full report, accessible to Gartner clients only.

Gartner, SIEM Cost Reduction: Four Strategies for Balancing Visibility & Budget, Alex Tytarenko, Kevin Schmidt, 9 September 2026.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.