Is 'SIEM-less' Really What It Sounds Like?
Sophos, Friday, October 23rd, 2026
Sophos argues SIEM-less architectures still need SIEM functions and often recreate the same complexity across several products.
Sophos argues that a 'SIEM-less' approach does not remove the need for SIEM functions, because the underlying work still has to happen somewhere.
SIEMs are flexible but carry operational complexity and rising ingestion costs, often from collecting everything just in case.
SIEM-less designs split those functions across ingestion pipelines, cross-source search and agentic SOC tools, which can recreate similar complexity spread over several products.
Sophos says compute, not storage, is the main cost driver, and frames the choice as do-it-yourself versus a fully integrated SIEM.