$25M New growth round

Keep your stack.
Shrink the bill.

Abstract is the composable SIEM. Collection, detection, retention and AI SecOps run as independent layers, so you shape data before it's billed and keep the tools you already own.

Get Abstracted Explore the platform

01 The problem

Legacy SIEMs are one welded block.

Collection, storage, detection and billing ship as a single platform. Change one and you re-platform all of it, while every byte is indexed and billed before anyone asks if it matters.

02 Decouple

Abstract splits it into layers.

Four independent layers, each one swappable and each one scaling on its own. Data moves between them on your terms, not your vendor's.

03 Collection

Shape data before it's billed.

Collect from every source, drop the noise at the edge, normalise to the schema you need and route each stream where it's worth paying for.

Sources
Cloud · SaaS · Identity · Endpoint · Network
Schemas
OCSF · ECS · CIM

04 Detection

Catch threats in the stream.

Detections run on data in motion, before it lands, then re-run across history when new intelligence arrives.

Mode
Streaming · Historical
Signal
Pink = threat flagged in flight

05 Swap any layer

Keep the storage you already own.

Use Abstract's tiered retention or point the layer at your own lake. Nothing above or below it has to move.

Runs beside
Splunk · Sentinel · Google SecOps · CrowdStrike

06 AI SecOps

Analysts start from an answer.

AI agents triage, enrich and investigate every alert with the full context the layers above have already shaped.

Get Abstracted
A The cost

Your SIEM bills every byte.
Detection uses a fraction.

SIEM pricing scales with data volume, and security data grows 25–30% a year. Most of it is indexed at hot-storage prices and never queried by a detection.

“Our old model was ‘log everything and sort it out later.’ That worked until storage costs and performance caught up to us.”
Head of Security Operations
  1. Cause 1

    Locked in

    Detection is tied to storage, storage to licensing, licensing to one vendor. Every upgrade is a rip-and-replace.

  2. Cause 2

    The data swamp

    Critical telemetry and never-queried compliance logs are indexed, stored and priced the same way.

  3. Cause 3

    Broken economics

    The bill tracks volume, not value. It grows every year; confidence that a real attack gets caught doesn’t.

FIG. 01 ingest.report · last 24h Billed Used by a detection
  1. Firewall & flow logs1,2408%
  2. DNS queries62012%
  3. Compliance archive6200%
  4. Debug & heartbeats5400%
  5. EDR telemetry52050%
  6. Cloud audit48050%
  7. Identity & SSO18070%
Billed4,200 GB/day
Used by a detection800 GB/day
Paid for, never queried81%
Billed for never-queried data since you got here$0.00≈ $3.20 a minute at this estate

Illustrative estate. Abstract’s research: 80% of stored data is never used for detection or response.

B Platform

Take the SIEM apart.
Keep what earns its place.

Abstract splits the SIEM into four layers that run on their own. Watch each one work on live data, then compose your own stack.

Layer 01 · Security data fabric

Shape data before it’s billed.

Collect from every source, then filter, normalize and route at the edge, so each stream lands where it’s worth paying for.

  • Drop debug noise and duplicates in flight
  • Normalize to OCSF or ECS
  • Route by intent: SIEM, lake or both
LIVE pipeline · edge-01 Streaming
In4,200GB/day
To SIEM1,520GB/day
To lake1,180GB/day

Layer 02 · Streaming + historical

Catch threats in the stream.

Detections run on data in motion, before it is indexed, then re-run across history when new intelligence arrives.

  • Alerts in milliseconds, not after indexing
  • Abstract Intel rules plus your own
  • Matches hand straight to AI SecOps
LIVE detect · streaming Rule armed
rule impossible_travel + new_mfa_devicemode: streaming · historical
ALERTwaiting for a match…

Layer 03 · Tiered storage

Keep the storage you already own.

Tier data by what it’s for: hot for what you hunt, low-cost for what compliance needs. Point the cold tier anywhere; nothing above it changes.

  • Hot, warm and cold tiers
  • Bring your own lake or keep your SIEM
  • Swap providers without re-platforming
LIVE retention · tiers Policy active
  1. Hot7 daysdetection-grade
  2. Warm90 daysinvestigations
  3. Cold1–7 yrsLakeVilla
Cold tier lives in
  • Collection rules unchanged
  • Detections unchanged
  • No re-platforming

Layer 04 · Agentic triage

Analysts start from an answer.

AI agents triage and investigate every alert with the context the pipeline already added, so people review conclusions, not raw logs.

  • Triage on every alert
  • Context from collection and detection
  • A verdict and a next step, with evidence
LIVE ai-secops · case 4471 Agent online

All four · your order

Start with one layer. Add the rest when they pay off.

Each layer runs on its own and plugs into the stack you already have. Switch one on today; everything else keeps working where it is.

  • No rip-and-replace
  • Keep your SIEM, lake and tools
  • One pipeline feeds every layer
CONFIG stack.yaml · try it Applied
  1. collection
  2. detection
  3. retention
  4. ai_secops
C What it does to the bill

Pay for signal,
not storage.

SIEM pricing scales with volume. Security data keeps growing, compliance keeps it for a year or more, and most of it never feeds a single detection.

Scroll the invoice. The beam runs the pipeline over each line and re-prices what it touches.

  • Monolithic SIEM
  • With Abstract in front
0 / 6 lines re-priced
INVOICE SIEM-2026-10 · monthly Illustrative · 4.2 TB/day estate
  1. Ingest licenceFirewall, VPC flow and DNS, all of it
    Filtered and deduped in stream
    $68,400$24,600
  2. Indexing & computeCompliance logs nobody queries
    Only detection-grade data indexed
    $31,200$11,200
  3. Hot storage · 365 daysEvery byte priced the same
    Hot 7 days, then a low-cost lake
    $27,500$6,900
  4. Second copy for the data lakeSame data, ingested twice
    Collected once, routed to both
    $18,900$0
  5. Source onboarding servicesParsers for every new source
    Normalized to OCSF in the pipeline
    $14,000$2,400
  6. AI assistant add-onSummarising alerts that shouldn’t exist
    Agents read filtered, enriched data
    $12,000$5,200
Monthly total $172,000

Scroll to apply the pipeline

Figures are illustrative. Abstract models yours on the demo call.

D Use cases

Start where your stack
hurts most.

You don’t replace everything. Pick the problem you have today; Abstract swaps in one layer and the rest of your stack stays put.

What teams tell us

Swap one layer:

Today
With Abstract

E Customers

Shipped to production.
Signed by the people running it.

Security leaders in consumer, defence-tech and supply-chain intelligence, in their own words.

Also in productionAll customers ↗

  • OneMain Financial
  • Health-ISAC
  • Betsoft
  • Dune
  • Acoustic
FIG. 05 git log --author=juul
F Integrations

Keep your SIEM.
Fix what feeds it.

Collect once from any source, then route each stream to the destination it’s worth paying for. Pick a source to trace its route.

Abstract
  1. normalize
  2. enrich
  3. detect
  4. route

Representative sources and destinations. See abstract.security for the full integration list.

G Get Abstracted

Get
Abstracted.

We'd love for you to be part of the journey. Grab a coffee with us, have a chat and see a demo, from one of the most fun teams in cyber.

abstract — demo

$ abstract demo --book