Replacement of the current SIEM platform due to unsustainable cost increase
- Who
- The decision
- At stake
- They chose
- What happened
- Core lesson
What we said vs. what happened
They weighted support at 10%, but a named 3am engineer decided it — and unscored usability knocked a finalist out.
GAP
| What we said we'd judge on | Weight | What actually happened | |
|---|---|---|---|
| Threat detection coverage | 30% | All four could detect everything we cared about — decided nothing. | |
| Query performance at our volume | 15% | Corvid slowed badly on 90‑day lookbacks — that knocked Corvid out. | |
| Price | 25% | Threw out the incumbent; the other three were within about $30k over three years — decided nothing else. | |
| Support | 10% | The named 3am phone call decided it. | |
| Will the team actually use it daily | — | Our SOC stopped opening Sentrix two weeks into the trial — that knocked Sentrix out. |
Source: The buyer (Dana Whitfield) and team — Interview transcript; their described scorecard and trial results.
Feature comparison
Once table stakes were cleared, 3am named support was the separator: NightOwl included it, Sentrix didn’t, Corvid charged extra.
PYRAMID
| Can it do this? | LogHarbor (incumbent) | Sentrix | Corvid | NightOwl |
|---|---|---|---|---|
| A named engineer we can call at 3am | ||||
| Detection coverage (our test scenarios)Table stakes | ||||
| Integrations we needed (12 incl. card switch)Table stakes | ||||
| Query performance on 90‑day lookbacks |
Source: The buyer (Dana Whitfield) and team — Interview transcript.
Decision timeline
Nine months of evaluation, one meeting decided it — the 3am support question.
TIPPING POINT
Renewal quote lands (+28%)
Pricing model changed to ingest; that’s what sent us to market.
We wrote the scorecard
Five criteria, weighted, before talking to vendors.
Two head‑to‑head trials
Side‑by‑side on replayed production logs; demos and security review.
Seriously considered building our own
Open‑source pipeline modelled; break‑even only if fully staffed.
Final meeting: “Who picks up at 3am?”
Named engineer, not a ticket queue — that question decided it.
Chose NightOwl
We bought the 3am phone call.
Migration overran
Went live in May instead of January; +$35k nobody priced.
Source: The buyer (Dana Whitfield) — Interview transcript.
Who dropped out, and why
Support model picked the winner; price only eliminated the incumbent.
TOURNAMENT
| LogHarbor (incumbent)Established standard | Too expensive | 28% renewal hike and a switch to ingest pricing — price knocked out exactly one vendor.After that, price decided nothing else. | |
| Sentrix | Nobody used it | SOC stopped opening it two weeks into the trial; no named 3am support; card switch connector was only on the roadmap. | |
| Corvid | Above budget for support | Named 3am support only on Enterprise Plus (+$95k/yr); also slowed on 90‑day lookbacks. | |
| NightOwl | Chosen | Included a named TAM and on‑call engineer. We bought the 3am phone call. |
Source: The buyer (Dana Whitfield) — Interview transcript.
What we skipped
Skipping reference calls was the cut that hurt: it hid a 4‑month migration overrun.
LEAP OF FAITH
| Formal RFP | Skipped | No issues — we went straight to vendors already on procurement's approved list. | |
| Second trial round across every business unit | Cut to 2 weeks in one unit | Shortened due to the renewal deadline; not what caused the migration overrun. | |
| Security review | Kept in full | We refused to shorten it, and I'm glad. | |
| Reference calls | Skipped | Three phone calls would have saved a four‑month migration overrun surprise. |
Source: The buyer (Dana Whitfield) — Interview transcript.
Stakeholder map
One influence question (3am support) overrode the scorecard.
SHADOW
Dana WhitfieldDecision | Not established in the research | ||
our CFOSponsor | Held the budget — Dana had to defend spend against a $1.1M tooling budget. | ||
Priya (Deputy CISO)InfluenceChamp | Asked the 3am support question that decided it. | ||
Marcus (deputy)Influence | Built the weighted scorecard; modeled the open‑source build option. | ||
SOC analystsInfluence | Their actual trial usage knocked Sentrix out when they stopped opening it. |
Source: The buyer (Dana Whitfield) and team — Interview transcript.
What the money actually buys
The cheapest finalist didn’t win — they paid about $75k more over 3 years mainly to buy 24/7 named support.
PAIN MAP
| What we're paying to solve | Sentrix | Corvid | NightOwl |
|---|---|---|---|
| Not offered | +$95,000 (Enterprise Plus) | Included (≈$40k baked into tier) | |
| Total | $735,000 | $765,000 | $810,000 |
Source: The buyer (Dana Whitfield) — Interview transcript.
How they decided
Consulted: Skipped:
What they'd do differently
Unknowns — what one case can't tell you
Underlined claims open the interview moment behind them.