Abstract raises $25M in a new growth round

Composable SIEM

Pay for signal,
not for storage.

Abstract shapes security data in the stream, catches threats before indexing and keeps every log in the tier it's worth. It runs in front of the SIEM you already have, so nothing gets ripped out.

Book a 30-minute demo See how it works

Fig. 1Abstract, composed live

Running on Abstract

  • OneMain Financial
  • JUUL Labs
  • Altana
  • OmegaBlack
  • Health-ISAC
  • Acoustic

Take the SIEM apart.
Keep what earns its place.

  1. Today
  2. Collection
  3. Detection
  4. Retention
  5. AI SecOps
  6. Composed

Fig. 2A SIEM, as sold today

Today

One block. Every event pays full price.

A monolithic SIEM ingests, indexes and stores hot everything it's sent. Detection waits for indexing, and changing one part means replatforming the rest.

Events in
0
Billed
0
Filtered
0%

01 · Collection

Shape data before the meter runs.

The pipeline sits between your sources and your SIEM. Noise is filtered, duplicates dropped and fields normalized, so only what you'll use gets indexed.

    Input
    280 GB
    To SIEM
    66 GB
    Reduction
    -76.4%

    02 · Detection

    Catch threats while they're moving.

    Rules run on the stream, before anything is indexed. History stays available for low-and-slow hunts.

    rule same user, two logins >5000 km apart within 30 min

      Alert j.ortiz@acme · 0.6s after the event

      03 · Retention

      Store each log at the price it's worth.

      Threat telemetry and audit logs do different jobs. Each lands in the tier that fits, so compliance retention stops paying hot-storage prices.

      Real-time7 days
      2.1 TB
      Hot30 days
      9.4 TB
      Warm365 days
      118 TB

      04 · AI SecOps

      Triage with the context attached.

      Alerts arrive enriched with identity, asset and threat intel, so the AI reasons about context instead of summarising noise.

      analystIs the j.ortiz alert real?

      abstract ai

      Composed

      Four parts. Use one, or all four.

      Each part works on its own and alongside the SIEM you already pay for. Start with the one that costs you most.

      • Collectionreplaces costly ingest and parsers
      • Detectionadds in-stream rules to any SIEM
      • Retentionmoves cold data off hot storage
      • AI SecOpsone workbench across every engine

      02Speed

      One attack.
      Two clocks.

      Rules on the stream answer in under a second. An index-first SIEM answers after the data is parsed, indexed and searched. Scroll to run the same account takeover against both.

      Abstractrule on the stream

      0.0s

      Watching

      Index-first SIEMsearch after indexing

      0:00min

      Parsing

      A phished password is used to sign in from a new country.

      03Cost

      What that does to the bill.

      SIEM pricing scales with volume. Most of that volume never feeds a detection. Scroll to re-price an illustrative 4 TB/day estate, one line at a time.

      $172,000a month

      0% back in budget

        Illustrative figures. Abstract models your real bill on the demo call.

        04Use cases

        Start where it
        hurts most.

        Five things security leads say on the first call. Each tile shows what is happening underneath today, then the same picture with Abstract in front. One switch changes all five.

        Five problems as they look today.The same five, with Abstract in front of your SIEM.

        Collection

        “Our SIEM bill grows every year.”

        Every event is billed at ingest and kept hot.Noise is dropped before the meter. Audit logs go warm.

        Detection

        “We’re drowning in alerts.”

        Every rule fires on its own. Nobody joins the dots.Related alerts merge into one incident, with context.

        Collection

        “We pay to collect it twice.”

        Each tool ingests its own full copy.Collected once. Each tool gets its slice.

        Retention

        “We have a dependency, not a strategy.”

        Detection, storage and search come welded together.Three parts you own, each one swappable.

        AI SecOps

        “We bought AI. Still drowning.”

        The assistant reads raw noise with no context.It reads clean events with identity and intel attached.

        05Platform

        Keep your SIEM.
        Fix what feeds it.

        Collect once, send everywhere. Without a pipeline, every tool you add ingests its own full copy. Abstract sits in the middle and sends each tool only the slice it needs. Turn destinations on to compare.

        Your destinations. Click a tool to route to it.

        Full copies8.0 TBWith Abstract3.7 TB54%

        06Migration

        Move one source
        at a time.

        No cutover weekend. Each source moves behind Abstract when you are ready. Your SIEM keeps running, and the volume it bills drops a step at a time.

        Week 0 of 12

        4.00TB/day into
        your SIEM

        Nothing moved yet

        SourceDaily volume to SIEMRoute

        07Customers

        From the teams
        running it.

        Security teams in finance, health, gaming and consumer brands run Abstract in front of the SIEM they already had.

        “Abstract lets us scale our operations at a cost-effective pace, without losing critical visibility or detection.”
        AltanaScott BelisleDirector of Technical Security, Altana
        “Time is our most valuable resource. Abstract gives us time back.”
        JUUL LabsPablo QuirosJUUL Labs
        “Abstract Security has completely redefined security platforms.”
        OmegaBlackJonathan KovacsOmegaBlack
        “Our old model was ‘log everything and sort it out later.’ That worked until storage costs caught up with us.”
        SOCHead of Security OperationsEnterprise SOC
        “Not just another tool. A true force multiplier that made us proactive instead of reactive.”
        JUUL LabsPablo QuirosJUUL Labs

        Running on Abstract today

        • OneMain Financial
        • Health-ISAC
        • Altana
        • JUUL Labs
        • Betsoft
        • OmegaBlack
        • Dune
        • Acoustic

        08Questions

        Questions,
        answered.

        The five we hear on almost every first call. Anything else, ask the engineer on your demo.

        Get Abstracted.

        Thirty minutes with an engineer and your real volumes. Leave with your bill re-priced line by line, and a first source you could move this month.

        • Your bill, re-pricedLine by line, before and after.
        • A first source to moveWith an effort estimate.
        • Where payback startsWhich of the four parts earns first.