MixMode in the Real World: Customers Turn to MixMode Frustrated and in Search of a Viable SIEM Alternative

Christian Wiens Director of Marketing

Christian Wiens is Director of Marketing at MixMode. He has 10+ years of experience as a cybersecurity professional. He has his BA from The University of California, Berkeley and resides in Austin, TX.

SIEM has failed to meet the needs of enterprises in the modern threatscape. One huge reason for this is that over time, most organizations will come to the sad realization that they will never achieve a full enterprise deployment of their SIEM. By its very nature, SIEM is always “in process.” It’s not unusual for an organization to have an SIEM in process for a full decade.

Along the way, these organizations will be hit with ever-increasing costs for additional applications to address the shortcomings of SIEM, as well as astronomical licensing and data ingest costs. This is an unsustainable situation that becomes more difficult to justify as time goes on.

“One of the most common failings I have seen is a SIEM overstuffed with useless data. A SIEM should augment analysis, not hinder it. Put simply: less is more. The more data you have, the worse the SIEM performs.”
Justin Henderson, SANS Institute

Many customers come to MixMode with a very specific business problem: “I’m trying to address the same functional requirements today that I was trying to address 15 years ago and these systems have proven ineffective at addressing not only my functional requirements but they’ve also created operational and technology costs that are unsustainable.”

It’s a sobering reality that the functional limitations of a SIEM identified 15 years ago are the same functional limitations of a SIEM today.

Customers routinely encounter aggressive SIEM vendors who encourage them to consider adding IT operational intelligence as an additional SIEM platform deliverable. They do this by creating layer upon layer of abstraction, normalization, reporting, queries, thresholds-based alerts and dashboards, which all come at a premium.

These customers need an alternative, and in one recent example, MixMode was able to demonstrate better granularity and authentic visibility into both real-time threats as they occurred as well as network and operational configuration challenges.

“We were not only able to save money, we were able to actually retrieve budget by deploying MixMode and reallocate that budget more effectively while better addressing the functional requirements of the deployment across our different lines of business.”