Chloe Maraina brings a unique perspective to the intersection of data science and enterprise security, focusing on how visual storytelling and big data analysis can transform modern infrastructure. As organizations grapple with an explosion of telemetry, her expertise in business intelligence provides a roadmap for turning raw logs into strategic defense mechanisms. This conversation explores the shift toward integrated detection engineering, the economic pressures driving tool consolidation, and the emerging “agentic” future where customized AI interfaces replace traditional vendor-defined dashboards. We dive into the strategic maneuvers of observability challengers as they edge into the security operations space, the technical hurdles of managing petabytes of data without the friction of traditional databases, and the long-term risks of building bespoke security architectures.
The shift toward detection engineering suggests that simply moving data is no longer enough for enterprise teams; how does integrating this specialized “DNA” change the way a company supports security operations?
The move into detection engineering represents a fundamental pivot from being a passive pipe for data to becoming an active participant in a company’s security posture. By bringing in a team of 200 dedicated security engineers, a platform can finally start addressing the “coverage gaps” that haunt modern CISOs who are tired of flying blind. It is no longer just about the mechanical act of routing logs; it is about the intellectual process of mapping observed system behaviors against global standards like the Mitre ATT&CK framework. This integration allows teams to ask whether their architecture actually improves their ability to spot a breach rather than just asking if the data arrived at its destination. When you see a company transition from reducing data volumes to providing the actual content for threat detection, you are seeing a response to an intense customer pull for a more full-stack, “SIEM-like” experience that feels native to their existing workflows.
With general-purpose data giants like Snowflake and Databricks acquiring security-focused startups, how can a specialized observability platform maintain its relevance in such a crowded and well-funded landscape?
The battle for the enterprise data stack is intensifying, but the advantage for a specialized player lies in removing the “schema tax” that typically slows down general-purpose warehouses. Most security buyers are overwhelmed and simply do not have the time or the inclination to write complex ETL jobs or manage the rigid data definition languages required by the big cloud data players. There is a palpable sense of frustration when engineers have to manage schemas just to get a glimpse of their metric or tracing data. By offering a platform that provides the properties of a data warehouse without the administrative overhead, a specialized provider can compete on pure agility and speed. The strategy here is often driven by a “double the data for the dollar” mantra, essentially using a competitor’s high margins as an opportunity to provide a more cost-effective, purpose-built backend for telemetry.
The concept of an “agentic future” suggests a world where users move away from traditional interfaces; what does this mean for the way security analysts will interact with their data in the coming years?
We are moving toward a reality where the user experience a vendor designs might actually become a bottleneck rather than a benefit for the analyst. In this agentic future, enterprises will be looking for a robust repository where they can store petabytes of telemetry data, but they will want the freedom to bring their own bespoke AI agents to interpret that data. This shift reflects a desire for a “platform-first” approach where the output is the priority, allowing organizations to build their own unique experiences on top of the raw information. It feels like a liberation from the “packaged” UI, where the analyst is no longer confined to the tabs and buttons prescribed by a legacy provider. Instead, they can interact with their data through tailored interfaces that understand the specific context of their unique environment and threat landscape.
While some platforms are moving toward a “SIEM-like” experience, there are still significant gaps in threat intelligence and investigation workflows; what is required to cross the threshold into a full-scale security platform?
To truly bridge the gap between a data management tool and a full-fledged SIEM, a platform must evolve beyond simple querying to include deep, native analytics and sophisticated case management. While having a powerful search capability allows for proactive threat hunting, the missing pieces often include dedicated threat intelligence teams and integrated response workflows that can handle alert triage. Established vendors have spent years refining the “analyst experience,” creating complex investigative workflows that guide a user from the initial red flag to a documented resolution. Without these native investigation and response layers, a tool remains a vendor-neutral layer—extremely useful for deciding where telemetry goes and how it supports coverage, but not yet the central nervous system of the security operations center. It is a distinction between providing the scaffolding of a security program and providing the entire, habitable structure.
There is often a cycle where enterprises build their own custom security tools only to return to vendor solutions a few years later; how should leaders weigh the benefits of a “Bring Your Own” approach against long-term maintenance?
This is the classic “two-year itch” where an organization initially feels empowered by building a custom solution that perfectly fits their needs, only to realize the crushing weight of the maintenance required to keep it competitive. In the beginning, the “Bring Your Own” approach feels like a victory because it bypasses the limitations of the market, but as the threat landscape evolves, that custom tool often starts to look like a relic. The “oh no” moment typically arrives when the internal team realizes they cannot keep pace with the massive R&D budgets of dedicated vendors who are constantly updating their detection content and AI integrations. For early adopters with elite engineering talent, the custom route provides a temporary edge, but for most, the migration back to an outsourced platform is almost inevitable as maturity sets in. The real challenge is finding a middle ground: a platform that is flexible enough to feel custom but robust enough that the vendor handles the heavy lifting of backend maintenance and global threat updates.
What is your forecast for the convergence of observability and security operations over the next three years?
I expect the wall between observability and security to collapse entirely, resulting in a single “unified telemetry” market where the distinction between a system performance issue and a security breach becomes a matter of perspective rather than different tools. We will see a massive consolidation where the winners are those who can ingest petabytes of data at a fraction of today’s costs, specifically aiming for that “double the data for the dollar” efficiency that legacy players struggle to match. The “agentic SOC” will become the standard, where human analysts act more like conductors of AI agents that are hunting through data lakes in real-time. Ultimately, the successful platforms will be the ones that act as a vendor-neutral control plane, allowing enterprises to decouple their data from their analytics tools so they are never again locked into a single provider’s soaring margins.
