By Brian Brown, Chief Revenue Officer
Every security leader we talk to knows the war room. It’s the room you end up in when something has already gone wrong: the screens are full, the coffee is cold, and the same three questions keep coming back. When did this start? What else did they touch? Were we ever exposed before anyone told us to look?
Over the last nine posts, we’ve made one argument from a lot of different angles: the answers to those questions are not decided in the war room. They’re decided long before, in the engine room, the data layer underneath every SIEM, SOAR, detection rule and, increasingly, every AI agent. If the engine room kept the evidence at full fidelity, kept it long enough, and can answer fast, the war room has a fighting chance. If it didn’t, no amount of talent or tooling upstairs can bring that evidence back.
We want to use this post to pull the series together, because when you read the nine posts side by side, the picture is bigger than any one of them. And we’ll be honest: we’re more excited about where this is going than we’ve been about anything in a long time.
What nine posts told us
We started with arithmetic and ended with nation-state tradecraft. Here’s the short version of each stop along the way.
| Topic | Summary |
| Retention Math | Median dwell time rose to 14 days (M-Trends 2026) while breakout time fell to 29 minutes. The average breach lifecycle runs 241 days; the typical hot window runs out around day 90. |
| What Petabyte Scale Actually Unlocks | When the trade-off between deep history and fast query goes away, teams stop doing the same analysis faster and start asking questions they had filed under “not possible.” |
| Detecting Low-and-Slow Beaconing | A beacon is a pattern over time. You can’t compute the variance of intervals you never recorded, so sampling and short retention kill the detection before any logic runs. |
| Retrospective IOC Sweeps | Indicators arrive after the activity they describe. With full history, “were we ever exposed?” becomes a join, not a project. |
| One Engine, Many Questions | The hard part was never the SQL. It was getting the tables into one place where they could be joined. |
| Fusing Security Telemetry with Business Data | Fraud, insider risk, third-party risk and network operations all have one foot outside the security dataset. Shared entity keys turn those questions into queries. |
| CASA | AI agents change the shape of the workload. Keeping storage next to compute removes the network hop that would otherwise throttle them. |
| Prevention Is a Data Problem Too | Vulnerability, credential, configuration and exposure management have the same data problem detection has. |
| How Advanced Intrusions Evade Detection | Volt Typhoon, Salt Typhoon, BRICKSTORM and SUNBURST outlasted the evidence defenders kept. The attacker’s lasting advantages are looking normal and staying longer than your logs. |
The thread running through all of it
Strip away the specifics and every post lands in the same place: the defender’s advantage is the data, and most organizations have been forced to give that advantage away.
They haven’t done it carelessly. For years the choice has been either 1) retain everything and watch cost and performance move the wrong way together, or 2) filter, sample and age out data to stay on budget. Dynatrace found organizations exclude an average of 86% of their log data from ingestion, storage or analysis because of cost and system limits. One CISO described it to us as TSA screening one in every ten passengers and calling it security. That’s not a people problem or a tooling problem. It’s an engine room problem.
What the series kept coming back to are four things that have to be true at the same time:
- Full fidelity. Every flow, every DNS record, every auth event, because the rare event is exactly what sampling deletes.
- Full history. Retention measured against attacker timelines, which run in months and years, not against whatever the storage budget allowed.
- Answers at the speed of the question. Interactive query across trillions of rows, so an analyst iterates in the same sitting instead of filing a ticket.
- On infrastructure you control. On premises, private cloud, GovCloud or air-gapped, at a fixed cost that doesn’t meter curiosity.
None of that replaces the war room. The SIEM, SOAR, and detection tools your team already runs stay right where they are. The engine room gives them a longer memory and a wider reach, and feeds the results back up to where your analysts already work.
Why AI raises the stakes on the engine room
Here’s what has us most fired up: AI for cybersecurity is finally moving from slideware to real work: agents that triage, hunt, scope incidents, and check every new indicator against the past. But an agent is only as good as the data it can reach, and today most agents are being asked to reason over fragmented, sampled, short-window data. That doesn’t remove the gaps. It automates them, at machine speed, with confidence.
The attackers aren’t waiting. Breakout time is down to 29 minutes. AI is lowering the cost of phishing and attack automation, and frontier models may surface vulnerability chains faster than defenders can track them. If the offense is getting faster, the defense can’t afford an engine room that runs on a 90-day memory.
Getting AI for cyber right comes down to a few principles we believe in deeply:
- Push the analysis down into the engine. Let the agent ask the question and let the query engine do the heavy lifting across years of full-resolution data. The data stays put; only the answer moves.
- Deterministic answers with an audit trail. When an agent tells a regulator or a board “we were never exposed,” you need to show the query and the data behind it, not a best guess.
- Economics that welcome curiosity. An agent may run the same check every few minutes, all day. Under consumption pricing that’s a budget problem. Under fixed capacity it’s just the job.
- Your data, your models, your walls. Hardware-agnostic and model-agnostic, running where your most sensitive data already lives, without handing a copy to anyone to train on.
That’s the engine room AI needs. When it’s in place, the war room gets an analyst that never sleeps, never forgets and can look back years without waiting on a rehydration ticket.
An invitation to the whole industry
First, credit where it’s due. The progress this series describes isn’t ours alone. It belongs to the threat researchers who document these campaigns in public, the agencies who publish the advisories, the SIEM, SOAR, and pipeline builders who gave analysts a place to work, the model builders bringing AI into the SOC, and the defenders who show up every day in rooms most people never see. This industry has done remarkable work with the data it’s been allowed to keep.
What those teams deserve now is an engine that keeps up with them: one that performs at the scale they actually operate, enables every question they want to ask, and never makes cost the reason a question goes unasked. That’s the engine room we’re building. It plugs in underneath the tools people already trust rather than replacing them, so every human and every agent works from the complete record.
And this isn’t only about our customers. It’s about the industry. Full-fidelity, full-history data paired with AI is new ground, and no single company is going to break it alone. So here’s our invitation to the platform builders, the intelligence teams, the AI companies, the researchers, the agencies and the defenders on the front line: let’s break this new ground together. Bring the question you’ve always filed under “not possible with our data.” That’s our favorite kind of conversation.
The war room isn’t going anywhere. But the next chapter of cyber defense will be written by the teams, and the industry, that invest in the engine room together. We can’t wait to build it with all of you.
Ready to break new ground? Let’s talk.