Security data as a business asset
Jul 30th, 2025 by Jesper Kråkhede
This month Microsoft introduced a data lake for Sentinel, meant to store large amounts of security data at a much lower cost than before. That may sound like a technical detail, but it touches a business question I have written about many times: how much security data can you afford to keep?
For years the answer has been ‘not enough’. Logging is expensive, so organisations keep the most important logs for a short time and throw away the rest. Then an incident is discovered months later and the logs that would have shown how the attacker got in are gone.
With AI the question becomes more important. AI is good at finding patterns in large amounts of data, but only in data that exists. A model can´t analyse logs you deleted to save money.
So for management, think of security data as an asset, not just a cost. Keep the high value logs searchable for detection and response. Keep the large volumes in cheaper storage for longer, for investigations and analysis. Decide on retention based on how long it takes to discover an attack, not on the default setting. And make sure the data is good enough to be used: complete, consistent and with known sources.
The question isn´t how little data you can get away with. It is how much value you can get from the data you keep.
You can´t investigate what you deleted.