Abstract Security, a San Francisco-based provider of a composable SIEM platform, has raised $25 million in growth financing. The round was co-led by Cheyenne Ventures and Advance Venture Partners, with participation from Crosslink Capital, Rally Ventures, and Olive Hill Ventures. Abstract's platform breaks traditional SIEM into independent components for data collection, detection, retention, and AI-enabled operations, allowing teams to avoid vendor lock-in while processing data in real time before storage.
SIEM Displacement Fuels New Architecture
The timing aligns with enterprises seeking alternatives to legacy SIEM platforms amid rising costs and architectural rigidity. Cribl raised funding in its Series E at a $3.5 billion valuation in August 2024. DataBahn.ai secured a $17 million Series A in June 2025. Abstract's modular approach decouples ingestion from detection and storage, addressing the gap where organizations pay for data volumes that deliver little analytical value.
Legacy SIEM Economics Break Down
Traditional SIEM deployments tie costs directly to data volume, with many enterprises facing annual growth of 25-30 percent in log data. The result is high spend on storage of signals that never reach detection or response workflows. Abstract routes and filters data in-stream using the OCSF schema, achieving roughly 35 percent volume reduction before it reaches expensive tiers.
Streaming Detection Replaces Post-Storage Analysis
Abstract processes security data through a real-time streaming fabric that normalizes, enriches, and routes telemetry before it lands in storage. Detection runs in-stream, historically, or in federated mode across wherever data resides. Retention uses three tiers—real-time, hot, and warm—while Astro AI assists with triage, investigation, and response. This differs from pipeline-only tools that still require a separate SIEM.
"For more than two decades, SIEM has been the foundation of security operations. AI-Gen Security Operations is what's next," said Colby DeRodeff, CEO and co-founder.
Investors Back Platform Transition Thesis
Cheyenne Ventures brings prior cybersecurity exits including Adallom to Microsoft and Verodin to FireEye. Advance Venture Partners provided patient evergreen capital with a track record in enterprise platforms. The round values the company at triple the prior round and follows 380 percent recurring revenue growth since the $15 million Series A in October 2024.
SIEM Market Shifts Toward Modularity
The SIEM market is estimated between $8.4 billion and $12.1 billion in 2026, with projected CAGR between 10.3 percent and 15.5 percent through 2031-2033. Competitors include Edge Delta, which raised $63 million in its Series B in May 2022, and Observo AI, acquired by SentinelOne for $225 million in September 2025. Structural drivers include 50-100 percent annual log growth, talent shortages, and backlash against monolithic pricing models from vendors such as Splunk and Microsoft Sentinel.
Strong Execution Signals Category Momentum
Abstract reports a customer base that tripled in the past year alongside 264 percent net revenue retention. The company maintains integrations with Netskope, SentinelOne, and Torq while expanding availability across AWS, Azure, and Google Cloud marketplaces.