LogLogic discounts SIEM

by Rocky DeStefano

Today LogLogic announced it is attempting to push the market towards a more cost effective solution for SEM/SIEM.  On one hand I get “it” and applaud the attempt to push price downward, but on the other hand the overall strategy seems to me, albeit without the benefit of the larger picture, ill-conceived, ill-timed and in my opinion it may devalues the company’s effort in that space especially when you consider the quote at the end of the press release (more on that later).

Positive Reflections on this announcement:

LogLogic is a almost exclusively a channel driven sales entity and the “channel play” with a move like this makes perfect sense.  It allows even more flexibility by the channel to sell downmarket, but I would have expected an announcement like this to coincide with a major channel or partner strategy announcement.  A refreshed service offering being made available through partners or a partnership with several managed services to deliver more value, etc.  Something that would represent a larger strategy is in play.  Maybe I missed it?

Help me maybe I’m missing something:

If the focus of the pricing strategy was log management, storage or just about any product outside of SIEM that might be considered a commodity within the IT world I’d understand the pricing movement.  To me SIEM is much more complex and as such requires continuous effort and is not ready for this pressure.  Right strategy, wrong product.  In my opinion they should have lowered price on the commodity (Log Management / IT Search).

Very often I’ve heard of Symantec, RSA (via EMC), Q1 (through Juniper/Enterasys), SenSage (through HP) and of course Mars (via Cisco) basically giving SIEM away for free as a bundle with other products or services, yet companies like Q1 and ArcSight continue to knock the ball out of the park at a “premium” rate (via direct or indirect sales). 

If the leaders in the space can compete at that level with the huge machines in this environment how does LogLogic affect the market at all with this announcement?  Without the context of a larger product strategy or channel/partner offering this new pricing effort seems like a missed opportunity at best and a last ditch effort at worst.  (I hope it is not the latter).

As a company LogLogic seems to be doing well (43% year over year growth) but I think this SIEM pricing strategy confirms that the growth is relative to the strengths of their Log Management product.


Another Possibility:

Ok so there is another thread running through my head about this subject.  Which is that this pricing move simply reflects the reality of their effective price book.  Depending on the spin doctor this might be taken a few different ways:

1. SIEM has a ton of features that most users can’t quite implement because the vendors haven’t made it easy enough - so why charge a premium?

- or -

2. We don’t have the ability to do “x” or “y” so we can’t charge a premium and compete in that space.

Given what I know about the LogLogic team, it actually makes sense that this was the thought process.  They are sharp and motivated to do the right thing.  Even so, it doesn’t detract from some of the things I presented above as potential missed opportunities.  If this is true then does it also mean when (if) those advanced features are developed the pricing model gets complicated?


Misguided Quote:

The quote at the end of the press release is even more haphazard than the announcement itself.  (Paraphasing the quote by Mike Davis: “We see 80+% of the needs of the SIEM space being satisfied by log management. SEM fulfills a further 10+% of those needs” to be that quote is dangerously misguided on two fronts.

  1. This quote signifies the lack of market understanding, a lack of appreciation of SIEM or maybe just an overestimation of Log Management. Perhaps the quote is relative to only the qualities of a SEM (versus SIEM), but that doesn’t reflect the reality of the market today (Log Management and SIEM) and serves no real purpose other than to discount the value of SIEM/SEM.
  2. The quote also serves to invalidate a product that LogLogic invested in with the purchase of ExaProtect and continues to attempt to sell as a competitive offering in the space.  It seems odd to invest in a technology that only meets 10% of a market need (still leaving 10% unfulfilled).  It is my opinion that the quote does more damage than service to Log Logic.



I don’t disagree that there should be pricing rationalization that occurs across the market, but I’m not convinced LogLogic took the best approach (or perhaps I simply don’t understand the strategy well enough at this point).  I’m hoping they’ll take the time to enlighten me!

Reference:  http://loglogic.com/news/news-releases/2010/05/loglogic-slashes-sem-prices/

Note:  I apologize I wasn’t able to get input from LogLogic in time for this initial post but I will update the comments of this post with any lessons learned from LogLogic.   I really do want to understand and not just seem like I’m beating them (or anybody) down.