Why SMBs suddenly need a SIEM
Three forces push log monitoring onto small and mid-size businesses at roughly the same time: cyber-insurance questionnaires start asking "do you collect and review security logs, and for how long are they retained?"; compliance frameworks (SOC 2's monitoring criteria, HIPAA's audit controls, PCI's requirement 10) expect log review as an operating control; and one day something happens — a phished account, a strange sign-in — and the first question is "what do the logs say?" If the answer is "we don't keep any," the incident gets much more expensive.
The traditional answer — an enterprise SIEM plus analysts to run it — was built for companies with a security operations center. The tooling assumes a query language your team will learn, a rule-writing project someone will own, and a bill that scales with every gigabyte. None of that assumption set fits a 40-person company. The good news: none of it is actually required to get the value.
Pricing models: the trap to avoid
Most SIEM pricing is per-GB ingested or per log source, and both create the same perverse incentive: visibility costs money, so teams turn sources off. The firewall gets excluded because it is chatty. Workstations get excluded because there are many of them. Then the incident happens on exactly the machine that was excluded to save forty dollars. The industry calls this the visibility tax, and it is the single most important thing to design around when choosing a SIEM.
Flat-tier pricing inverts the incentive: a fixed monthly price for a daily allowance means connecting one more firewall costs nothing, so you connect everything. Check two details in any flat model: what happens in a burst (an incident is precisely when log volume spikes — a vendor that bills or drops during a spike fails you at the worst moment; look for explicit burst headroom at no charge), and whether the allowance is measured transparently so you can watch it on a dashboard rather than discover it on an invoice.
Retention: the numbers that come up
Retention requirements come from your obligations, not from the vendor's tier names. The figures that recur: PCI DSS asks for one year of audit-trail history with three months immediately available. HIPAA's six-year documentation horizon is about policies and procedures, but auditors commonly expect activity logs measured in months, not weeks. Cyber-insurance applications increasingly ask for 90 days or more. And incident responders will tell you attackers commonly dwell for weeks before detection — 60 days is a reasonable floor, and a year answers almost everyone.
Practical approach: buy the retention your obligations require today, and prefer a vendor where longer retention is an add-on or a tier upgrade rather than a re-platforming. Searchability matters as much as storage — 365 days of logs you cannot query is an archive, not a SIEM.
Detections: packs beat query languages
The classic SIEM failure mode is an empty rules screen. The product ships as a powerful query engine, detection content is your problem, and eighteen months later the only alert configured is the one from the proof-of-concept. For a team without a detection engineer, curated out-of-the-box detections are not a nice-to-have — they are the product.
Evaluate the pack against the attacks that actually hit SMBs: ransomware precursors (shadow-copy deletion, encoded PowerShell, new services), account attacks (brute force, password sprays, lockout storms), and quiet admin drift (new local administrators, disabled endpoint protection, audit logs cleared). Then check two more things: whether related alerts correlate into one incident — ten detections on one workstation should read as one story, not ten emails — and whether you can add your own rules without learning a query language, because every environment has one weird thing worth watching.
The deployment question nobody asks until month three
Ask every vendor: what exactly ships the logs? The honest answers are agents on devices and a syslog path for everything else — and both have hidden costs in most products: another agent to deploy fleet-wide, a collector VM to build and patch, parsing to configure per source. This is where SIEM projects die quietly.
The shortcut is a platform where collection rides software you already run. Cybermatic's device agents — the same ones doing security posture — flip on curated log collection the moment SIEM is active, and the Discovery Agent already sitting on your network doubles as the syslog receiver for firewalls and switches. Deployment becomes a settings change plus one router configuration, which is why it fits in an afternoon rather than a quarter.