◆
Retention long enough
Signal kept for long enough that an investigation reaches the activity that matters.
Security investigations fail on retention more than on tooling. The relevant activity is almost always outside the window somebody chose when storage was the binding constraint.
Used for detection, investigation, access governance and incident response.
What this looks like in practice
Signal kept for long enough that an investigation reaches the activity that matters.
Who could reach what, and who did, as a query rather than a week of correlation.
Blast radius limited by how things are arranged rather than by how carefully they were configured.
Looking for something across months of data without first restoring it from somewhere.
Most dwell time is longer than most retention windows. That single mismatch explains a large share of investigations that end inconclusively.
An intrusion is detected and the question becomes when it started. If retention is thirty days and dwell time was ninety, the honest answer is that nobody will ever know. Retention is not a storage decision; it is a decision about which investigations you are able to conclude.
Certification from the real access record rather than from a spreadsheet of intentions.
Isolation that limits what an incident can reach, by construction.
Incident handling informed by a complete record rather than by partial logs.
Searching months of activity without a restoration project first.
The first real investigation we ran here went back four months. Our previous window was two weeks and we had never known what we were missing.
Long enough to exceed typical dwell times, which is the threshold that matters. Retention chosen on storage cost is why investigations end at a window boundary.
As a query. In most organisations this takes a week, which is why it tends to be asked only after an incident.
Structurally rather than by configuration diligence. Configuration-based isolation fails quietly and is discovered during an incident.
No. It is the substrate they work on — retention, access records and isolation. We would rather your detection stack stayed yours.
Start on something that will still be right at a hundred times your size, and pay now what a startup should pay.
Move in stages with the old arrangement still running, and cut over only once the replacement has carried real traffic.
Get capacity when the experiment is ready, keep what produced a result, and put models in front of users without a separate platform.
Keep everything at full fidelity, query it without a project, and stop deciding today what you will want to ask next year.
Ship the application your users touch, on an address that stays put, with every version one click behind you.
Build the tools your own teams need, at a cost that makes small improvements worth doing.
Begin with one workload. Keep what you have running. Decide whether to continue once you have seen it carry something real.
No migration required to begin. Nothing to tear down if you stop.