At Bitkub, the cryptocurrency exchange in Thailand, the security team had a problem that looked like growth. The company was expanding quickly. Its security processes were still manual. Before it adopted Devo, it had no security information and event management system, or SIEM, to bring the evidence together. The people protecting a digital exchange were spending their time assembling the machinery of protection.
- Devo brings machine data, threat detection and response into one cloud platform.
- Its useful promise: less time collecting clues and repeating investigations.
- Bitkub reported freeing 20% of staff time. Your results need their own test.
That distinction matters. An analyst can be busy without becoming better informed. A queue can get longer while several people quietly investigate pieces of the same event. Devo sells software into this gap between having information and doing something useful with it.
The cost of joining the dots
Consider a hypothetical suspicious login. The identity system records it. A laptop produces another trail. A cloud service supplies a third. Each tool knows something; somebody has to decide whether the fragments belong together. The work includes collecting records, adding context, checking earlier incidents and deciding what deserves attention.
In April 2025, Devo published a Wakefield Research survey of 200 American security operations managers and directors at companies with at least 1,000 employees. Eighty-four percent reported that analysts unknowingly investigated the same incidents several times a month or more. The survey was commissioned by a vendor with something to sell, but its question was well chosen: how much security work is being done twice?
reported duplicate investigations several times a month or more.200 US enterprise SOC managers and directors · Wakefield Research for Devo · 2025
Devo’s answer starts underneath the alert queue. Data Analytics Cloud ingests and analyzes machine data, exposes APIs and supplies visualizations. The Security Data Platform combines that foundation with detection, behavioral analysis, investigation and response. Its expertise lies in moving between enormous quantities of records and the much smaller set of decisions a person can make.
A case is worth a thousand pings
The product names describe different parts of that journey. Intelligent SIEM supplies security monitoring. DeepTrace handles automated alert investigation and threat hunting. ThreatLink correlates and enriches alerts into cases. SOAR, short for security orchestration, automation and response, runs workflows that would otherwise require repeated manual steps.
There is corporate history inside this architecture. Founded in Madrid in 2011 as Logtrust, the company became Devo in 2018. In 2022 it acquired Kognos, which brought automated threat hunting, and LogicHub, which brought response automation. Collecting data, investigating it and acting on it became parts of the same commercial proposition.
That gives Devo a place among enterprise SIEM and security analytics platforms. Its pitch emphasizes broad data ingestion, quickly searchable records and connected investigation workflows. Buyers should make it prove those advantages against their own workloads. An attractive demonstration says little about a difficult query across months of real company data.
Twenty percent is a human number
Bitkub provides a more tangible test than the platform vocabulary. Devo’s customer study says the exchange freed 20% of staff time, halved time spent implementing manual use cases and saw a return on investment in under two months. Those are customer results published by Devo, rather than an independent trial or a promise to every buyer.
The revealing detail is the work that disappeared. Prebuilt use cases and alert management reduced the effort required to assemble each new monitoring scenario. Bitkub could spend more time on threat hunting and investigation. Its initial bottleneck was manual process; adding software helped because it addressed that particular constraint.
“We have greater confidence in our data insights.”Joe Wilson · IT Threat Intelligence Manager, Ulta Beauty
Devo’s customers extend beyond exchanges. Its public material names Ulta Beauty, AT&T, Sonos and OneMain Financial. These organizations differ, but each has systems producing evidence faster than people can read it. Devo also targets managed security providers, whose analysts must serve several customer environments without mixing up their data.
The bill follows the data
This is enterprise subscription software. Devo describes licensing based on ingest and asks buyers to request pricing. Data Analytics Cloud can stand alone or sit underneath Intelligent SIEM. The Starter package includes two behavioral models and two automation playbooks; the fuller package removes those limits. Both list unlimited users, detections and ThreatLink case management.
The investment bill is easier to quantify. Devo announced a $250 million Series E in October 2021 and a $100 million Series F in June 2022. The latter valued the company at $2 billion at that time. For a buyer, the useful calculation includes the subscription, migration effort and the staff time needed to maintain detections.
Make the software earn its quiet
In April 2025, Devo announced a Detecteam partnership to test and improve detections using attack scenarios. That is a useful extension of its argument. Reducing manual work helps; verifying that a detection catches the behavior it was built to catch helps establish whether the quieter queue deserves trust.
The lesson readers can borrow is practical. Follow one investigation from first signal to final decision. Count the evidence requests, repeated searches and handoffs. Then test automation against that baseline. Check data access, retention costs and response permissions. If essential records are missing, or nobody can maintain the rules, connecting the tools will not supply the missing judgment. Devo’s proposition becomes interesting when the team can show exactly which work it gets back.