The first thing to fail in a modern security operation is often not a firewall. It is attention. One employee signs in from an unusual place. Another downloads a file at an odd hour. A service account touches a system it has never visited. Each event may be harmless. Put them in order, however, and the same crumbs can form the outline of a stolen identity moving through a company.
Exabeam was founded in 2013 to assemble that outline automatically. Nir Polak and Sylvain Gil came from Imperva; Domingo Mihovilovic came from Sumo Logic. Their premise was pleasantly unfashionable for a security vendor: enterprises already owned piles of defensive tools and generated oceans of logs. The missing product was not another fence. It was a way to understand the person - or account - walking around behind it.
The name was a nerdy volume joke. Giga and tera sounded too small for all that data, so the founders jumped to an exabyte and added “beam.” The business was more serious. Exabeam learned a baseline for users and entities, attached risk to departures from that baseline, and produced chronological timelines. A login from Singapore was not automatically bad; a new location followed by privilege escalation and bulk downloads might be.
The product is the plot
Traditional SIEM software collects security events, runs searches and fires correlation rules. That remains useful. The trouble begins when each rule generates an isolated clue and a human must manually rebuild the case. Exabeam’s differentiator is sequence-aware behavior intelligence: it groups activity around identities and assets, scores the risk and gives the analyst a narrative starting point.
This is why the company’s customer stories keep returning to the same complaint. MUFG Union Bank had a data-loss prevention system that worked, but too many false positives consumed investigators. It used Exabeam to baseline activity and elevate the incidents that looked genuinely unusual across more than 100,000 staff. NTT DATA inherited multiple systems through acquisitions and wanted a global view. It rolled out more than 50 use cases while retiring legacy SIEMs. Dayforce piloted several vendors and says Exabeam’s UEBA was the feature that changed its mind: investigations that took days could be completed in minutes.
“One of the stand-out features when we were piloting Exabeam was the UEBA functionality.”Dayforce customer account
There is a practical lesson hiding inside the acronym soup. Buyers did not switch because a dashboard was prettier. The old workflow failed at triage and reconstruction. The pilot won when it surfaced meaningful threats from a large stream and let an analyst explain the path quickly. That is a test another team can copy: choose a known messy incident, feed competing systems the same identity and telemetry, then time how long it takes a less-experienced analyst to reach a defensible conclusion.
Six rounds, then a two-track company
Investors funded the thesis in neat increments: $10 million in 2014, $25 million in 2015, $30 million in 2017, $50 million in 2018, $75 million in 2019 and $200 million in 2021. The last round, led by Owl Rock with existing investors participating, valued Exabeam at $2.4 billion and brought disclosed funding to $390 million. It was peak confidence in cloud security software, but also a bill coming due: scale the platform, expand internationally and keep pace in a market crowded by Splunk, Microsoft, Google, Palo Alto Networks, CrowdStrike, Securonix and Elastic.
The strategic answer arrived in July 2024, when Exabeam completed its merger with LogRhythm, the older SIEM vendor backed by Thoma Bravo. Financial terms were not disclosed. The combined company kept the Exabeam name, a useful signal about which brand represented the future, but it did not simply erase the installed base. Today New-Scale is the cloud-native line; LogRhythm SIEM remains the on-premises option.
That split acknowledges how enterprise security is actually bought. A cloud-first retailer may want managed scale and rapid releases. A government agency, manufacturer or bank may be constrained by data residency, legacy integrations or a mandate to run software in its own environment. The merged portfolio lets Exabeam argue for behavior analytics without making cloud migration a prerequisite.
What it costs - and what that number hides
Exabeam does not post a current universal sticker price. New-Scale has historically been sold by product and gigabytes ingested per day, with retention, support and services changing the quote. LogRhythm adds its own component, appliance and log-source licensing. An older public reseller list is useful as a pricing fossil, not as a 2026 proposal: the real bill depends on how much telemetry enters, how long it stays and who operates the system.
A Forrester study commissioned by Exabeam modeled a composite Fusion SIEM customer spending $1.08 million over three years, including $75,000 in initial implementation fees and nearly $147,000 in training and ongoing internal effort. It calculated $3.73 million in benefits and a 245 percent return. Those are modeled results from a sponsored study, not a promise. The more useful insight is what the model counts: software is only part of the cost. Data plumbing, tuning, training, retention and analyst time decide whether the economics work.
Now the insider may be software
In 2025, Exabeam added Nova, a set of AI agents embedded in New-Scale. One summarizes investigations and recommends next steps. Another translates natural-language questions into searches. A visualization agent turns a prompt into a chart; an advisor reports on security posture and coverage. The pitch is not that a chatbot replaces the SOC. It is that the machine takes the first pass through the evidence and leaves the judgment to an analyst.
In 2026, the company extended its older behavioral idea to a newer identity: the AI agent. Digital workers can hold credentials, call tools, reach data and drift beyond their assigned role. Exabeam’s Agent Behavior Analytics watches those actions much as UEBA watches employees and service accounts. July updates added Claude observability, more than 50 agent-oriented detections and models, and coverage views tied to the OWASP Agentic Top 10. A deeper Google Security Operations partnership followed in August.
It is a tidy product narrative - the user is no longer necessarily human - but it will be judged by telemetry. An AI agent’s intention is hard to infer from a log line. Useful detection requires identity context, tool-call records, permissions, data access and enough history to distinguish productive novelty from dangerous drift. Without those ingredients, “agent behavior” risks becoming another alert category in the queue Exabeam originally set out to shrink.
When the beam misses
Behavioral analytics is not magic sprinkled over bad logs. It works best in a large, instrumented environment where identities are consistent, telemetry arrives on time and the organization knows which use cases matter. It is a weaker fit when accounts are shared, assets are poorly inventoried or frequent reorganizations keep resetting “normal.” A small company that mainly needs endpoint protection may get more value from a managed detection service. A team with petabytes of low-value logs may discover that ingest economics punish indiscriminate collection.
Automation also creates a governance chore. Risk scores should accelerate a decision, not become the decision. Analysts need to see why a score changed, test false positives and retain authority over containment. The company’s best idea is the timeline precisely because it makes machine judgment inspectable. Lose that explanatory layer and the product becomes the kind of opaque alarm it was built to improve.
The transferable playbook is refreshingly small. Start with five painful behaviors, not 500 hypothetical rules. Connect identity, endpoint, cloud and network data. Establish a baseline. Run a red-team scenario or replay a known incident. Measure investigation time and the quality of the conclusion. Expand only when the sequence gives analysts more truth than the individual alerts did. Exabeam sells the machinery, but the discipline belongs to the buyer.