At Vensure Employer Solutions, the firewall was doing its job. It recorded connections, permitted traffic and system messages. The security team collected them. The bill grew. Nothing in that sequence looks especially foolish; each step is defensible. Together, they produced an expensive collection of ordinary events.
Vensure handles benefits and payroll, protecting millions of people’s financial and personal information. Collecting more evidence sounds like sensible insurance. But a security information and event management system, or SIEM, charges for processing data whether that data reveals an attack or merely confirms another uneventful connection. Prudence has a meter running.
- Realm sits between security data sources and the tools that consume them.
- Vensure reported 83% less firewall telemetry reaching its SIEM.
- New detection checks aim to protect the fields that existing alerts need.
- Filtered data can stay searchable outside the SIEM.
The invoice was the first alarm
Realm Security’s published Vensure case study describes the intervention precisely: FortiGate firewall logs going to Sumo Logic. The pipeline filtered routine connection events, permitted traffic logs and redundant messages while preserving signals such as denied connections, unusual port activity and policy violations. The team used a no-code interface to put filtering rules into production.
The reported result was an 83% reduction in daily firewall log volume and $254,901 in annual savings. That figure concerns this particular data stream. It does not mean Vensure’s entire cybersecurity budget fell by 83%. The distinction matters: an excellent haircut should not be mistaken for a new head.
What strained first was the economics of sending expanding telemetry into a constrained SIEM budget. Vensure’s case identifies low-value volume as the problem, rather than a broken firewall. The decision to filter followed a concrete observation: every byte was being charged for, while many events contributed little to detection or investigation.
“This is a game-changer for budget-constrained security teams.”Dwayne Smith, Vensure Global CISO
A business built in the space between
Founded in 2024, Realm operates in an unglamorous but consequential location: between the systems generating telemetry and the systems analyzing it. Peter Martin is CEO, Jeff Kraemer CTO and Sanket Choksey VP of Engineering. Their product collects, reduces, enriches, masks, normalizes and routes security data. The customer keeps the downstream tools.
That makes Realm complementary to a SIEM rather than a replacement for one. A source can feed a lean stream into a detection system and a fuller stream into a data lake. Changing the destination need not require rebuilding every upstream connection. Vendor independence is part of the commercial pitch: the plumbing should serve the security team’s choices.
The buyers are security operations teams, CISOs and enterprises trying to reconcile visibility with cost and staffing. Vensure is a named example; Main Line Health is another. Realm also describes an unnamed global manufacturer with 40,000 employees. Its June 2026 announcement reported more than doubling customers in the first quarter against the previous quarter, without giving an absolute count.
The dangerous little word: irrelevant
Filtering is easy to admire until someone asks what disappeared. A routine-looking field may be essential to a detection rule. Reducing traffic by looking only at volume can reward precisely the wrong behavior. A pipeline needs to understand the destination’s requirements as well as the source’s contents.
Realm’s July 2026 Detection Integrity announcement makes that relationship explicit. Its Clarity AI layer maps detection rules to the sources and fields they depend on, supporting formats including Sigma, KQL and SPL. Proposed reductions produce reports covering protected data, projected savings and MITRE ATT&CK coverage. When a reduction cannot be applied safely, the platform flags it instead of cutting.
- 01Profile sources
- 02Explain a change
- 03Team approves
- 04Shape the data
- 05Check detections
The present product documentation gives the human team an important role: recommendations show their reasoning, and rules run in a pending state before activation. Realm manages the infrastructure; the SOC approves the decisions. That is a more useful description than imagining an AI quietly deciding what evidence a company deserves to keep.
These checks address existing detection dependencies. They should not be read as a promise that every future attack will be recognized. The practical question remains local and testable: do this organization’s detections still receive what they need after this particular change?
Less in the SIEM, more within reach
Data Haven tackles the other objection to filtering: tomorrow’s investigation may need yesterday’s uneventful event. Realm describes an immutable raw copy with Open Cybersecurity Schema Framework observables attached. Its new search capability lets analysts query that history directly and resupply selected events to another destination. Exclusion from the SIEM need not mean deletion from the record.
Privacy Guard handles a different kind of selectivity. It discovers sensitive personal, health and payment information and masks it in transit under approved, destination-specific rules. Main Line Health appears in Realm’s published privacy example. For a hospital, deciding which fields a service provider receives is a governance problem as much as a storage problem.
The price of becoming the editor
Realm sells managed enterprise software priced by daily ingested volume; Data Haven is priced separately on ingest, with no charge for search or resupply. A buyer should weigh those costs alongside SIEM savings. Log reduction produces less immediate financial benefit if a contract’s fixed commitments prevent the bill from falling.
Competition includes Cribl Stream and DataBahn. Cribl also advertises AI-assisted transformations, masking, routing and replay, so AI alone is a weak dividing line. Realm’s distinctive pitch combines a managed security workflow, explicit detection dependency checks and searchable retention. Buyers can compare those capabilities on their own data rather than settle the argument through adjectives.
The investors have supplied room to try: $5 million in seed funding in September 2024, $15 million in October 2025 and $2 million from Presidio Ventures that December. The last investment was intended to help open Asia-Pacific channels through Sumitomo’s network. Announced funding totals $22 million.
The useful habit to copy is narrower than the ambition: pick one noisy source, map the detections that depend on it, stage a change and measure the result. Realm offers a seven-day assessment built around that exercise. Vensure’s lesson begins with an ordinary firewall event and ends with a question any security team can ask: why are we paying this particular system to receive it?