VEGA

Security got expensive by the gigabyte

The traditional SIEM: a very tidy room you pay rent on, where half the furniture is in boxes you never open.

For two decades the security playbook had one rule - collect everything, move it to one place, then search. The tool that did this was the SIEM, and it worked, in the way a toll booth works: every log paid to enter, and the bill grew with the data. Enterprises now generate logs faster than they can afford to ingest them, so teams quietly make a grim trade. They keep the "important" data hot and searchable, and they banish the rest to cold storage, where it waits, unread, for an incident that hopefully never comes.

The irony writes itself. The data most useful during a breach - the old, the obscure, the archived - is exactly the data nobody can reach when the breach happens. Security teams ended up paying premium prices to store information they had effectively agreed not to look at.

That is the tension Vega exists to resolve: visibility should not be a budget line you ration. If half your data is too expensive to search, you don't have a security program - you have a hope.

Don't move the data. Move the detection.

Two veterans of an intelligence unit decided the cheapest place to search your data is the place it's already sitting.

Shay Sandler and Eli Rozen met in Unit 8200, Israel's signals-intelligence corps - the kind of place where you learn that the hard part of finding a needle is rarely the needle, it's the cost of carrying the haystack around. They went on to help build Granulate, a performance-optimization startup acquired by Intel in 2022 for around $650 million. Sandler became CEO; Rozen became CTO. They had built a company that made other people's infrastructure cheaper to run. The next idea was to do the same for security.

Their bet inverts the entire SIEM model. Instead of dragging petabytes of logs into a central warehouse, Vega leaves the data where it is - in cloud platforms, data lakes, SaaS tools, and existing storage - and sends the analytics out to meet it. They call the architecture a Security Analytics Mesh: a federated layer that queries everything at once, without asking you to move, copy, or re-pay for a single byte.

It is a deceptively simple reframing. The expensive part of security was never the searching. It was the moving. Remove the move, and the economics flip.

What the mesh actually does

Ask a question in English. Vega translates it to KQL, runs it everywhere, and reads the raw logs so you don't have to.

Strip away the funding headlines and Vega is, at heart, a search engine with opinions. It lets a security team query every repository simultaneously - in natural language or KQL - and returns answers fast enough to be useful mid-incident. Under the hood sit the unglamorous workhorses of scalable search: Bloom and cuckoo filters, HyperLogLog++ for approximate counting, finite state transducers, inverted indexes. The kind of engineering that wins no marketing awards and quietly makes everything possible.

Milestones

A timeline that fits on an index card and still embarrasses companies twice its age.

The money and the customers agree

Three rounds, two years, one chart. The investors did the math you're about to look at.

Skeptics are right to ask whether a clever architecture and a clever pitch are the same thing. Vega's answer is its customer list and its cap table - two audiences that are notoriously hard to charm. Accel led the Series B; Cyberstarts, Redpoint, and CRV came along. On the buyer side, the company reports multimillion-dollar contracts with global banks, one of the world's largest healthcare organizations, and Fortune 200 enterprises, with cloud-heavy firms among its named users.

Make all of it searchable, now

A mission statement short enough to remember and specific enough to argue with - rarer than it sounds.

Vega's stated mission is to help organizations access and analyze all their security data wherever it resides, without migrations or legacy SIEM constraints. The company organizes itself around four principles: visibility first, cost efficiency, a unified experience across fragmented sources, and AI woven through every stage of the detection lifecycle.

What makes the mission credible is that it is also the product. There is no gap here between what Vega says it believes and what the software does. The belief - that no dataset should be too expensive to search - is the feature. Remove the data-access barrier and, the company argues, genuinely preemptive threat hunting stops being a slide and becomes a Tuesday.

The long game

Comparisons to Wiz are flattering and premature. Vega seems comfortable with both.

Security spending is moving in exactly one direction, and so is the volume of data attackers hide inside. If the next decade of breaches will be won or lost on whether defenders can actually see their own data, then the company that makes all of it searchable - cheaply, instantly, in plain language - is holding a useful hand. The press has already started drawing lines to Wiz, the Israeli cloud-security juggernaut. Flattering, certainly. Premature, probably. But the comparison points at the right ambition.

Now return to that 2 a.m. SOC. The alert still fires. The cold archive still exists. But the long night is gone, replaced by a question and an answer. The analyst checks the last 90 days across every store at once, confirms the threat never spread, and closes the ticket. The data that used to sit in a box, paid for and unread, just earned its keep.

That is the whole bet: the most dangerous log is the one you couldn't afford to look at. Vega's job is to make sure that log no longer exists.