Imply Lumi gives SIEMs and AI agents wider data access

Imply has launched Imply Lumi, a data platform the company describes as the foundation for an "agentic SIEM." The aim is to help security teams deal with growing data volumes, rising costs and the new demands of AI-driven investigations, without asking them to give up the SIEM tools and workflows they already rely on.

SIEM stands for security information and event management. It is the category of products that collect and analyze log data so analysts can detect and investigate threats.

Why the classic SIEM model is under strain

According to Imply, SIEMs were designed for a different era. Back then, one platform could ingest, index, store and query every log in the same system. As data volumes grow, that model becomes increasingly expensive to scale. Security teams are left making hard choices about which data to keep and for how long.

AI adds to the pressure. An agent working an alert does not stop at the first answer. It follows each finding with new questions and often reaches into other data sources. It also tends to look further back in time than a detection rule would. That means the architecture underneath has to keep more data within reach and absorb search demand that is much harder to predict.

"The SIEM isn't going away, but the architecture underneath it has to change," said Eric Tschetter, chief architect at Imply. "The opportunity isn't simply to make SIEM cheaper, but to enable organizations to retain and access significantly more security data while preserving the tools and workflows analysts already rely on."

Imply points to how data platforms solved similar problems. They split low-cost object storage from compute, which let organizations keep far more data and scale computing resources to match demand. For security teams, the company argues, the point is not only to put more data into a security data lake. The data also has to be quickly accessible and useful to existing SIEMs and modern AI agents, wherever it is stored.

A shared data layer under existing tools

Lumi works as a shared data layer that sits beneath existing SIEM tools and AI agents. Organizations can widen access to their security data while continuing to use the tools and workflows they have today.

Security teams and AI agents get immediate access to data wherever it lives. There is no need to move everything into the SIEM first. Analysts can search both indexed data and unstructured logs held in object storage, using familiar query languages such as SPL and SQL. According to Imply, this puts more of an organization's security history in reach during investigations without changing how teams work.

Lumi separates storage, compute and access. This lets organizations keep more security history in cost-efficient object storage and scale search resources based on demand. Teams keep the tools they know, while more of their data becomes available for investigations and AI-driven analysis.

BTG Pactual is one of the organizations using the platform. "With Imply Lumi, we can ingest more data, retain it longer, pull in telemetry from platforms beyond Splunk, and still understand what our costs will look like as we scale," said Rafael Hass, security information manager at BTG Pactual.

Our Take

Imply's pitch reflects a wider shift. Security vendors are no longer only adding AI to the front end of the SOC. They are rethinking the data plumbing behind it. Recent launches such as Exabeam's agentic SOC and Stellar Cyber 7.0 show the same push toward AI-led investigations. Imply's argument is that those agents are only as good as the data they can reach.

For defenders, the promise of longer retention without SIEM cost spikes is attractive, especially for incidents that surface months after the initial intrusion. Giving AI agents broader reach into security history also raises access control questions, a concern underlined by research showing that AI agents can keep data access after their tasks end. It is worth watching whether customers see predictable costs once agent-driven search scales, and how platforms like Lumi govern what agents are allowed to query.