--- title: Why CISOs Are Building Open Security Lakes with Iceberg description: Legacy SIEM architectures are hitting cost and scalability limits as AI-driven threats generate unprecedented data volumes. CISOs are responding by building... canonical: https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why CISOs Are Building Open Security Lakes with Iceberg | daily.dev og:description: Legacy SIEM architectures are hitting cost and scalability limits as AI-driven threats generate unprecedented data volumes. CISOs are responding by building... og:url: https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou og:image: https://api.daily.dev/og/posts/KaWNUZoOU.png og:image:alt: Why CISOs Are Building Open Security Lakes with Iceberg og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why CISOs Are Building Open Security Lakes with Iceberg **[Confluent Blog](https://daily.dev/sources/conf)** · 6 min read · 0 upvotes · 0 comments ## Summary Legacy SIEM architectures are hitting cost and scalability limits as AI-driven threats generate unprecedented data volumes. CISOs are responding by building Open Security Lakes using Apache Iceberg as an open table format, decoupling data storage from vendor-proprietary analytics. This approach lets organizations own their data, bring any compute engine to it, and avoid lock-in. A data streaming platform acts as the central nervous system, routing high-volume logs, applying real-time threat detection via open standard rules, and reducing downstream SIEM costs by 30–50%. SIEM doesn't disappear but becomes focused on high-value analysis, while the security lake handles forensic data at scale. Confluent's Tableflow and Freight clusters are positioned as key enablers of this architecture. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics](https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat) · Security Boulevard · 0 upvotes · 0 comments - [Databricks pitches Lakewatch as a cheaper SIEM — but is it really?](https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc) · InfoWorld · 1 upvotes · 0 comments - [Why Batch ELT Breaks at Enterprise Scale](https://daily.dev/posts/why-batch-elt-breaks-at-enterprise-scale-2uoypymjg) · Confluent Blog · 0 upvotes · 0 comments - [Iceberg Needs an Open Catalog, Not a Walled Garden](https://daily.dev/posts/iceberg-needs-an-open-catalog-not-a-walled-garden-znv0xeptl) · SingleStore · 0 upvotes · 0 comments - [Managed Iceberg Lakehouse: A Practical Guide](https://daily.dev/posts/managed-iceberg-lakehouse-a-practical-guide-qdlvpntka) · ITNEXT · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#confluent-cloud](https://daily.dev/tags/confluent-cloud), [#data-streaming](https://daily.dev/tags/data-streaming), [#apache-iceberg](https://daily.dev/tags/apache-iceberg) [View this post on daily.dev](https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why CISOs Are Building Open Security Lakes with Iceberg","url":"https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou"},"datePublished":"2026-03-16T14:05:11.230Z","dateModified":"2026-03-16T14:05:39.634Z","description":"Legacy SIEM architectures are hitting cost and scalability limits as AI-driven threats generate unprecedented data volumes. CISOs are responding by building...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c4d9264004528c63e11c7cc99e30cb2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c4d9264004528c63e11c7cc99e30cb2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Confluent Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Confluent Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cb2c20a237b7409591c7a087c42fb714","url":"https://daily.dev/sources/conf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,confluent-cloud,data-streaming,apache-iceberg","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Confluent Blog","item":"https://daily.dev/sources/conf"},{"@type":"ListItem","position":3,"name":"Why CISOs Are Building Open Security Lakes with Iceberg"}]} ```