File 014Security

Security Logging Replacement: When Selection Criteria Fail to Differentiate

Interview analyzed 17 Aug 2026

The decision: Replace the company’s security logging (SIEM) platform.
At stake: A 28% renewal increase that couldn’t be justified to the CFO.
They chose: NightOwl, mainly for its 3am support, despite fewer features.
What happened: Migration cost $110k and took six months instead of two.
Core lesson: Weight every critical factor up front, or one will quietly decide for you.

Get the next file free.

New decision files, about twice a month.

Every claim links to the moment it was said.

Key findings, in brief

Decision timeline: Nine months of trials and comparisons ended with one question — “who picks up at 3am?” — and then migration ran four months long.
Stakeholder map: The CFO set the constraint, the SOC decided more than the scorecard did, and nobody blocked — the decisive vote came from analysts who simply stopped opening a product.
What we said vs. what happened: They weighted support at 10%, but the 3am named engineer decided the winner; higher-weighted items either passed for everyone or just knocked one vendor out.
Feature comparison: Only NightOwl offered a named 3am engineer at the budgeted tier; that single line decided it.
Who dropped out, and why: The incumbent fell on price; Sentrix fell on real-world use; Corvid fell on support at budget; NightOwl won for the 3am named engineer.
What the money actually buys: Versus the cheapest finalist, they paid about $75k more over three years — ~$40k effectively for the 3am phone call and ~$35k from a migration overrun.
What we skipped: Skipping reference calls is what bit them — a few calls would have surfaced the 4-month migration overrun risk.
The CFO view — what the premium buys back: The 3am line cost ~$25k a year. The only other vendor offering it priced the same line at $95k a year — against the real alternative, NightOwl's premium pays back in under a year.

“The honest truth is we bought the 3am phone call.”

Dana Whitfield, CISO

How they decided: A nine-month evaluation with two trials and a weighted scorecard. Skipped reference calls and a formal RFP.
Do differently: Score migration effort as a criterion, and make reference calls before deciding.
Unknowns: Whether NightOwl keeps meeting their needs long-term.