Decision File · Sample / Demonstration
Deciding on a SIEM replacement.
30-second brief
- Who
- A CISO at a payments company
- The decision
- Deciding on a SIEM replacement.
- What was at stake
- Budget constraints made defending a 28% increase to the CFO untenable.
- What they chose
- Dana chose NightOwl mainly for its 3am support despite lacking features.
- What happened
- Migration cost $110k and took six months instead of two due to unforeseen complications.
- Core lesson
- Ensure all critical factors are properly weighted to avoid them becoming de facto decision points later.
01 What we said vs. what happened
They weighted support at 10%, but the 3am named engineer decided the winner; higher‑weighted items either passed for everyone or just knocked one vendor out.
| What we said we'd judge on | Weight | What actually happened | |
|---|---|---|---|
| Threat detection coverage | 30% | All four could detect everything we cared about — it didn't separate anyone. | |
| Integrations with our existing stack | 20% | Sentrix had 9 of 12; the card switch was “on the roadmap.” The others had all 12 day one. | |
| Query performance at our volume | 15% | Corvid slowed badly on 90‑day lookback searches; the others handled our volume fine. | |
| Price | 25% | Price knocked out exactly one vendor — the incumbent. The other three landed within about $30k of each other over three years. | |
| Support | 10% | We bought the 3am phone call — a named engineer in contract. That decided it. | |
| Will the analysts actually use it daily | not on the list | Our SOC stopped opening Sentrix two weeks into the trial — the UI didn't fit queue‑clearing work. |
Source: Dana Whitfield (CISO) and team — interview transcript (their scorecard was described in detail).
Read what Dana said (7 quotes)
“We did it properly, or so we thought. April, we wrote a scorecard before we talked to a single vendor.”
“All four could detect everything we cared about.”
“We needed twelve connections… LogHarbor, Corvid and NightOwl had all twelve… Sentrix had nine of twelve. The card switch connector was ‘on the roadmap.’”
“Corvid slowed badly on 90-day lookback searches… LogHarbor, Sentrix, NightOwl all handled our volume without complaint.”
“Price knocked out exactly one vendor — LogHarbor. The other three landed within about 30 thousand of each other on a three-year view.”
“The honest truth is we bought the 3am phone call.”
“Sentrix, the analyst darling, our SOC guys just stopped opening it two weeks into the trial.”
02 Feature comparison
Only NightOwl offered a named 3am engineer at the budgeted tier; that single line decided it.
| Can it do this? | LogHarbor (incumbent) | Sentrix | Corvid | NightOwl |
|---|---|---|---|---|
| A named engineer we can call at 3am | ||||
| Has all 12 integrations we need (incl. card switch) | ||||
| 90‑day lookback query performance during incidents |
Source: Dana Whitfield (CISO) and team — interview transcript.
Read what Dana said (3 quotes)
“When this breaks at 3am during an incident, who picks up the phone?”
“LogHarbor, Corvid and NightOwl had all twelve, day one. Sentrix had nine of twelve.”
“Corvid slowed badly on 90-day lookback searches.”
03 Decision timeline
Nine months of trials and comparisons ended with one question — “who picks up at 3am?” — and then migration ran four months long.
MARCH · what started it
Renewal quote jumps 28%
Pricing model changed; at our volume it was untenable, so we went to market.
MAY–DECEMBER 9 months
Head‑to‑head evaluation and trials
Two full head‑to‑head trials; ~60 hours of team time.
MID‑EVALUATION 6 weeks
Seriously considered building it
Modeled an open‑source stack but killed it due to staffing reality.
JANUARY · the tipping point one meeting
The 3am question decides it
One meeting — only NightOwl had a named 3am engineer at our tier.
POST‑DECISION 6 months (4 months late)
Migration ran long
Took six months instead of two; four months late.
MAY · how it ended
Go‑live on NightOwl
Live in May instead of January.
Source: Dana Whitfield (CISO) and team — interview transcript.
Read what Dana said (5 quotes)
“The renewal quote… was 28 percent higher than the year before.”
“Nine months. Two full head-to-head trials…”
“We did, seriously, for about six weeks in the middle of the evaluation.”
“When this breaks at 3am during an incident, who picks up the phone?”
“It cost about 110, and it took six months — we went live in May instead of January.”
04 Who dropped out, and why
The incumbent fell on price; Sentrix fell on real‑world use; Corvid fell on support at budget; NightOwl won for the 3am named engineer.
| LogHarbor (incumbent) | Too expensive | 28% renewal hike and pricing model change made it untenable; price knocked out exactly one vendor — the incumbent. | |
| Sentrix | Nobody used it | Analysts stopped opening it two weeks into the trial; UI fit threat hunting, not queue clearing. Also missing the card switch connector and no named 3am engineer. |
|
| Corvid | Above budget for support | A named 3am engineer required Enterprise Plus (+$95k/yr); also slowed on 90‑day lookbacks. | |
| NightOwl | Chosen | Included a named on‑call engineer at our tier — we bought the 3am phone call. |
Source: Dana Whitfield (CISO) and team — interview transcript.
Read what Dana said (4 quotes)
“Price knocked out exactly one vendor — LogHarbor.”
“Our SOC guys just stopped opening it two weeks into the trial.”
“Corvid — yes, but only on the Enterprise Plus tier, which was 95 thousand a year above what we'd budgeted.”
“The honest truth is we bought the 3am phone call.”
05 What the money actually buys
Versus the cheapest finalist, they paid about $75k more over three years — ~$40k effectively for the 3am phone call and ~$35k from a migration overrun.
| What we're paying to solve | Sentrix | Corvid | NightOwl (chosen) |
|---|---|---|---|
| A named engineer we can call at 3am This line decided it. |
not offered | +$95,000/yr | included |
| Migration overrun Ran 4 months long |
n/a | n/a | +$35,000 (over plan) |
| Three-year total | $735,000 | $765,000 | $810,000 |
Source: Dana Whitfield (CISO) and team — interview transcript.
Read what Dana said (3 quotes)
“Versus the cheapest finalist we paid about 75 thousand more over three years. 40 of that was the 3am phone call… The other 35 was the migration overrun…”
“Sentrix came to roughly 735 total over three years, Corvid 765, NightOwl 810.”
“Corvid — yes, but only on the Enterprise Plus tier, which was 95 thousand a year above what we'd budgeted. NightOwl — yes, included.”
06 What we skipped
Skipping reference calls is what bit them — a few calls would have surfaced the 4‑month migration overrun risk.
| Formal RFP | Skipped | Cost nothing — we went straight to vendors on procurement's approved list. | |
| Second trial round across all business units | Cut to 2 weeks in one unit | No specific damage called out; renewal deadline was breathing on us. | |
| Security review | Kept in full | Avoided issues there — nobody was willing to shorten it, and I'm glad. | |
| Reference calls | Skipped | Three phone calls would have saved a four‑month migration overrun surprise. |
Source: Dana Whitfield (CISO) and team — interview transcript.
Read what Dana said (2 quotes)
“Our normal process has a formal RFP — we skipped it… The one that actually cost us: reference calls.”
“It cost about 110, and it took six months — we went live in May instead of January.”
How they decided
Ran a nine-month evaluation including trials and created a scorecard.
ConsultedSOC leads · Security team
SkippedSkipped reference calls and a full RFP process.
What they'd do differently
Score migration effort as a criterion and conduct reference calls before deciding.
Unknowns — what one case can't tell you
This case does not indicate whether NightOwl will continue to meet needs long-term.
“Ensure all critical factors are properly weighted to avoid them becoming de facto decision points later.”
— Dana Whitfield, CISO (illustrative subject)Methodology Underlined claims in the interactive version open the interview moment behind them — a video receipt, timestamped to the words above. Try it in the interactive report ↗
Sample disclosure This page is generated by UpSight to demonstrate what a Decision File looks like end-to-end — brief, six diagrams, evidence, narrative — built from a seed interview transcript. "Dana Whitfield," the payments company, and the SIEM vendors named (LogHarbor, Sentrix, Corvid, NightOwl) are illustrative, not a real person or real companies. It is not one of the three real files that open the published series. Real Decision Files use named or anonymized real subjects, quotes approved by the subject before publication, and a real outcome — see the methodology note for the policy that governs the actual series, and the founder credential behind it.
Processed Interview analyzed 17 August 2026 · Share token bf3VlTLtHBKp