Exabeam

• SecurityWeek named Cisco-owned Splunk, Microsoft Sentinel, IBM and Securonix among the companies Exabeam and LogRhythm competed with at the merger, so a buyer who consolidates security spending onto one of those suppliers can put a separate analytics vendor up for review at renewal.
• The customer references in the reviewed record sit on pages Exabeam or its owner publishes, so a buyer who wants references outside that material has to ask for them in diligence.
• The Leader placement in the Gartner Magic Quadrant that Exabeam leads with is read off its own pages and the economic study it cites is one it commissioned from Forrester Consulting, so the strongest value evidence a buyer meets first is vendor-controlled.
• No revenue or margin figure appears in the reviewed record and the merger terms were not disclosed, so a buyer weighing a multi-year commitment cannot judge financial standing without asking for figures under diligence.
• Exabeam maintains a cloud platform and a separate self-hosted product with more than 20 years of history behind it, and its own FAQ sends a buyer who wants a cloud-native option to the other platform, so a self-hosted customer depends on continued investment in a line the company frames as the non-cloud choice.
• The chief executive changed in October 2025, about fifteen months after the merger closed, so the leadership a customer met when the two companies combined has already changed once.

Exabeam addresses the security team that has to find credential misuse and insider activity in log data, and it now counts machine identities and AI agents among the insiders to watch. Its pages describe behavior modeling for both employees and machine identities, and the newer material extends the argument to AI agents that act inside enterprise systems at machine speed.

The category is established rather than emerging. KuppingerCole has recognized Exabeam since 2020 and lists research on intelligent SIEM platforms, on security orchestration and, in April 2026, on the emerging AI security operations center, so an outside research firm keeps active coverage of the category Exabeam sells into.

The quantification of the pain is the weaker part of the record. The urgency figures Exabeam cites appear on its own pages and in a study it commissioned from IDC, and the reviewed independent sources report Exabeam's product releases rather than measuring the problem. [s1, s9, s27, s13, s25]

Two platforms carry the portfolio. New-Scale Fusion is the cloud-native platform that combines New-Scale SIEM for search, correlation and case management with New-Scale Analytics for machine-learned behavior baselining, and LogRhythm SIEM is the self-hosted product a customer runs in its own data center or private cloud.

The mechanisms are documented rather than asserted. LogRhythm SIEM's data fabric normalizes and enriches logs as they arrive and ships more than 1,100 prebuilt correlation rules mapped to MITRE ATT&CK and to compliance mandates, while LogRhythm Intelligence carries Exabeam's behavior analytics into that self-hosted workflow with a sync service that aligns case status and risk scores across the two platforms.

Exabeam Nova is the agent layer, a set of named agents that summarize cases, classify threats, automate rule creation and conversion and surface high-priority entities. NetMon adds network traffic monitoring with deep packet inspection across nearly 5,000 applications, and Outcomes Navigator maps ingested data to use cases, MITRE ATT&CK techniques and recognized compliance frameworks. Agent Behavior Analytics applies the same baselining to AI agents themselves, and SC Media reported in July 2026 that the release doubled its AI-focused detection coverage and added support for Anthropic's Claude. [s3, s4, s5, s7, s8, s6, s9, s26, s30, s31]

Exabeam competes against companies that already sell the buyer something else, and it does so as a Thoma Bravo portfolio company, since Thoma Bravo owned LogRhythm before the merger and lists Exabeam in its portfolio today. SecurityWeek named Cisco-owned Splunk, Microsoft Sentinel, IBM and Securonix as the competitive set at the time of the merger, and TechCrunch noted that the merger was announced the same day Palo Alto Networks confirmed it was buying the assets of IBM's SIEM business, QRadar.

The pitch that follows from that structure is independence. Exabeam's platform page sells reading the tools a customer already owns and avoiding a proprietary scheme, which is an argument aimed squarely at a buyer weighing whether to take the SIEM its endpoint or cloud vendor bundles.

Self-hosting addresses local-control requirements, since LogRhythm SIEM runs in the customer's own data center or a private cloud the customer manages, and its FAQ sends a buyer who wants a cloud-native option to the other platform. The reviewed record does not compare competitors' deployment models, and it names no capability a funded competitor would find slow or costly to build. [s21, s22, s20, s3, s7]

The named-customer record is broad, and Exabeam's own boilerplate claims more than 3,000 enterprises worldwide. Customer stories cover BRAC Bank in Bangladesh, MUFG Union Bank, NTT Data, Aeroméxico, the engineering group MAIRE, Qatari Diar and The Football Association, and the homepage names NASA and the U.S. Air Force among its customers.

One integration reaches beyond Exabeam's own console. Exabeam announced in August 2026 that it had extended its behavioral analytics and workflow automation into Google Security Operations, and that New-Scale Analytics is available to those customers through Google Cloud Marketplace.

The corroboration is the gap. The customer references in the reviewed record sit on pages Exabeam or its owner publishes, and SC Media's 2026 award write-up cites more than 1,100 Nova customers since the April 2025 launch without disclosing its source. [s12, s1, s15, s17, s24]

Several of the senior team came from LogRhythm. Pete Harteveld became chief executive in October 2025 after serving as chief revenue officer and, by Exabeam's account, helping unite the two companies in 2024. The chief technology officer and chief customer success officer each held senior LogRhythm roles before the merger. The record does not say which of the two merging companies Harteveld joined from.

The strongest individual credential is in AI security. Steve Wilson, the chief AI and product officer, founded and co-chairs the OWASP Gen AI Security Project, the community effort behind the OWASP Top 10 for large language model security, and Exabeam's agent work is built around that vocabulary.

Chris O'Malley, who led the combined company from the merger, retired in October 2025 and stayed engaged through the fourth quarter. The leadership that closed the merger has already turned over once, which is the continuity record a buyer can check. [s2, s19, s15, s18]

The assurance package is documented and inspectable. Exabeam holds ISO 27001, 27017 and 27018 certifications, a SOC 2 Type II report and an IRAP assessment at the PROTECTED level, publishes service levels of 99.9% for data upload and 99.5% for product access, and runs a trust portal that publishes a certification list including SOC 2 Type 2 and Cyber Essentials.

Cloud customers choose where data is hosted, and the self-hosted product is the answer for buyers whose rules keep logs on their own equipment. Those two deployment options are what a regulated buyer weighs when a competitor sells only a cloud service.

Two Exabeam executives told TechJournal.uk that a North Korean operative cleared the company's own hiring checks in the summer of 2025, and that its behavior analytics flagged the account within 24 hours of first login and the laptop was reimaged within hours. The account comes from the company itself, no reviewed source verifies it independently, and Exabeam's field chief information security officer acknowledged that the account could damage the company's reputation. [s10, s11, s7, s23]

Add analyzed competitors to compare them side by side with Exabeam.

Exabeam segments by deployment model before it segments by industry. The cloud-native New-Scale Fusion platform and the self-hosted LogRhythm SIEM are two answers to the same question, and the second exists for buyers whose rules or preferences keep logs on equipment they own.

The site carries an industry menu, and the named customer stories run across two banks, an airline, an engineering group, a technology services provider and a national football governing body.

The reviewed record shows no self-serve path to either platform. The LogRhythm pages route pricing to a sales representative, which places that buying process inside enterprise procurement, and the smaller end of the market appears once, through Cybanetix, a provider that sells cybersecurity to small and mid-sized businesses.

The behavioral layer is the differentiator Exabeam leads with. New-Scale Analytics builds dynamic baselines for human and non-human activity and assigns risk scores, and it can run on another vendor's SIEM or data lake rather than requiring a rip-and-replace.

Exabeam Nova is the automation layer above it, a set of named agents that summarize cases, classify threats, automate rule creation and conversion and pull high-priority entities into an investigation. SC Media reported that Exabeam extended the same modeling to AI agents in April 2026 and doubled its AI-focused detection coverage in July 2026, adding support for Anthropic's Claude.

The same record bounds that advantage. The reviewed material describes baselines built from the logs a customer already sends and names no pooled cross-customer corpus. The cross-customer path the reviewed record documents is Outcomes Navigator, whose Nova Advisor Agent benchmarks a customer's use-case coverage against peers, and the record describes that comparison without sizing the data behind it. Exabeam's AI security work outside the product, the Praxen agent-verification tool, is published under the Apache 2.0 license for anyone to read.

Exabeam sells into an enterprise buying process, and its own boilerplate claims more than 3,000 enterprises worldwide. The customer stories name organizations with published case studies, among them BRAC Bank, MUFG Union Bank, NTT Data, Aeroméxico, MAIRE and The Football Association, and the homepage names NASA and the U.S. Air Force among its customers.

The clearest distribution move in the reviewed record is with Google. Exabeam announced in August 2026 that it had extended its behavioral analytics and agent-powered workflow automation into Google Security Operations, and that New-Scale Analytics is available to those customers through Google Cloud Marketplace, where purchases can count toward existing Google Cloud commitments.

What the reviewed record lacks is independently reported customer validation. The names appear on pages Exabeam or its owner publishes, and SC Media's award write-up cites more than 1,100 Nova customers since April 2025 without disclosing its source, so a buyer checking references starts from material the vendor shaped.

Exabeam publishes no price. The LogRhythm SIEM page states the shape of the deal rather than the number, offering a subscription or a perpetual license under what it calls a True Unlimited Data Platform model with no tiers, and directs the buyer to a sales representative.

The pricing language answers a cost question directly. LogRhythm SIEM's model promises no tiers and no hidden fees, and the platform pages sell data pipeline management and searching data in place as ways to control what a deployment costs.

For a buyer, the practical consequence is that total cost cannot be estimated from public material. The LogRhythm pages route pricing to a sales representative, and the reviewed record contains no list price for either platform, no unit of consumption and no published discount structure.

Delivery splits along the same line the portfolio does. Exabeam runs the cloud service on a multi-tenant architecture and lets a customer choose where data is hosted, and it commits to monthly data upload availability of 99.9% and product access availability of 99.5%.

The self-hosted product moves the operational burden to the customer. LogRhythm SIEM runs in the customer's own data center or a private cloud it manages, which is the arrangement a buyer chooses when residency or control matters more than someone else running the platform.

At the merger the combined company committed to quarterly launches across both the cloud-native and on-premises lines. The reviewed record does not track releases against that commitment, and SC Media reported in April 2026 that the new agent capabilities were being integrated into both the Exabeam New-Scale and LogRhythm platforms.

The reviewed assurance record covers the enterprise credentials. Exabeam holds ISO 27001, 27017 and 27018 certifications, a SOC 2 Type II report and an IRAP assessment at the PROTECTED level, and its trust portal publishes a certification list including SOC 2 Type 2 and Cyber Essentials.

The program behind the certificates is described rather than merely asserted. A governance, risk and compliance team runs the security program, a third party conducts an annual attack and penetration test, and Exabeam says it shares those results with customers.

Exabeam also published a failure. Two of its executives told TechJournal.uk that a North Korean operative cleared its own third-party background check in the summer of 2025, that its behavior analytics flagged the account within 24 hours of first login, and that the activity was shut down and the laptop reimaged within about four to six hours. The account comes from Exabeam, no reviewed source verifies it independently, and its field chief information security officer acknowledged that the account could damage the company's reputation.

Openness is the platform argument. New-Scale Fusion integrates with more than a thousand tools through low-code automation and standard APIs, and an MCP server extends its data into external workflows and agentic experiences.

The ecosystem argument doubles as the competitive one. Exabeam sells reading the tools a customer already bought and avoiding a proprietary scheme, which is aimed at the buyer deciding whether to accept the analytics bundled by an endpoint or cloud vendor.

Exabeam also contributes code to the ecosystem. It released Praxen, an agent behavior verification tool, under the Apache 2.0 license, and SC Media reported the release of Observra, an open-source telemetry library for AI agents.

Several of the senior team came from LogRhythm. Thoma Bravo, which owned LogRhythm before the merger, lists Exabeam in its portfolio today. Pete Harteveld became chief executive in October 2025 after serving as chief revenue officer, and the chief technology officer and chief customer success officer each held senior LogRhythm roles before the merger.

The deepest individual credential belongs to the product organization. Steve Wilson, the chief AI and product officer, founded and co-chairs the OWASP Gen AI Security Project, the community effort behind the OWASP Top 10 for large language model security.

Continuity is the item a buyer can check. Chris O'Malley, who led the combined company from the merger, retired in October 2025 after three years and stayed engaged through the fourth quarter, so the leadership that closed the merger has already turned over once.