Hydrolix launches Security Data Layer for cheaper long-term security telemetry storage

Hydrolix on July 30, 2026 introduced a Security Data Layer aimed at giving security teams and MSSPs full-fidelity telemetry access without forcing SIEM budgets higher. The platform is built to keep high-volume data hot, searchable, and available for investigations for months or years, while preserving existing tools and workflows.

Why it matters: - Security teams often shorten retention windows or move data to cold storage because SIEM costs rise with ingest. - That tradeoff can leave investigators without the evidence they need weeks or months later. - Hydrolix is positioning the Security Data Layer as a way to keep more telemetry available without replacing existing SIEM investments. - The goal is faster investigations, stronger root-cause analysis, and better incident containment.

What happened: - Hydrolix announced the Hydrolix Security Data Layer on July 30, 2026. - The product is built as a data layer beneath modern SIEM and agentic SecOps platforms. - Hydrolix says the layer connects through MCP where applicable and offers native integrations for federated environments such as Splunk. - The company says the product is available now. - Hydrolix and Monad experts, including Hydrolix CEO and Co-founder Marty Kagan, will be at Black Hat USA for interviews.

The details: - Hydrolix says the Security Data Layer ingests petabyte volumes of telemetry, compresses data by up to 50x, and stores it in the customer’s own cloud. - The platform keeps data immediately queryable at any age. - Security teams can keep using SIEMs and analyst tools for detection and daily workflows. - High-volume sources can include firewall, network flow, DNS, EDR, proxy, and cloud logs. - Monad provides a tight integration for next-generation agentic security operations. - Monad’s network includes more than 340 integrations. - Hydrolix says the platform keeps months or years of telemetry available for investigations and audits. - The company says the data layer supports full-fidelity, sub-second-searchable data at a lower cost than storing all telemetry directly in a SIEM.

Between the lines: - The launch reflects a broader shift in security operations: retention has become a budget problem, not just a technical one. - Hydrolix is not trying to replace Splunk or other SIEM tools. - The strategy is to keep detection and analyst workflows in place while moving bulk retention to a separate high-performance layer. - That approach targets the gap between fast lookups and long-horizon correlation searches, which matter most in extended investigations.

The details: - Hydrolix worked with RAD, a European managed security service provider, Cisco/Splunk, and Monad on a real-world evaluation. - The test used about two million Palo Alto firewall log events. - RAD used its own production detection logic. - Hydraolix retained the telemetry for low-cost, full-fidelity storage and used the Hydrolix Search for Splunk connector for querying. - For broad correlation searches, Hydrolix returned results in 1.6 seconds. - The test ran with column indexing intentionally disabled. - RAD said the evaluation showed it could keep more data and still get analysts to root cause faster from inside Splunk. - RAD also found that Splunk remains faster for highly targeted, single-record lookups.

What's next: - Hydrolix will use Black Hat USA to brief customers and partners on the Security Data Layer. - The company is likely to lean on the RAD evaluation as proof that long-term retention and fast investigations can coexist. - The product will compete on whether security teams see enough cost relief and query speed to move high-volume telemetry out of the SIEM.

The bottom line: - Hydrolix is betting security teams will pay for full-fidelity history if they can keep existing tools, cut storage costs, and still search old telemetry in seconds.