Exabeam: Smaller Means Stronger In SIEM Market

(Pictured above: Exabeam’s Nir Polak on stage at Spotlight 2018 in Las Vegas, Sept. 12.)

EXABEAM SPOTLIGHT — Watch out Splunk, IBM, ArcSight and other, larger security information and event management (SIEM) vendors because Exabeam, with its arsenal of partners, is gunning for your business.

At this week’s Exabeam Spotlight 2018 in Las Vegas, the company’s first user conference, executives laid out their ambitious plans for the company to continue on its rapid growth trajectory.

Nir Polak, Exabeam’s co-founder and CEO, said his company recently crossed the 200-customer mark, “so we’ve been on kind of a triple, double, double growth with the top-line revenue, and we’re going to double again this year, so it’s very big for us.” And being a channel-only organization, Exabeam has to depend on partners for growth, he said.

“In security, when you’re trying to go wide in a transactional way, everything passes through a channel, so we’ve been 100-percent channel out of the gate,” he said. “We have a fairly large channel team here with very seasoned executives … we have very good channel connections. We try to have really good relationships with them and we’re never going to do anything that will upset the waters. We’re going to be very fair to the channel because we believe that they’re an integral part of our go to market.”

Last month, the company announced $50 million in new Series D funding. 

“We’re using both those funds and the funds we’re getting from our customer base to really put much more emphasis in research and development,” Polak said. “There’s a lot of innovation that we have to do to remain current in security. Once you stop innovating, you’re done. We’re investing 20 percent more than companies such as Splunk, FireEye or even Palo Alto Networks when they were at our stage … both in R&D and the customer success side of the house.”

Exabeam is taking on the bigger vendors and stealing deals, “and we have to because in the end there [are] gaps,” Polak said.

“These are very well-established vendors that have built features, some of them for 15-20 years, and they have all kinds of bells and whistles, and stuff like that,” he said. “We had to put a lot of innovation in order to close that gap, and we’ve done really, really well with that. It’s an amazing trajectory here with all the different customers talking about the replacement of their Splunk, (IBM) QRadar, Nitro and LogRhythm — you have them all.”

Exabeam will increasingly be focusing on cloud with an upcoming platform on which multiple applications will run, Polak said.

“We’re calling it the Exabeam cloud-platform project,” he said. “We put a lot of emphasis on using all the latest and greatest technology, from multitenancy to elasticity, to DevOps, to be able to easily deploy multiple applications. We can’t talk too much about roadmap on what’s coming up on those, but there’s a lot of cool, cool things.”

Exabeam later next year will launching a SaaS offering, Polak said.

“I’m amazed at how much appetite there is in the market today, how much frustration there is around the pricing models of these incumbents, and they’re so open to replacing their SIEM,” he said. “That’s helping propel our growth.”

During the conference, Exabeam unveiled its new Threat Intelligence Service, a cloud-based offering that aggregates threat indicators from multiple online sources. It collects potential indicators of compromise (IOCs), and security analysts will be able to use the feeds directly in Exabeam products, simplifying the task of …

… understanding the impact of a potential threat and saving time conducting the investigation, according to the company.

Exabeam also announced the addition of case-management functionality into Exabeam Advanced Analytics and Exabeam Entity Analytics, its user and entity behavior analytics (UEBA) offerings. It provides a customizable user interface designed for the workflows of security teams, adding intelligence aimed at helping analysts resolve incidents more efficiently. Machine learning helps make the interface context aware, presenting users with relevant fields, values and data for different incident types.

Ted Plumis, Exabeam’s vice president of channel, said being a smaller, channel-only SIEM vendor gives his company a competitive advantage.

“We can be pretty nimble on the channel front,” he said. “If you look at our channel program globally, we have the top security partners in every theater around the world, and part of that is we can be nimble. One partner may say I need you to get me services certified, so we’ll spend and do that, and another partner may say I don’t want to do services, but I really need you to come in and help me build a workshop for my customers to explain moving from legacy SIEM to a next-gen SIEM, and we can do that. We also have a lot of ability to fit into existing SIEM programs that these vendors have.” 

Sylvain Gil, Exabeam’s co-founder and vice president of products, said when you look at SIEM vendors like Splunk, IBM and Micro Focus, “these are not channel-friendly companies, they are used to selling direct … and they try to bypass the channel because of the presence they have, because they’re such big IT providers.”

“We don’t do any direct deals .. and we’ve decided as a company to not do the professional services that comes with delivering our products,” he said. “The idea is we don’t even contract it out. We partner with service-delivery partners out there, and it can be the bigger SIs or our security channel partners. And we have a full training program for these folks.”

Identropy provides the implementation, advisory and migration services for Exabeam. It was referred by SailPoint, whose IdentityIQ is integrated with Exabeam’s UEBA.

“It’s been a very exciting partnership so far,” said Fletcher Edington, account executive with identropy. “Over the past few months we’ve actually dedicated a team purely to Exabeam now and this has all come together in the past six months or so. We’re very proud to be a critical part of the implementations and their growth in the marketplace.”