SECURITY

Exclusive: Daylight gives managed detection and response customers searchable telemetry without a SIEM

Israeli cybersecurity startup Daylight Security Inc. today launched Agentic Security Data Lake, a managed service that lets its managed detection and response customers retain years of security telemetry and search it without running their own security information and event management platform.

The service is aimed at security teams that have to keep telemetry around for compliance, audits, legal inquiries and old investigations but balk at the cost and upkeep of a full SIEM.

The issue is one whereby telemetry piles up from everywhere now: identity providers, cloud platforms, endpoints, software-as-a-service apps, email systems and the rest of the security stack. Keeping it is cheap enough. The trouble starts when someone needs an answer from data collected months or years earlier.

SIEM platforms became the standard fix, serving as the system of record that made all that data searchable. The economics soured as volumes grew. Ingesting, indexing and querying the data turned expensive and the infrastructure got harder to run, so some teams went hunting for a cheaper option.

Agentic Security Data Lake uses a two-tier design to keep that cost down. Recent telemetry stays live for active investigations. Older data drops into low-cost archival storage and gets rehydrated into searchable storage only when an investigation calls for it. Organizations can hold years of history and pay full search costs only on the slice they actually pull back.

A natural-language chat interface lets analysts ask questions in plain English instead of writing queries. Those who want more control can reach the telemetry directly through Kusto Query Language. Daylight also stores telemetry in its original format rather than normalizing it on the way in, which spares teams from guessing up front which fields a future investigation might need.

“Organizations need to retain security telemetry for compliance, audits, investigations, and operational visibility,” said co-founder and Chief Executive Hagai Shapira. “For many organizations, the challenge is not storing the data. The challenge is making it accessible without taking on the cost and complexity of operating a SIEM.”

The launch pushes Daylight’s managed security operations platform past detection and response. Daylight MDR continues to handle 24/7 detection, investigation and response, while the data lake adds the long-term retention, searchability and historical investigation capabilities that traditionally drove SIEM adoption. The company said the service is not meant to replace every SIEM deployment, but to cover the retention and investigation needs many organizations have without the operational weight of a full platform.

Daylight was founded in 2025 by Shapira and Eldad Rodich, both veterans of Israel’s Unit 8200 intelligence unit. The company raised a $33 million Series A round in November led by Craft Ventures Management, following a $7 million seed round in July.

Agentic Security Data Lake is available today for Daylight MDR customers.

Image: Daylight Security