估值 01
$2.4B USD [CV001] 尽调报告
Exabeam
私募股权持有下的 AI 驱动 SIEM/UEBA
Exabeam 仍是具备差异化的 SIEM/UEBA 挑战者，已有真实规模，AI 定位也很强；但并购后的经济账目仍不透明，云迁移和老客户留存也带来执行风险。
覆盖范围与披露说明
公开证据支持公司身份、产品方向、客户规模和历史融资，但合并后的当前 ARR、NRR、毛利率、流失率、现金、烧钱和债务仍未披露。
封面要素
公司概况
Exabeam 是一家由私募股权支持的安全运营厂商，将云原生 UEBA、SIEM 摄取、自动化和智能体 AI 结合起来，服务混合云及自管环境中的企业 SOC 团队。
- 成立时间
- 2013-01-01
- 创始人
- Nir Polak
- 创立地点
- Foster City, California, USA
- 总部
- Foster City, California, USA
- 产品
- 云原生 New-Scale SIEM、New-Scale Analytics/Fusion、Nova 智能体 AI、Agent Behavior Analytics，以及自托管 LogRhythm SIEM。
- 客户
- 企业安全运营团队和大型 SOC 组织
- 商业模式
- 与平台模块和遥测摄取绑定的经常性订阅及支持收入，辅以专业服务、培训和维护。
- 阶段
- Growth — PE-backed post-merger
- 融资情况
- 2024 年 7 月 Thoma Bravo 合并前累计融资约 $390M；当前私募融资条款和合并后经济状况未披露。
执行摘要
主要优势
- AI 原生的 Nova 和智能体 SOC 路线让产品组合形成差异化。
- Exabeam 与 LogRhythm 合并后的规模带来庞大的存量客户基础。
- Thoma Bravo 的控股为公司提供资金支持和运营纪律。
主要风险
- 公开的 ARR、利润率、NRR、流失率和烧钱数据仍未披露。
- 老 LogRhythm 客户迁移和双架构支持可能拖慢执行。
- 更大型平台厂商和超大规模云厂商带来的竞争压力仍然很大。
- 整合复杂度可能推迟产品简化和云端采用。
未决问题
- 合并后的实际 ARR 和净收入留存率尚未公开披露。
- 老 LogRhythm 客户基础的实际流失情况和迁移速度仍不清楚。
- 按部署模式和产品线拆分的毛利率尚未公布。
- 合并后公司的现金、烧钱速度、债务和现金跑道均未披露。
- 私募股权股东的退出时间表和交易结构仍不清楚。
目录
01公司概览
1.1 公司身份、成立背景与商业模式
Exabeam 是一家由私募股权支持的安全运营厂商，将云原生 UEBA、SIEM 摄取、自动化和智能体 AI 结合起来，服务混合云及自管环境中的企业 SOC。公司 2013 年成立，最初从行为分析叠加层发展为完整的 SIEM/TDIR 厂商；收入主要来自 New-Scale 平台年度订阅和自管日志采集器的软件维护。[CO001, CO008, CO013]
| 指标 | 数值 / 状态 | 日期 | 置信度 | 尽调判断 / 缺口 |
|---|---|---|---|---|
| 估值 | $2.4B（投后） | 2021-06-01 | 高 | 已在 2 亿美元 F 轮融资时确立；后续私募市场重估及 2024 年合并估值条款未披露 |
| 累计募资 | $390M+（合并前） | 2021-06-01 | 高 | 据报道，2014 至 2021 年间完成 6 轮股权融资；额外的 Thoma Bravo 合并股权 / 债务未拆分 |
| 年度经常性收入（ARR） | 未披露 | 2026-10-12 | 低 | 合并后 ARR 及增长轨迹尚未由私募股权所有方公开，构成重大尽调缺口 |
| 客户数量 | 全球 3,000+ 家企业 | 2026-10-01 | 高 | LogRhythm 合并后客户基础合并扩大规模（合并前约 600 家） |
| 员工人数 | ~411（合并前 Exabeam）/ ~750+（合并后） | 2026-10-12 | 中 | 2021 年披露历史员工数为 411 人；当前覆盖 22 个国家的合并团队规模为估算值 |
| 全球布局 | 双总部：Foster City, CA 与 Broomfield, CO；22 个国家 | 2024-07-17 | 高 | 合并后运营布局覆盖 22 个国家，横跨北美、EMEA 和 APAC |
快照指标截至 2026 年 10 月，反映已核实的公司披露、风险融资轮次和合作伙伴公告；ARR、NRR、流失率等私募财务表现指标仍未由赞助方 Thoma Bravo 披露。
[CO002, CO003, CO008, CO013]1.2 高管领导、治理与关键人物结构
Exabeam 的治理和高管团队随规模扩张经历了有意的交接：创始 CEO Nir Polak 于 2021 年转任董事长，Michael DeCesare 接任 CEO；2024 年 7 月与 LogRhythm 合并后，Pete Harteveld 统一领导公司。Steve Wilson、David Kennedy 分别负责 AI/产品与技术，团队覆盖销售、客户成功和法务，Thoma Bravo 提供私募股东支持。[CO004, CO005, CO014, CO015]
| 人员 | 职务 | 背景 | 职能覆盖 / 匹配度 | 关键人物依赖 |
|---|---|---|---|---|
| Pete Harteveld | 首席执行官 | 在网络安全与科技领域拥有超过 20 年经验；曾任 Exabeam 首席营收官，此前担任 Aryaka、Veracode、Compuware 和 Deloitte 的管理职务 | 高管领导、GTM 转型与并购整合 | 高；合并后整合、组织战略和商业执行的关键推动者 |
| Nir Polak | 联合创始人兼董事会主席 | 从公司成立到 2021 年担任 Exabeam 创始 CEO；领导公司完成初期 UEBA 开发和早期规模化 | 董事会治理、战略愿景与创始人延续性 | 中；转任董事会职务降低运营层面的关键人物风险，同时保留战略一致性 |
| Steve Wilson | 首席 AI 与产品官 | OWASP GenAI Security Project 创始人 / 联席主席；O'Reilly LLM Security playbook 作者；曾任 Citrix、Oracle、Sun 的副总裁 / 负责人 | AI 路线图、Nova 智能体架构与智能体行为分析 | 高；Exabeam 智能体式 AI 战略和技术差异化的首席架构师 |
| Mike Byron | 首席财务官 | 拥有超过 20 年 SaaS 财务经验；曾任 Mimecast 战略财务高级副总裁（出售给 Permira），以及 Rapid7 FP&A 负责人 | 财务运营、PE 报告、资本结构与 SaaS 指标 | 中；经验丰富的网络安全财务负责人，支持 Thoma Bravo 监督和财务纪律 |
| David Kennedy | 首席技术官 | 曾任 Exabeam 工程副总裁 / 企业架构师；此前担任 LogRhythm、Dynatrace、Compuware 首席架构师 | 覆盖云原生与自托管部署的平台技术架构 | 高；连接 Exabeam New-Scale 与传统 LogRhythm 引擎的关键跨平台架构桥梁 |
| Kiley LePage | 首席法务官 | 拥有 20 年企业治理、合规和企业交易法律高管经验 | 公司治理、监管合规、风险管理与法务运营 | 低；成熟的法律框架由赞助方法律顾问（Kirkland & Ellis、Goodwin Procter）支持 |
管理层简介根据 Exabeam 官方公司治理公告和高管履历整理，覆盖 2024 年 LogRhythm 合并及 2026 年组织更新后的情况。
[CO004, CO005, CO014, CO015]1.3 融资历史、估值与投资者
2014—2021 年，Exabeam 通过六轮机构股权融资筹得约 $390M，投资者包括 Lightspeed、Norwest 和 Acrew。2021 年 6 月，Blue Owl Capital 旗下 Owl Rock 领投 $200M 的 Series F，投后估值 $2.4B。2024 年 7 月 17 日，Thoma Bravo 完成 Exabeam 与 LogRhythm 的合并并取得控股权；交易估值和合并后的股权比例未公开，早期投资人保留滚存权益。[CO002, CO003, CO007, CO008]
| 利益相关方 | 角色 / 类型 | 控制权或经济重要性 | 投资历史 / 条款 | 尽调重点与治理要求 |
|---|---|---|---|---|
| Thoma Bravo | 私募股权赞助方 / 控股股东 | 2024 年 7 月 LogRhythm 与 Exabeam 合并后拥有控制性经济权益和董事会监督权 | 2018 年收购 LogRhythm；主导并出资推动 2024 年与 Exabeam 的合并 | 核实回报预期、债务契约结构、资本承诺及流动性事件时间表 |
| Blue Owl Capital (Owl Rock Division) | 机构成长投资者 | 2021 年 6 月以 24 亿美元估值领投 Exabeam 2 亿美元 F 轮融资 | 2021 年领投 2 亿美元融资，在合并前提供主要扩张资本 | 确认 2024 年 Thoma Bravo 合并后的当前股权地位、稀释或滚存条款 |
| Lightspeed Venture Partners | 早期及成长阶段风险投资支持方 | 重要少数风险投资股东；支持公司从早期轮次到 F 轮 | 2014 年起参与早期轮次，并参与 2021 年 F 轮 | 评估治理参与、董事会观察员权利和风险基金生命周期 |
| Norwest Venture Partners | 风险投资伙伴 | 支持公司规模化和商业化阶段的机构风险投资方 | 参与截至 2021 年 6 月 F 轮的多轮股权融资 | 检视历史银团一致性及其向合并后私募股权实体的滚存 |
| Acrew Capital | 风险投资伙伴 | 在多轮融资中持续支持的风险投资股东 | 参与从早期到 F 轮的多个成长阶段 | 评估滚存至合并后股权工具的比例及二次出售历史 |
| 管理层与联合创始人 | 管理层股权持有人 | 合并后管理团队的管理层一致性和激励股权池 | 合并后滚存股权及管理层激励单位 | 审阅留任契约、归属加速触发条件及高管激励池规模 |
投资者和利益相关方地图根据已核实的资本交易公告、F 轮条款清单和 Thoma Bravo 合并披露整理。
[CO002, CO003, CO007, CO008]1.4 运营规模、产品里程碑与整合路径
合并后的 Exabeam 服务覆盖 22 个国家、逾 3,000 家企业。技术路线包括 2025 年 4 月推出的多智能体框架 Exabeam Nova、2026 年 1 月推出的 Agent Behavior Analytics，以及 2026 年 10 月发布的 Agentic SOC 架构。公司一边推进云迁移，一边维护旧产品，例如 2025 年 7 月发布 LogRhythm 7.21；第三方跟踪机构则指出，主流基准中的独立 LogRhythm 品牌正在退出。[CO006, CO009, CO010, CO011, CO012, CO013]
梳理从 Exabeam 2013 年成立到 2026 年智能体式 SOC 正式可用期间的关键公司、资本、产品和治理里程碑。
[CO001, CO002, CO003, CO004, CO005, CO006, CO007, CO008, CO009, CO010, CO011, CO012, CO013]1.5 案例
02市场分析
2.1 市场边界、纳入支出与相邻领域
企业 SOC 架构把遥测摄取、威胁检测、调查和响应区分开来。核心市场包括下一代 SIEM、集中式安全日志管理、UEBA 及 SOAR；支出覆盖高吞吐日志摄取、信息模型标准化、行为基线和自动案件分诊。独立终端防护、身份目录治理及缺少专门威胁规则的通用 IT 可观测性平台则不在范围内。[CM001, CM002, CM003, CM004]
| 细分市场 / 类别 | 纳入支出 | 排除支出 | 主要买方 / 付款方 | 与 Exabeam 的相关性 |
|---|---|---|---|---|
| 下一代 SIEM 与安全日志管理 | 云日志摄取、通过 CIM 规范化、可扩展索引、搜索流水线、合规报告 | 原始云基础设施托管、通用商业智能数据库、通用日志聚合器 | CISO / 安全运营副总裁 | 通过 New-Scale SIEM 和 LogRhythm 本地引擎交付的核心收入引擎 |
| 用户与实体行为分析（UEBA） | 机器学习基线、异常活动检测、内部风险评分、凭据滥用分析 | 身份治理与管理（IGA）、目录服务、静态访问策略引擎 | 威胁检测负责人 / SOC 负责人 | 基础差异化能力；自动生成时间线并动态进行风险评分 |
| 安全编排与响应（SOAR） | 自动化事件丰富、剧本执行、webhook 连接器、安全工具间 API 集成 | IT 服务管理（ITSM）工单许可、外部通知软件、DevOps CI/CD 流水线 | SecOps 总监 / 安全工程负责人 | 原生集成在 Fusion 平台工作流中的交钥匙响应自动化 |
| 智能体式 AI 安全运营（Agentic SOC） | AI 协同调查员、智能体行为分析（ABA）、非人类身份监控、自动分诊 | 通用生成式 AI LLM 订阅、前台聊天助手、非安全机器人 | CISO / 首席 AI 与风险官 | 由 Exabeam Nova 和 2026 年推出的 Agentic SOC 能力带来的新兴增长方向 |
支出分类反映 SOC 核心能力，并排除了相邻的身份治理和通用 IT 基础设施。
[CM001, CM002, CM003, CM004]2.2 市场规模、可服务机会与增长预测
全球 SIEM 市场预计从 $10.67B 稳步增长至 2031 年的 $20.78B，复合增速 11.5%。2025 年传统及本地部署占收入 55.27%，但云原生 SIEM 以 12.84% CAGR 更快增长；组织正把计算与存储分离，以每日摄取超过 10TB 遥测。Exabeam 以 New-Scale 切入云现代化市场，以 LogRhythm 服务自托管存量。[CM001, CM002, CM004, CM005, CM012]
| 发布方 / 视角 | 年份 | 地理范围 | 价值（美元） | CAGR | 方法论 | 置信度 | 局限 |
|---|---|---|---|---|---|---|---|
| 近期市场研究（Exabeam 说明材料） | 2026 | 全球 | $10.67B（2025）至 $20.78B（2031） | 11.5% | 厂商汇编的企业遥测与 SIEM 软件支出市场综合分析 | 中 | 汇总了广义 SIEM 软件，但未拆分独立 UEBA 或 SOAR 增值层 |
| 本地 SIEM 细分市场（市场研究） | 2025 | 全球 | $5.90B（2025 年占比 55.27%） | 中等 | 分析受监管行业中传统及自托管设备部署的市场份额 | 中 | 面临稳定的云端转化压力，但受主权数据要求支撑 |
| 云原生 SIEM 现代化（市场研究） | 2026 | 全球 | $4.77B（2025 年占比 44.73%） | 12.84% | 自下而上跟踪 SaaS SIEM 订阅收入和云遥测摄取 | 中 | 将纯云 SIEM 服务商与超大规模厂商的安全日志产品合并计算 |
| 安全运营平台机会（SDxCentral / 高管规模估算） | 2021 | 全球 | $2.4B 私募估值基础 | 两位数 | 基于私募轮估值倍数，假设向更大型企业 SecOps 可服务 TAM 扩张 | 低 | 这是由估值推导的代理指标，而非经审计的收入拆分；合并后规模未更新 |
市场研究数字反映行业披露中引用的全球 SIEM 行业基准；CAGR 覆盖 2025 至 2031 年。
[CM001, CM002, CM005, CM012]从安全运营总支出逐层拆解至 Exabeam 可服务、可获取的市场机会。
各层宽度仅表示层级，不代表数值比例。
市场规模层级综合全球市场研究基准和厂商收入估算；SOM 反映预估的可触达目标市场。
[CM001, CM002, CM007, CM011]2.3 买方画像、用户分层与预算归属
安全运营平台的采购横跨财富 2000 强、中型企业和 MSSP。CISO 与信息安全副总裁掌握预算，优先考虑审计合规、快速遏制入侵和运营韧性；日常用户是 Tier 1–3 分析师、事件响应人员和检测工程师。续约、日志超额费用或重大合规审计期限通常会加速采购。[CM006, CM009, CM010, CM011]
| 细分市场 | 目标买方 | 主要用户 | 经济付款方 | 核心工作流 | 预算负责人 | 采用触发因素 |
|---|---|---|---|---|---|---|
| 全球 2000 强与大型企业 | 首席信息安全官（CISO） | 二级 / 三级威胁猎人和 SOC 分析师 | 企业 IT 与安全资本预算 | 多源日志关联、内部威胁检测、自主案件分诊 | 信息安全副总裁 | 传统 SIEM 许可成本激增、高误报告警疲劳、多云扩张 |
| 中端市场存量客户（LogRhythm 客户群） | IT 副总裁 / 安全总监 | 通用安全管理员和系统工程师 | 年度 IT 安全运营预算 | 自托管日志收集、合规审计报告、自动告警 | IT 总监 / CIO | LogRhythm 7.21 升级规划，以及对云原生 New-Scale 迁移路径的评估 |
| MSSP 与托管检测（MDR）合作伙伴 | 首席运营官 / 托管服务副总裁 | MSSP 多租户 SOC 分析师和工程师 | 合作伙伴销售成本（COGS） | 多租户告警分诊、共同管理客户监控、自动事件派发 | 托管服务负责人 | 需要可扩展的 AI 协同调查员，在不增加员工的情况下守住运营利润率 |
| 受监管金融机构与关键基础设施 | 首席风险官 / 安全治理负责人 | 合规官与取证事件响应人员 | 专项风险与监管合规预算 | 长期审计留存、取证事件回放、跨境数据驻留执行 | 首席合规官 / CISO | 欧盟 DORA、NIS2 和 SEC 披露要求下的监管执行期限 |
细分市场综合了直接企业客户、共同管理部署和渠道合作伙伴的企业采购模式。
[CM006, CM009, CM010, CM013]2.4 增长驱动、采用瓶颈与实施约束
严格监管（包括欧盟 NIS2、DORA 和美国 SEC 披露要求）推动市场采用，但从旧关联引擎迁移需要重调检测规则和行为基线，也会造成厂商锁定。自动化编排还可能受订阅层执行上限约束，团队必须持续微调数据，才能在避免误升级的同时可靠完成事件分诊。[CM005, CM007, CM008, CM013, CM014]
2.5 案例
03竞争格局
3.1 竞争格局与市场结构
现代安全运营和 SIEM 市场正受遥测爆发、云迁移及自主运营需求推动而重构。2025 年本地 SIEM 仍占市场 55.27%，云架构预计到 2031 年以 12.84% CAGR 增长。2024 年 7 月 17 日，Exabeam 在 Thoma Bravo 控股下完成与 LogRhythm 的合并，将 LogRhythm 的企业客户和摄取能力，与自身行为分析及云原生 New-Scale Fusion 结合。竞争者包括 Palo Alto Networks、Fortinet、Microsoft Sentinel、Google Cloud SecOps 和已并入 Cisco 的 Splunk；Exabeam 以开放、厂商中立和异构遥测摄取作为差异化。[CP001, CP004, CP006, CP010]
| 竞争对手 | 类别 | 估计规模 / 支持方 | 目标细分市场 | 主要差异化 | 主要局限 |
|---|---|---|---|---|---|
| Exabeam | 独立 SIEM / UEBA 领导者 | 私营（Thoma Bravo / Francisco Partners）；合并前累计募资 $390M+ | 中端市场至全球 2000 强企业；异构混合 SOC | AI 驱动行为基线、Exabeam Nova 智能体式 SOC、厂商中立集成 | 双平台维护负担（LogRhythm 对 New-Scale）；持续模型调优要求 |
| Palo Alto Networks (Cortex XSIAM) | 综合型 SecOps 平台 | 上市公司（市值 $100B+）；SecOps 收入运行率数十亿美元 | 寻求在端点、网络和云之间整合平台的大型企业 | 融合式 XSIAM 平台（SIEM / XDR / SOAR / ASM）、SmartGrouping ML 分诊、AgentiX 响应 | 客户高度锁定 Palo Alto Networks 生态；迁移与规划复杂度高 |
| Microsoft Sentinel | 超大规模厂商云原生 SIEM | 上市超大规模厂商；安全业务规模数十亿美元 | 大量依赖 Microsoft 365、Azure 和 Windows 基础设施的企业 | 原生数据湖架构、350+ 连接器、Security Copilot 自然语言查询 | 摄取峰值期间成本波动；对非 Microsoft 环境的集成价值较低 |
| Splunk (Cisco) | 企业数据 / SIEM 既有厂商 | 被 Cisco 以 $28B 收购；拥有市场领先的 SIEM 存量基础 | 配备专门检测工程团队的大型全球企业和政府机构 | 大型集成生态、Splunk Enterprise Security 8.0、Splunk SOAR 剧本 | 总拥有成本高；传统架构复杂，需要大量手工维护规则 |
规模、差异化和局限综合自厂商披露、竞争对手分析和行业评测数据。
[CP001, CP003, CP004, CP005, CP010]3.2 架构差异化与能力矩阵
Exabeam 以行为分析和智能体 AI 形成架构差异化。New-Scale Fusion 用动态基线替代静态关联规则，ABA 覆盖机器账户和自主软件智能体；Nova 的六个 AI 智能体自动完成日志解析、异常检测、威胁排序和响应编排，平台支持逾 1,000 个连接器及 MCP。Palo Alto 认为 UEBA 需要持续调参并造成规则泛滥，强调 SmartGrouping 和无索引数据湖；独立评测也显示 AI 编排器仍需大量上下文微调。[CP002, CP003, CP005, CP009, CP012]
| 采购标准 | Exabeam New-Scale | Palo Alto Cortex XSIAM | Microsoft Sentinel | Splunk 企业安全 |
|---|---|---|---|---|
| 行为分析 / UEBA | 原生行为基线与智能体行为分析（ABA） | 通过 SmartGrouping 进行机器学习告警分组 | 覆盖 Azure、M365、AWS 和 Okta 的内置 UEBA | Splunk UBA 增值模块，需要单独部署 |
| 智能体式 SOC 自动化 | Exabeam Nova（6 个专用 SOC AI 智能体） | AgentiX 自主响应工作流 | Security Copilot 的生成式 AI 查询辅助 | Splunk SOAR / Wayfinder 引导式自动化剧本 |
| 部署灵活性 | 云原生 SaaS 与自托管 LogRhythm 本地部署 | 仅云原生 SaaS | 仅云原生 Azure SaaS | 云原生 SaaS 与本地企业软件 |
| 集成与开放生态 | 1,000+ 连接器与模型上下文协议（MCP）服务器 | 广泛的 Palo Alto Security Fabric 与原生 XDR 摄取 | 350+ 内置连接器与无代码自定义 API | 数千个集成与 Splunkbase 应用生态 |
能力评估依据厂商产品文档和公开竞争对比；具体功能深度因许可层级而异。
[CP002, CP004, CP005, CP009]在行为分析深度与平台整合范围两个维度上呈现竞争定位。
| 条目 | X (6–9) | Y (4.5–9.5) | 说明 |
|---|---|---|---|
| 1. Exabeam（New-Scale Fusion） | 9 | 7 | |
| 2. Palo Alto Networks（Cortex XSIAM） | 7.5 | 9.5 | |
| 3. Microsoft Sentinel | 6.5 | 9 | |
| 4. Splunk 企业安全 | 6 | 8.5 | |
| 5. LogRhythm（自管理旧版） | 7 | 4.5 | |
| 6. Securonix | 8.5 | 6.5 |
序数评分（1-10）基于厂商技术能力、产品文档和分析师市场评估。
[CP001, CP003, CP005, CP007, CP011]3.3 定价模式、切换成本与锁定效应
SIEM 定价是竞争焦点。传统厂商按每日 GB 或每秒事件数收费，促使客户过滤日志；Exabeam 将 New-Scale 定位为可预测的用户/身份套餐。Microsoft Sentinel 按消费量收费，Palo Alto 常把 Cortex XSIAM 与防火墙、SASE 和终端产品打包。SIEM 迁移还要求重构摄取管道、合规报告和检测内容；LogRhythm 客户从 AIE 规则转向 UEBA 基线，需要培训、调优并承受峰值性能风险。[CP004, CP006, CP008, CP011]
| 平台 / SKU | 定价 / 许可模式 | 包含能力 | 折扣与未知事项 | 尽调含义 |
|---|---|---|---|---|
| Exabeam New-Scale Fusion | 基于用户 / 身份及分层摄取的产品打包 | 云规模日志管理、SIEM、UEBA 与 TDIR 自动化 | 企业批量折扣和迁移抵扣未披露 | 对比传统按摄取量计价模式，可更透明地核算总成本 |
| LogRhythm SIEM (Self-Managed) | 设备 / 容量许可（MPS / EPS 上限） | 核心日志聚合、合规报告与 AIE 关联分析 | Unlimited Upgrades 合同条款因客户协议而异 | 传统合同可抵御云端峰值成本，但会带来硬件负担 |
| Palo Alto Cortex XSIAM | 遥测摄取量和端点覆盖许可 | 融合式 SIEM、XDR、SOAR 与攻击面管理 | 折扣与更广泛的 Palo Alto 网络 / SASE 协议高度绑定 | 对整个 Palo Alto 企业资产形成较高平台锁定 |
| Microsoft Sentinel | 按消费计费的 GB 摄取与承诺层级 | 配有 Microsoft 365 数据连接器的云 SIEM 与 SOAR 数据湖 | Microsoft 365 E5 许可提供部分摄取额度 | 若缺乏严格留存上限，EPS 激增时成本会波动 |
定价模型汇总自厂商文档和合作伙伴指引；具体企业折扣安排及定制化承诺档位属于非公开信息。
[CP004, CP006, CP008, CP011]3.4 护城河持久性与平台替代风险
Exabeam 的护城河来自机器学习基线、威胁建模 IP、厂商中立定位及云端/本地双线工程投入，包括 2025 年 LogRhythm 7.21 发布。但 2025 Gartner SIEM 魔力象限不再把 LogRhythm 列为独立厂商，竞品借此制造迁移焦虑。客户留存、NRR 以及 LogRhythm 与 New-Scale Fusion 的收入拆分仍未公开；在未证明留存和迁移顺畅前，平台替代威胁仍高。[CP001, CP003, CP007, CP011, CP013, CP014]
3.5 案例
04财务
4.1 收入模式与变现
Exabeam 销售 New-Scale SIEM、Analytics、Fusion、自动化和自托管 LogRhythm SIEM 组成的产品组合。Fusion 可增强或替代现有 SIEM，形成扩展路径；独立目录称许可可能按每日数据量计费，但没有公开价目表，这不能证明实际价格、经常性收入或毛利率。专业服务、教育和支持可见，但合同结构及收入贡献未披露。[CI001, CI002, CI003, CI004, CI011]
| 收入流 | 机制 | 单位 | 公开状态 | 收入质量 | 尽调问题 |
|---|---|---|---|---|---|
| New-Scale SIEM | 与日志摄取量挂钩的云原生 SIEM 订阅 | 每日数据摄取（GB/day） | 产品和许可依据可见；实际价格未公开 | 可能具备经常性、按用量计费的特征；尚未验证 | ARR、ACV、承诺摄取量、超额用量、折扣、续约条款 |
| New-Scale Analytics / Fusion | 可增强或替代 SIEM 的模块化分析与自动化能力 | 模块、平台及摄取量计费依据未完全披露 | 商业化打包方式可见；价格和收入组合未披露 | 扩展路径合理可行；附加销售率和留存尚未验证 | 模块 ARR、附加销售率、扩展 ARR、毛留存率、NRR |
| 自托管 LogRhythm SIEM | 许可、支持、升级和自主管理部署 | 许可和支持权益；具体计费单位未披露 | 受支持且持续发布版本的产品；经济性未披露 | 可能是经常性维护收入或期限型收入；尚未验证 | 许可期限、维护收入组合、续约率、支持业务毛利率 |
| 服务、培训与支持 | 实施、培训和企业支持服务 | 项目、席位或支持档位未披露 | 服务项目已列出；变现和收入贡献未披露 | 可能促进采用，但若劳动密集会稀释利润率 | 服务收入、利用率、附加销售率、独立利润率 |
仅有公开产品和第三方描述；没有任何行披露实际收入、经审计的收入组合或毛利率。
[CI001, CI002, CI003, CI008, CI011]| 产品/服务 | 公开价格 | 披露的单位或期限 | 折扣证据 | 财务含义 |
|---|---|---|---|---|
| New-Scale 云产品 | 每日摄取量；据报道，转售商 SKU 按 GB/day 计量 | 没有公开的实际价格或折扣数据 | 遥测量增长可推高账单，但优化也可能减少应付摄取量 | |
| 联邦搜索与第三方存储 | 取决于配置；合同计费单位未披露 | 没有公开数据 | 客户控制成本可能有助于留存，但会降低存储变现 | |
| 自托管 LogRhythm SIEM | 提及许可和支持权益；期限及计量方式未披露 | 没有公开数据 | 无法建模续约和升级经济性 |
Null 表示指定证据中没有公开价目表或实际价格；应获取订单、折扣阶梯和 续约分组数据。
[CI003, CI004, CI009, CI015]客户遥测可以提升平台价值并带来与摄入量挂钩的变现，但存储和管道优化也可能减少可计费数据基础。
| 节点 / 连接 | 节点 / 起点 | 终点 | 说明 |
|---|---|---|---|
| 节点 1 | 客户安全遥测 [telemetry] | 来自云端、本地部署、身份、终端和其他工具的日志与信号。 | |
| 节点 2 | 摄入与标准化 [ingest] | 每日摄入量是公开描述最清晰的商业计费单位。 | |
| 节点 3 | 路由与优化数据 [optimize] | 管道控制、第三方存储和联合搜索可以降低存储成本或付费摄入量。 | |
| 节点 4 | 应用分析与自动化 [analyze] | SIEM、UEBA、风险评分、调查和 Nova 智能体共同创造工作流价值。 | |
| 节点 5 | 交付安全成果 [outcome] | 更快的调查速度和更广的威胁上下文支撑客户 ROI 论据。 | |
| 节点 6 | 订阅与使用收入 [monetize] | 实际价格、扩张、留存和毛利均未披露。 |
基于公开产品与许可证据的概念性流程，并非量化收入瀑布图。
[CI015]4.2 牵引力与销售效率代理指标
2026 年 10 月公告称 Exabeam 获逾 3,000 家企业信任，Nova AI 分诊约需十分钟而人工分析师需五小时。这些说法可能支持销售，但不能推出 客户数、ACV、续约、收入增长、CAC、回收期或销售周期；不增加人员改善结果是客户 ROI 主张，不是 Exabeam 自身经营杠杆证据。[CI005, CI006, CI007, CI010, CI011]
4.3 成本结构与单位经济限制
云端摄取、搜索、分析、存储、自动化和 AI 推理带来可变基础设施成本；自托管 LogRhythm 把更多基础设施转给客户，却保留支持、维护和工程成本。第三方存储、联邦搜索和低成本存储可能降低客户支出或提升留存，也可能减少可计费摄取。毛利率、成本、收入结构、NRR、流失、CAC、回收期和营运资金需求未披露，单位经济表保留 null。[CI001, CI004, CI009, CI010, CI011, CI015]
| 指标 | 公开值 | 置信度 | 重要性 | 具体尽调要求 |
|---|---|---|---|---|
| 收入 / ARR / 增长 | 低 | 确定规模和未来增长基数 | 按产品、部署方式、地域以及新增与扩展拆分的月度收入和 ARR 桥接表 | |
| 毛利率 | 低 | 检验云摄取、存储、支持和 AI 推理的经济性 | 按 New-Scale、Fusion 和自托管 LogRhythm 拆分的毛利率与托管 COGS | |
| NRR / 毛留存率 / 流失率 | 低 | 检验合并扰动、定价权和扩展质量 | 按季度统计的客户数和金额分组，包括迁移客户及传统 LogRhythm 客户 | |
| CAC / 回收期 / 销售周期 | 低 | 检验企业 GTM 效率和资金需求 | 全口径 CAC、新客户 ACV、销售周期、合作伙伴贡献和回收期 | |
| 现金 / 消耗 / 现金跑道 / 债务 | 低 | 决定融资依赖度和下行保护 | 当前现金、月度消耗、债务和契约、整合支出及下行情景现金跑道 |
所有值均刻意设为 null，因为指定公开证据未披露这些指标；任何代理指标都不 作为估算值。
[CI010, CI011, CI012, CI016]4.4 资本充足性与财务结论
赞助方支持和历史融资不能替代当前流动性。Thoma Bravo 将 Exabeam 列为被投企业，投资年份为 2018；2026 年目录称融资超过 $400M，但不能证明 2024 年 LogRhythm 合并后的现有现金。留存材料没有现金、亏损、现金流、烧钱、跑道、债务、契约、整合成本、资金用途或下一轮触发条件。组合可能扩大变现，但路线图偏向 New-Scale 且迁移需重调，收入质量、整合成本、利润路径和资本依赖仍未量化。[CI008, CI009, CI012, CI013, CI014, CI016]
4.5 案例
05产品与技术
5.1 平台交付架构、产品线与 Threat Center
Exabeam 以云原生 New-Scale Security Operations Platform 为核心，将 SIEM、UEBA 和 SOAR 汇入统一分析工作台 [CE001, CE002, CE007]；产品还包括 New-Scale SIEM、Analytics、Outcomes Navigator、自管 LogRhythm SIEM 和 Intelligence [CE003]。Threat Center 聚合告警、整理证据、构建时间线，并执行调查剧本以解决完整攻击链 [CE011]。
| 模块 / 产品线 | 目标用户 | 部署与成熟度状态 | 核心技术差异化 | 尽调缺口 / 验证需求 |
|---|---|---|---|---|
| New-Scale Fusion | 企业 SOC 分析师、威胁猎手和安全工程师 | 商业 SaaS；核心云旗舰平台 | 统一 SIEM、UEBA 和 SOAR，并嵌入 Exabeam Nova 代理式工作流 | 跨 PB 级多租户档位的实测查询延迟基准 |
| New-Scale Analytics | 增强传统或第三方 SIEM 的安全运营团队 | 商业 SaaS；可独立使用或作为模块化附加组件 | 专有行为基线、状态跟踪和动态风险评分 | 独立客户留存率和 API 连接器性能上限 |
| Exabeam Nova | Tier 1 至 Tier 3 SOC 分析师和事件响应人员 | 嵌入 New-Scale 控制台的商业功能，不另收 SKU 费用 | 用于分诊、调查、搜索和建议的六个专业自治代理 | 误报抑制率量化数据和提示词幻觉防护 |
| Agent Behavior Analytics (ABA) | 企业 AI 治理、合规和 DevSecOps 团队 | 2026 年在 New-Scale 中推出的商业能力 | 将行为基线应用于非人类自治 AI 代理和数字员工 | 定制开源及内部 LLM 代理的生产覆盖深度 |
模块规格和运营角色汇总自 Exabeam 官方平台文档及技术产品评测；多租户云 SLA 保证仍属保密信息。
[CE001, CE002, CE003, CE006]六层架构栈展示从企业遥测摄入到智能体式协同调查和统一威胁响应的演进。
- 1. 数据收集与摄入
- 超过 7,000 个预构建日志解析器和云采集器，每秒最多处理 2 百万个事件并写入 Exabeam 通用信息模型（CIM）。
- 2. 云存储与数据湖
- 弹性云安全数据湖提供 30 天热搜索索引、长期合规留存，并支持跨客户存储库的联合搜索。
- 3. 行为分析与基线
- 跟踪用户和资产状态，基于人类身份与非人类实体 90 天的日志构建动态行为基线。
- 4. 动态风险评分引擎
- 机器学习异常量化引擎根据统计稀有性、同伴群组和资产关键性，分配上下文感知风险评分（0–100）。
- 5. Exabeam Nova 智能体层
- 六个专用 AI 智能体（调查、搜索、可视化、威胁评分、分析师助手、顾问）自主执行分流和自然语言查询。
- 6. SOC 威胁中心与响应
- 统一分析师工作台整合告警、重要事件、智能时间线和低代码剧本，并接入超过 650 个第三方安全工具。
层级反映云原生 New-Scale Fusion 部署；本地部署的 LogRhythm 将云分析与本地存储设备解耦。
[CE001, CE002, CE004, CE006, CE009, CE011]5.2 行为分析引擎、标准化与多智能体 AI
行为分析引擎用动态基线替代静态规则 [CE001, CE008]，日志映射至 CIM 并补充身份、资产和网络上下文 [CE004]；系统在初始 90 天训练期建立基线，再按异常稀有度和业务上下文更新风险分。2025 年，Nova 的六个智能体自动分诊、威胁狩猎和合成时间线 [CE006]；公司称每班节省三小时、生产率最高提升 80% [CE007]。2026 年 ABA 将建模扩展到 Claude、ChatGPT、Copilot 等非人实体 [CE009]。
| 用户安全任务 | 传统 SOC 工作流 | Exabeam 平台方案 | 可衡量的运营收益 | 技术限制 / 边界 |
|---|---|---|---|---|
| 受损凭据检测 | 手动关联分散的 VPN 与 Active Directory 登录告警 | 通过状态跟踪把登录、异常地理位置和资产跳转串成风险评分 | 无需静态关联规则即可高保真检测横向移动 | 需要至少 30 至 90 天的基线日志数据，才能准确刻画异常 |
| 内部威胁与数据外泄 | 终端 DLP 告警被孤立标记，误报率很高 | 行为基线关联实体门禁、异常文件复制和非工作时间传输 | 准确区分恶意内部人员与合法管理员工作流 | 依赖覆盖 HR 和实体门禁数据源的广泛数据连接器 |
| 告警分诊与事件调查 | 分析师手动查询 SIEM 索引、整理电子表格并重建时间线 | Exabeam Nova 调查和搜索代理自动组装智能证据时间线 | 据报道调查时长减少 50%，每名分析师每班次节省 3 小时 | 自治分诊准确率取决于预先调优的上下文身份数据 |
| AI 代理漂移与滥用监控 | 企业使用 LLM 无监控，对自治代理没有任何行为可见性 | Agent Behavior Analytics 跟踪各 LLM 中的提示词、工具调用和异常数据访问 | 主动治理企业代理式工作流并自动发出漂移告警 | 目前连接器主要覆盖大型企业 LLM 平台 |
用例工作流和量化节省时间数据来自 Exabeam 技术文档及 2026 年 Cybersecurity Excellence Awards 申报数据。
[CE004, CE005, CE007, CE008]5.3 数据摄取管道、采集器规模与生态广度
云采集器可处理超过 200 万 EPS，配有逾 7,000 个日志解析器 [CE002, CE005]；平台与逾 650 个安全工具双向集成，包括 CrowdStrike、SentinelOne、Microsoft Defender 和 ServiceNow [CE002, CE010]。摄取数据驱动逾 2,500 条检测规则和机器学习模型 [CE010]；低代码自动化及 MCP 端点支持无需手写脚本的遏制与跨厂商编排 [CE007, CE011]。
| 架构层 | 核心组件 / 机制 | 主要运营角色 | 系统依赖 | 技术风险 / 瓶颈 |
|---|---|---|---|---|
| 数据摄取与规范化 | 云采集器、syslog 监听器和通用信息模型（CIM） | 以线速通过 7,000+ 个解析器解析、规范化并丰富遥测数据 | 客户网络出口、云 API 配额和 syslog 转发器 | 第三方日志格式变化时的解析器漂移和模式维护负担 |
| 行为分析与建模 | 状态用户跟踪和机器学习风险引擎 | 建立统计行为基线并分配具备上下文感知的风险评分 | Active Directory / 身份同步和持续日志训练数据流 | 新用户生成初始 30 至 90 天基线时存在冷启动延迟 |
| 代理式智能与自动化 | Exabeam Nova 多代理编排和低代码剧本 | 执行自治证据收集、分诊和自然语言调查 | 底层基础 LLM 推理 API 和经 CIM 规范化的索引 | 高严重性事件同时发生时，推理 API 延迟激增或触及速率限制 |
| 分析师运营与响应 | Threat Center 工作台、案件管理和 650+ 个工具连接器 | 集中管理事件响应、证据时间线和自动修复 | 第三方 EDR / 防火墙 API 响应能力和 webhook 交付 | 第三方集成目标的凭据过期或 API 版本弃用 |
架构组件源自 Exabeam 技术文档、合作伙伴数据表和平台 规格说明；延迟指标反映标准云托管部署。
[CE001, CE002, CE006, CE010]5.4 信任、合规认证与双平台尽调缺口
New-Scale Fusion 具备 SOC 2 Type II、ISO 27001、ISO 27017、ISO 27018 合规，并完成澳大利亚政府 PROTECTED 级 IRAP 评估 [CE012]；遥测加密，客户日志不用于训练第三方或共享基础模型 [CE014]，公司因此入选 2025 Gartner SIEM 魔力象限领导者 [CE013]。但 2024 年 7 月并购后同时维护云端 New-Scale 和本地 LogRhythm，带来双代码库开销及功能滞后风险 [CE003]。
5.5 案例
06客户
6.1 客户分层、买方画像与部署路径
2024 年 7 月合并后，客户分为采用云原生 New-Scale 的现代企业团队和运行自托管 LogRhythm 的传统组织 [CU001]。买方主要是受监管行业的 CISO、SOC 经理和安全架构负责人，集中在金融、医疗、制造、政府和高等教育 [CU003]。Exabeam 提供 Fusion 全平台现代化路径，也提供可叠加 Splunk 或 Microsoft Sentinel 的 Analytics 路径，避免一次性替换 [CU013]。
| 客户细分 | 买方 / 主要用户 | 核心部署 / 用例 | 规模与遥测画像 | 收入与战略价值 | 关键尽调缺口 |
|---|---|---|---|---|---|
| 大型企业 SOC（云原生） | CISO / SecOps 副总裁 | 通过 New-Scale Fusion 完整替换 SIEM | 在混合多云环境中每天摄取 >10 TB | ACV 最高的订阅；形成长期平台锁定 | 净扩展率和多年合同留存率未披露 |
| 企业 SIEM 增强型客户 | 安全运营总监 / 首席架构师 | 在 Splunk 或 Sentinel 上叠加 UEBA 和 ABA | 分析数千个终端上的用户 / 实体异常 | 高毛利分析附加组件，避免替换原系统的摩擦 | 从分析叠加层转为完整 Fusion SIEM 的转化率尚未验证 |
| 传统 LogRhythm 本地部署客户基础 | 基础设施安全经理 / 合规官 | 为满足数据驻留和合规要求而自托管 LogRhythm SIEM | 数百个网络和服务器日志源在本地物理隔离 | 经常性维护收入高，但新增增长低 | 强制云迁移周期中的流失风险 |
| 托管安全服务提供商（MSSP） | MSSP 合作伙伴业务负责人 / SOC 主管 | 多租户威胁检测与共同管理的 SIEM 交付 | 汇总监控数十个客户环境的日志 | 借助渠道杠杆扩大区域企业覆盖 | 合作伙伴利润分成和共同管理 SLA 依赖 |
Exabeam 和 LogRhythm 客户画像的事实细分，综合自官方部署指南、 产品能力文档及 MSSP 合作伙伴分析。
[CU001, CU003, CU013]6.2 采用轨迹、日遥测规模与 AI 速度
合并后的组织服务逾 3,000 家全球企业，部分客户每天摄取超过 10TB 日志 [CU002, CU010]。2025—2026 年 Nova 自动关联攻击信号、建立实体基线并加速分诊 [CU004]；把 Tier 1 分析师通常需要五小时的复杂调查压缩到约十分钟，为生产账户带来运营 ROI [CU004]。
| 指标 / 增长指标 | 报告值 | 观察日期 | 来源归属 | 置信度 | 战略含义 | 缺失分母 / 限定条件 |
|---|---|---|---|---|---|---|
| 全球企业客户基础 | 企业客户数 >3,000 | 2026-10-01 | Exabeam Corporate Release | 中 | 规模可观的存量客户基础带来交叉销售机会 | 云端 New-Scale 订阅客户与本地 LogRhythm 维护客户的拆分数据未披露 |
| 企业日志摄取规模 | >10 TB/天 | 2026-01-15 | Exabeam SIEM Architecture Guide | 中 | 高遥测量加深运营集成和转换成本 | 客户中每天运行 >10 TB 与低于 TB 级档位的占比未说明 |
| Nova AI 分诊加速 | ~10 分钟 vs 5 小时（快 30 倍） | 2026-10-01 | Exabeam SecOps Benchmark | 中 | 可衡量的 SOC 分析师人力节省有助于支撑平台续约价值 | 厂商内部运营测量；缺少独立第三方客户审计 |
| 分析师生产力提升 | 最高提升 80% | 2025-04-01 | Exabeam Nova Launch Disclosure | 高 | 加强企业续约谈判中的经济 ROI 论证 | 基于厂商对自动案件关联的建模，而非经审计的客户遥测数据 |
运营规模指标、客户基础披露和工作流速度指标汇总自公司公告及技术出版物。
[CU002, CU004, CU010]6.3 具名客户部署与可验证生产结果
Mastronardi Produce、E-Global 和 MTI 案例显示，Nova 摘要、快速发布和持续增强带来效率验证 [CU005, CU007, CU008, CU009]；Lumifi、The Missing Link 等 MSSP 用可定制 UEBA 提供多租户 MDR [CU006, CU007]。Mastronardi 称摘要减轻负担并将分诊时间减半 [CU005]，E-Global 称分析师更快排序关键事件且保留人工判断 [CU009]。
| 客户组织 | 行业细分 | 部署与用例 | 生产环境 vs 试点 | 报告结果 / 运营收益 | 尽调限制 |
|---|---|---|---|---|---|
| Mastronardi Produce | 商业食品生产与供应链 | 在 New-Scale 平台上使用 Exabeam Nova 进行告警关联 | 生产环境 | 自动案件摘要减轻分析师负担，并将分诊时间减半 | 具体合同规模、许可档位和多年承诺条款未披露 |
| The Missing Link | 托管安全服务提供商（MSSP） | New-Scale Analytics 与行为 UEBA 建模 | 生产环境 | 率先在客户环境中定制行为模型 | 客户终身价值和客户留存率未公开 |
| MTI Ltd. | IT 服务与移动内容提供商 | New-Scale Fusion 云原生 SIEM 与 TDIR | 生产环境 | 平台每日持续更新，功能快速改进 | 部署范围限于基础设施系统部门；对全公司 ARR 的影响未披露 |
| E-Global | 金融服务与交易处理 | 使用 Exabeam Nova AI 进行威胁优先级排序和案件上下文分析 | 生产环境 | 调查速度显著提升，并能优先分诊机器速度的威胁 | 具体摄取量和定价表因厂商私有条款未披露 |
已验证企业部署的事实清单，引用公开归属的案例研究和高管陈述。
[CU005, CU007, CU008, CU009]6.4 留存韧性、合并整合摩擦与流失风险
现代 New-Scale 客户满意度较强，但旧存量仍有留存风险 [CU011, CU012, CU014]。LogRhythm 在 2025 Gartner 魔力象限中不再独立出现，2024 年并购后，长期创新已转向云端 [CU001, CU012]；旧客户的 AIE 规则不能无缝迁到 UEBA，必须重调；公司仍维护至 7.21 [CU012]。在企业平均管理 76 个安全工具却只使用 20% 能力的环境里，迁移摩擦可能把客户推向 Microsoft Sentinel 或 Securonix [CU014]。
展示企业从初始 SIEM 摄入或 UEBA 增强，到全平台整合和智能体式 SOC 部署的采用顺序与扩张路径。
基于技术文档、部署模式和客户参考资料，对客户旅程阶段进行示意性综合。
[CU001, CU004, CU013]6.5 案例
07风险
7.1 高管风险分类与治理态势
2024 年 7 月 17 日与 LogRhythm 合并后，Exabeam 定位为 AI 驱动 SIEM/UEBA 厂商，但面临执行、运营和资本治理风险。Thoma Bravo 控股造成治理集中并使退出时间、杠杆和再投资承诺不透明；合并前 Exabeam 于 2023 年 10 月裁员约 20%，反映增长阻力和竞争压力。整合双重组织、保持工程速度和分析师满意度，是运营逻辑的核心脆弱点。[CR004, CR007, CR008, CR013]
展示核心监管、运营、合作伙伴和财务风险的严重性、可能性、缓解成熟度与残余暴露矩阵。
定性风险评级综合分析师评论、已发布的合并披露和技术文档。
[CR006, CR008, CR013]7.2 监管合规、数据主权与法律要求
Exabeam 受 NIS2、DORA 和美国 SEC Form 8-K 网络安全披露规则约束，必须在压缩窗口内检测、记录和报告入侵。数据主权法规要求受监管客户把遥测留在指定地域；SOC 2 Type II、ISO 27001、GDPR 技术控制、自动审计日志和内部威胁追踪可缓解暴露面。[CR001, CR002, CR003, CR012]
| 风险 / 监管 | 司法辖区 | 状态 | 可能性 | 严重性 | 缓解措施 | 剩余暴露 | 尽调路径 |
|---|---|---|---|---|---|---|---|
| 欧盟 NIS2 与 DORA 指令 | 欧盟 | 正在执行 | 高 | 高 | 自动生成可供审计的合规报告，并执行事件响应测试工作流 | 中 | 审计欧洲客户通知 SLA 日志和渗透测试记录 |
| 跨境数据主权与 GDPR | 全球 / 欧盟 / 美国 | 现行法规 | 中 | 高 | 通过 LogRhythm SIEM 混合本地部署，并在区域云中实现数据本地化 | 中 | 审阅欧盟数据处理协议和跨境传输评估 |
| SEC 网络安全披露规则（Form 8-K / Item 1.05） | 美国 | 现行规则 | 中 | 中 | Exabeam Nova AI 10 分钟分诊和自动化数据泄露影响时间线关联 | 低 | 检查事件升级时间线和重大性判定剧本 |
| 安全认证（SOC 2 Type II、ISO 27001） | 全球 | 已认证 | 低 | 中 | 持续合规监控、年度独立第三方审计和 Privacy Shield 对齐 | 低 | 审阅最新未删节的 SOC 2 Type II 审计师报告和例外测试 |
监管和法律风险按严重性排序，依据法规执行力度、数据隐私 要求及截至 2026 年 10 月的公开合规披露。
[CR001, CR002, CR003, CR004]7.3 运营可靠性、迁移摩擦与安全失效模式
LogRhythm 并入带来运营和留存风险。2025 Gartner 魔力象限不再列出独立 LogRhythm，客户终将面对迁移；自托管 7.21 等维护版仍受支持，但把多年 AIE 规则转成 UEBA 模型会制造摩擦并给竞品评估窗口。处理每日数十 TB 日志的多租户管道还暴露于摄取峰值、成本上升和遥测中断。[CR005, CR006, CR010, CR011]
7.4 伙伴依赖、资本结构与投资逻辑破裂触发条件
Exabeam 依赖 Thoma Bravo 的资本配置、基础设施主机及 MSSP/共管伙伴；UnderDefense 等伙伴帮助客户过渡、保持规则连续性并提供 24/7 监督。Nova 还依赖外部基础模型和 AI 插件。若旧 LogRhythm 客户年流失率超过 15%、核心管道长期跨区域中断，或数据驻留限制阻止国际扩张，投资逻辑将被打破。[CR004, CR009, CR013, CR014]
| 依赖项 | 交易对手方 | 角色 | 集中度 | 失败情景 | 严重性 | 缓解措施 | 残余暴露 |
|---|---|---|---|---|---|---|---|
| 主要财务赞助方 | Thoma Bravo | 私募股权所有者与资本提供方 | 高 | 被迫流动性事件、股息再融资或激进加杠杆 | 高 | 战略治理委员会与长期私募股权增长承诺 | 高 |
| 云基础设施托管 | 公有云提供商（AWS / GCP） | 云原生计算、对象存储与 SaaS 托管 | 高 | 区域性云中断、API 破坏性变更或计算利润率被压缩 | 中 | 多区域架构、容器化微服务，以及通过 LogRhythm 实现的混合本地部署兜底 | 中 |
| 联合管理与渠道合作伙伴 | MSSP 与系统集成商（如 UnderDefense） | 部署、联合管理与告警监控渠道 | 中 | 渠道合作伙伴去中介化，或转向竞争性的 XDR / SIEM 厂商 | 中 | 合作伙伴赋能计划、厂商无关 API 与社区 MCP 服务器集成 | 低 |
| AI 模型与 LLM 生态 | Anthropic / OpenAI 基础模型 | 为 Exabeam Nova 和 CLI 插件提供第三方 LLM 推理 | 中 | API 限流、模型弃用，或外部提示词导致的数据隐私泄露 | 中 | 本地 MCP 服务器查询执行、提示词标准化与严格的厂商 DPA | 低 |
按严重性排列的合作伙伴与依赖风险，涵盖财务赞助方控制、云托管基础设施、渠道合作伙伴和 AI 生态提供商。
[CR004, CR013, CR014]7.5 案例
08估值
8.1 融资历史与当前估值背景
Exabeam 于 2021 年 6 月完成由 Blue Owl Capital 领投的 $200M Series F 融资，投后估值为 $2.4B，由此确立了其私募市场基准估值。公司历史上共完成 8 轮股权融资，累计募资约 $390M–$393M，投资方包括 Lightspeed Venture Partners、Cisco Investments 和 Norwest Venture Partners 等一线风险投资与成长资本机构。2024 年 7 月，Exabeam 与同为安全运营服务商的 LogRhythm 完成里程碑式合并，交易由私募股权赞助商 Thoma Bravo 和少数股权投资者 Francisco Partners 支持。此次交易将 Exabeam 的云原生用户行为分析与 LogRhythm 成熟的企业客户基础整合到 Exabeam 这一品牌之下。对成长阶段和二级市场投资者而言，$2.4B 的合并前估值提供了锚定参考。考虑到扩大的企业规模和私募股权资本支持，这一估值水平被评为合理：它既反映了显著的市场扩张，也计入了公司没有公开财务披露这一事实。[CV001, CV002, CV003, CV004, CV010, CV013]
| 评估维度 | 评估 / 评级 | 关键证据与分析依据 | 投资含义 |
|---|---|---|---|
| 建议 | 买入 | LogRhythm 合并后，公司在 UEBA 和 AI 驱动 SIEM 领域保持领先的独立地位。 | 在成长期二级市场或联合投资银团中逐步建立敞口。 |
| 信心 | 中 | 强劲的产品与市场覆盖，抵消因素是私人公司财务信息未披露。 | 只有在验证客户留存基础后，才能确定仓位规模。 |
| 风险评级 | 中 | 旧版本地部署维护义务，以及双平台迁移摩擦。 | 监测 LogRhythm 续约群组和客户满意度信号。 |
| 估值立场 | 公允 | 最近一次私募投后估值为 $2.4B，相对同业倍数处于均衡水平。 | 保持纪律，将入场倍数门槛设在预估经常性收入的 8.0x 以下。 |
综合核心尽调维度、估值基准和投资含义，反映合并后实体的整体画像。
[CV001, CV003, CV004, CV008, CV013]8.2 投资论点与反论点
核心投资论点在于 Exabeam 作为 AI 驱动安全运营领导者的技术差异化。Exabeam Nova 将智能体式人工智能和机器学习注入行为建模，持续提供上下文辅助，加快威胁检测、调查和响应。与此同时，与 LogRhythm 的合并立刻打开了面向全球数千家已部署安全运营中心的交叉销售引擎。反论点则聚焦关键运营与过渡风险：公司既要支持自托管的 LogRhythm 安装，又要维护云原生 Exabeam 平台，双重架构会分散大量工程资源，并让产品路线图彼此牵制。第三方分析师记录了客户对支持连续性和产品长期生命周期的担忧。此外，LogRhythm 没有以独立品牌出现在 2025 年 Gartner SIEM 魔力象限中，也凸显了品牌逐步退出的风险。投资者需要权衡客户覆盖面扩大的上行空间，以及传统客户评估云替代方案时可能出现的流失。[CV003, CV006, CV007, CV008, CV009, CV011, CV012]
| 视角 | 核心论点 | 支持证据与市场背景 | 改变论点的触发因素 |
|---|---|---|---|
| 论点：智能体式 AI 领导力 | Nova 平台和行为建模以机器速度自动完成分流与上下文收集。 | Exabeam Nova 在分析师工作流中提供覆盖全平台的上下文辅助。 | 客户采用停滞，或无法取代旧式基于规则的检测引擎。 |
| 论点：规模化客户基础 | LogRhythm 的并入立即带来向数千个安全团队交叉销售的空间。 | 合并后实体将 LogRhythm 的数据摄入与 Exabeam 的威胁检测结合起来。 | 客户流失过高，或旧客户拒绝迁移到云端。 |
| 反论点：整合开销 | 同时维护自托管和云架构会消耗工程资本，并拖慢研发。 | UnderDefense 的评测指出，支持承诺和产品路线图仍然分裂。 | 统一云端路线图明显加速，并迅速淘汰旧 SKU。 |
| 反论点：财务不透明 | 私募股权结构使 ARR、现金消耗和净留存率不受外部审计。 | Thoma Bravo 和 Exabeam 都未披露合并后的独立财务结果。 | 独立审计财务披露，或正式提交 IPO 招股说明书。 |
对合并后公司增长驱动因素与运营、竞争脆弱性的平衡评估。
[CV003, CV007, CV008, CV011]8.3 情景分析与回报周期
在三年持有期内比较 Exabeam 的乐观、基准和悲观情景，可见上行潜力不对称，但整合障碍会形成约束。乐观情景下，传统客户快速迁移到云端，推动年经常性收入（ARR）增长超过 25%，毛利率同步提升；公司通过上市或战略并购，以 9.0x 至 10.0x 收入倍数实现 $4.0B 至 $4.5B 的退出估值。基准情景下，客户留存率稳定在 90% 以上，Nova 获得中等程度采用，ARR 实现中十几百分点增长，企业估值以 7.0x 至 8.0x 倍数达到 $2.8B 至 $3.2B。悲观情景则假设传统客户流失率上升，同时云端 SIEM 超大规模厂商带来的竞争压力加剧，企业价值收缩至 $1.5B 至 $1.8B。结合可比上市网络安全公司的估值和私募交易倍数，对纪律严明的成长资本而言，从基准走向乐观的路径提供了有吸引力的风险调整后上行空间。[CV001, CV008, CV010, CV013, CV014]
| 情景 | 核心运营假设 | 估值与回报画像 | 主要下行触发因素 | 概率权重 |
|---|---|---|---|---|
| 乐观情景 | LogRhythm 客户基础快速迁移至云端；ARR 年增长超过 25%；毛利率达到 75%。 | 企业估值升至 $4.0B–$4.5B（9.0x–10.0x ARR）；通过 IPO 或战略出售实现 1.7x–1.9x MOIC。 | 超大规模云厂商取代 SIEM，或 Splunk / Cisco 激进压价。 | 25% |
| 基准情景 | 留存稳定（超过 90%）；稳步迁移至 Nova；ARR 保持十几个百分点的增长；私募股权维持现金流纪律。 | 企业估值达到 $2.8B–$3.2B（7.0x–8.0x ARR）；通过赞助方再融资实现 1.2x–1.3x MOIC。 | 被迫升级本地部署期间客户流失上升；新客户获取乏力。 | 55% |
| 悲观情景 | LogRhythm 客户流失率超过 15%；输给云原生 SIEM；收入持平。 | 估值收缩至 $1.5B–$1.8B（4.5x–5.5x ARR）；倍数下压并进行重组。 | 云基础设施发生重大中断；大量客户转投 Microsoft Sentinel。 | 20% |
对 3 年持有期内的运营轨迹、估值区间和主要下行触发因素进行情景分析。
[CV001, CV008, CV010, CV013, CV014]8.4 战略综合判断与尽调建议
Exabeam 获得“买入”建议，置信度为中等，估值判断为合理。公司在用户与实体行为分析领域拥有较难防守的知识产权，并在私募股权整合后获得了规模化的市场进入能力。首席执行官 Christopher O'Malley 和首席财务官 Barry Capoot 领导的管理层展现了经过验证的运营纪律。不过，合并后的净收入留存率、分部毛利率等详细指标仍是高度保密的私有数据，潜在投资者应严格约束进入估值。尽调应优先验证传统 LogRhythm 客户群的留存率，并监测其向云原生 Nova 平台迁移的转化速度。客户流失意外激增或云迁移速度停滞，都应视为明确的论点失效触发条件。[CV003, CV004, CV005, CV006, CV008, CV013]
端到端分析决策链，将市场规模、AI 差异化、合并执行、运营风险和估值连接到最终建议。
| 节点 / 连接 | 节点 / 起点 | 终点 | 说明 |
|---|---|---|---|
| 节点 1 | 市场规模与 UEBA 领导力 [n1] | 在行为分析与安全运营领域处于领先地位。 | |
| 节点 2 | AI 原生 Nova 差异化 [n2] | 云原生平台迁移与智能体式 SOC 自动化能力。 | |
| 节点 3 | LogRhythm 合并执行 [n3] | 将数据摄入规模与既有客户基础的交叉销售结合。 | |
| 节点 4 | 整合与流失风险 [n4] | 管理双架构支持，缓解客户迁移摩擦。 | |
| 节点 5 | 估值与倍数纪律 [n5] | 以 $2.4B 基线对照私募股权赞助方支持进行基准比较。 | |
| 节点 6 | 买入建议（公允立场） [n6] | 长期风险回报有利，但取决于留存稳定。 | |
| 连接 1 | 市场规模与 UEBA 领导力 [n1] | AI 原生 Nova 差异化 [n2] | 促成 |
| 连接 2 | AI 原生 Nova 差异化 [n2] | LogRhythm 合并执行 [n3] | 通过……扩张 |
| 连接 3 | LogRhythm 合并执行 [n3] | 整合与流失风险 [n4] | 受……制约 |
| 连接 4 | 整合与流失风险 [n4] | 估值与倍数纪律 [n5] | 提供依据 |
| 连接 5 | 估值与倍数纪律 [n5] | 买入建议（公允立场） [n6] | 得出结论 |
将战略输入映射至投资立场的逻辑流程。
[CV001, CV003, CV004, CV006, CV008, CV013]8.5 展示项
免责声明
本报告是基于公开证据的尽调快照，不构成投资建议。重要的财务、法律、技术和合同事实仍未公开，任何投资决策前都应直接向管理层并通过一手文件核实。
证据索引
| 编号 | 陈述 | 可信度 | 来源 |
|---|---|---|---|
| CO001 | Exabeam was founded in 2013 by Nir Polak and cybersecurity executives in Foster City, California, originally developing big-data security log analytics. | 高 | SO002, SO006 |
| CO002 | Exabeam attained a $2.4 billion post-money valuation after closing a $200 million Series F funding round in June 2021 led by Blue Owl Capital's Owl Rock division. | 中 | SO006 |
| CO003 | Prior to its 2024 merger, Exabeam raised approximately $390 million in total equity financing across six funding rounds beginning in 2014. | 中 | SO006 |
| CO004 | Former Exabeam chief executive officer Michael DeCesare had previously led cybersecurity firm ForeScout Technologies through its 2017 initial public offering. | 中 | SO006 |
| CO005 | Founding CEO Nir Polak transitioned to Chairman of the Board upon Michael DeCesare's appointment as CEO in 2021. | 中 | SO006 |
| CO006 | LogRhythm instituted a commitment to quarterly software releases across cloud-native and on-premises SIEM in July 2022 that was retained following the merger. | 中 | SO005 |
| CO007 | Private equity firm Thoma Bravo announced its intention to merge portfolio company LogRhythm with Exabeam in May 2024 to unite SIEM log ingestion with behavioral AI. | 高 | SO005, SO007 |
| CO008 | Exabeam and LogRhythm completed their merger on July 17, 2024, forming a combined organization operating under the Exabeam brand across 22 countries with Thoma Bravo as majority owner. | 高 | SO005, SO008 |
| CO009 | LogRhythm ceased to appear as an independent vendor name in the 2025 Gartner SIEM Magic Quadrant, reflecting complete market consolidation under the Exabeam brand. | 中 | SO008 |
| CO010 | Exabeam shipped version 7.21 general availability for self-hosted LogRhythm SIEM in July 2025 to sustain on-premises compliance and data residency commitments. | 中 | SO008 |
| CO011 | In January 2026, Exabeam introduced Agent Behavior Analytics to baseline and monitor non-human generative AI agent activity alongside human user behavioral profiles. | 高 | SO003, SO010 |
| CO012 | Exabeam achieved the top score of 90.6 and led all 21 evaluation criteria in CRN's 2026 Annual Report Card for the AI Security category. | 中 | SO004 |
| CO013 | On October 1, 2026, Exabeam announced general availability for its Agentic SOC architecture, introducing persistent Nova AI investigation and an enterprise customer footprint exceeding 3,000 organizations. | 高 | SO001, SO009 |
| CO014 | Pete Harteveld serves as Chief Executive Officer of Exabeam, leading executive management following earlier roles as Chief Revenue Officer and M&A integration leader. | 中 | SO002 |
| CO015 | Steve Wilson serves as Chief AI and Product Officer at Exabeam, guiding Nova agent design and the OWASP GenAI security framework. | 高 | SO002, SO003 |
| CM001 | The global SIEM market is valued at USD 10.67 billion and is projected to reach USD 20.78 billion by 2031, growing at a compound annual growth rate of 11.5%. | 高 | SM001, SM002 |
| CM002 | On-premises SIEM deployments represented 55.27% of total market revenue in 2025, while cloud deployments are expanding at a faster 12.84% CAGR through 2031. | 中 | SM001 |
| CM003 | Next-generation SIEM requirements defined by industry analysts mandate combining log management with User and Entity Behavior Analytics (UEBA) and Security Orchestration, Automation, and Response (SOAR). | 中 | SM002 |
| CM004 | Modern security operations platforms ingest high-volume telemetry by separating storage and compute architectures, normalizing data via common information models across hundreds of vendor products. | 高 | SM003, SM004 |
| CM005 | Regulatory frameworks including the European NIS2 Directive, DORA, and U.S. SEC cybersecurity disclosure rules require timely incident reporting and rigorous security log retention. | 中 | SM001 |
| CM006 | Exabeam and LogRhythm completed their merger in July 2024 to unite SIEM and UEBA capabilities under Thoma Bravo ownership, operating under the Exabeam company brand. | 中 | SM006, SM008 |
| CM007 | Exabeam introduced Agent Behavior Analytics and AI co-investigator capabilities in 2026 to monitor non-human AI agents alongside human analysts within the security operations center. | 高 | SM003, SM005 |
| CM008 | Self-hosted LogRhythm SIEM remains supported through the 7.21 release, while primary net-new platform innovation is directed toward the cloud-native New-Scale platform. | 中 | SM008 |
| CM009 | Chief Information Security Officers and enterprise security leaders serve as primary economic buyers for SIEM platforms, prioritizing detection efficacy, regulatory compliance, and analyst productivity. | 中 | SM002 |
| CM010 | Exabeam partners with managed security service providers and solution distributors to deliver AI-driven security monitoring, threat detection, and co-managed SOC services across enterprise customers. | 中 | SM005 |
| CM011 | Exabeam achieved a $2.4 billion private valuation following its 2021 Series F funding round, positioning its advanced analytics platform to capitalize on enterprise data migration to cloud data lakes. | 中 | SM006, SM009 |
| CM012 | Large enterprise environments frequently ingest over 10 terabytes of security telemetry daily from endpoints, SaaS applications, and network infrastructure, necessitating scalable storage and tiered retention. | 中 | SM001 |
| CM013 | Transitioning from legacy correlation-based SIEM to behavioral analytics requires significant re-tuning of rule sets and models, creating friction and switching costs during platform migration. | 中 | SM008 |
| CM014 | User reviews of security automation tools indicate that pricing tier limitations on workflow execution and the need for extensive data fine-tuning constrain automated SOC orchestration. | 中 | SM007 |
| CP001 | Exabeam and LogRhythm completed their merger on July 17, 2024, creating a combined cybersecurity entity operating under the Exabeam brand under Thoma Bravo ownership. | 高 | SP004, SP008, SP009 |
| CP002 | Exabeam Nova embeds six purpose-built AI agents into the security operations center workflow to automate log analysis, anomaly detection, risk scoring, and response orchestration. | 高 | SP003, SP006 |
| CP003 | Competitor Palo Alto Networks argues that Exabeam's UEBA models require ongoing manual parameter tuning that creates rule sprawl and analyst triage fatigue at scale. | 中 | SP001 |
| CP004 | Exabeam maintains a dual-platform strategy comprising its cloud-native New-Scale Fusion platform and its self-managed on-premises LogRhythm SIEM architecture. | 高 | SP006, SP008, SP009 |
| CP005 | Palo Alto Networks positions Cortex XSIAM against Exabeam by emphasizing machine learning alert grouping, index-free data architecture, and converged SIEM, SOAR, and XDR capabilities. | 中 | SP001 |
| CP006 | On-premises SIEM installations represented 55.27% of overall market share in 2025, while cloud deployments were projected to grow at a 12.84% CAGR through 2031. | 中 | SP005 |
| CP007 | In the 2025 Gartner SIEM Magic Quadrant, LogRhythm ceased to appear as an independent evaluated vendor name for the first time, reflecting brand consolidation under Exabeam. | 中 | SP008, SP009 |
| CP008 | Migrating from self-hosted LogRhythm to Exabeam New-Scale Fusion requires rule re-tuning because LogRhythm uses fact-based AIE correlation rules while New-Scale uses behavioral UEBA baselines. | 中 | SP009 |
| CP009 | Exabeam New-Scale Fusion connects with over 1,000 security tools through prebuilt APIs and provides a Model Context Protocol (MCP) server for external agentic workflows. | 中 | SP006 |
| CP010 | Exabeam claims its post-merger entity is the largest dedicated independent vendor operating exclusively in the SIEM and security operations market. | 高 | SP004, SP007 |
| CP011 | Competitors and practitioners report that traditional SIEM architectures face performance bottlenecks and search delays during peak event-per-second ingestion periods. | 中 | SP001 |
| CP012 | SOC automation practitioners report that deploying advanced AI orchestration tools requires substantial contextual data tuning to prevent inaccurate alert triage. | 中 | SP010 |
| CP013 | Exabeam committed to quarterly release cycles across both cloud-native and on-premises offerings, releasing self-hosted LogRhythm 7.21 in 2025. | 高 | SP004, SP009 |
| CP014 | Audited customer renewal rates, net revenue retention, and migration conversion rates among legacy LogRhythm accounts post-merger are not publicly disclosed. | 低 | |
| CI001 | Exabeam publicly offers both cloud-native New-Scale products and a continuing self-hosted LogRhythm SIEM product. | 高 | SI003, SI005, SI006, SI008, SI010 |
| CI002 | Exabeam says New-Scale Fusion can augment an existing SIEM or replace it, supporting a modular adoption and expansion path. | 中 | SI008 |
| CI003 | A 2026 independent directory reports that Exabeam licensing is driven by daily data-ingest volume, with reseller SKUs sized in gigabytes per day and no published list pricing. | 中 | SI002 |
| CI004 | Exabeam says New-Scale supports third-party storage, federated search, data-pipeline management, search-in-place, and lower-cost storage options. | 高 | SI007, SI008 |
| CI005 | An October 2026 Exabeam release says the company is trusted by more than 3,000 enterprises worldwide. | 中 | SI004 |
| CI006 | Exabeam reports that its own security operations team measured Nova AI triage at about 10 minutes per average case versus five hours for a human analyst. | 中 | SI004 |
| CI007 | Exabeam says its latest capabilities are designed to move analysts from alert to resolution faster without adding headcount. | 中 | SI004 |
| CI008 | The 2024 merger created a combined cloud-native and on-premises product portfolio, and the company committed to quarterly launches across both deployment models. | 高 | SI005, SI010 |
| CI009 | UnderDefense argues that LogRhythm remains supported but net-new investment is shifting toward New-Scale, while migration can require re-tuning and contract-entitlement review. | 中 | SI009 |
| CI010 | The retained public evidence does not disclose current Exabeam revenue, ARR, revenue growth, gross margin, NRR, or churn. | 中 | SI001, SI002, SI003, SI004, SI005, SI006, SI007, SI008, SI009, SI010 |
| CI011 | The retained public evidence does not disclose revenue mix, recognition policy, realized pricing, discounts, sales-cycle length, CAC, or payback. | 中 | SI002, SI003, SI004, SI007, SI008, SI009 |
| CI012 | The retained public evidence does not disclose current cash, accounting loss, operating cash burn, runway, debt facilities, covenants, planned use of funds, or a next-round trigger. | 中 | SI001, SI002, SI004, SI005, SI010 |
| CI013 | A 2026 directory reports that Exabeam had raised more than $400 million across multiple historical funding rounds, which does not establish cash currently available. | 低 | SI002 |
| CI014 | Thoma Bravo lists Exabeam as a portfolio company with an investment year of 2018, establishing sponsor affiliation but not current liquidity. | 中 | SI001 |
| CI015 | Ingest-linked licensing can expand with customer telemetry, while federated search, pipeline controls, and lower-cost storage can reduce the billable data base and create pricing tension. | 中 | SI002, SI007, SI008 |
| CI016 | Exabeam's modular and usage-linked model may support recurring revenue, but public evidence is insufficient to underwrite revenue quality, margin path, unit economics, or capital intensity. | 中 | SI001, SI002, SI008, SI009 |
| CE001 | Exabeam delivers an AI-driven security operations platform that combines cloud-native SIEM, user and entity behavior analytics, and security orchestration and automation into a unified analyst experience. | 高 | SE001, SE007 |
| CE002 | The Exabeam New-Scale Fusion platform unifies Security Information and Event Management, behavioral analytics, dynamic risk scoring, and automation in a cloud-native software-as-a-service architecture. | 高 | SE002, SE007 |
| CE003 | Exabeam packages its product portfolio into cloud-native modules including New-Scale SIEM, New-Scale Analytics, Outcomes Navigator, and NetMon alongside self-hosted LogRhythm SIEM and LogRhythm Intelligence platforms. | 中 | SE006 |
| CE004 | Exabeam's data pipeline normalizes incoming security telemetry from hundreds of sources at ingestion using a Common Information Model to power threat detection and behavioral analytics. | 高 | SE002, SE003 |
| CE005 | The New-Scale Fusion platform collects data through prebuilt cloud collectors processing more than 2 million events per second with over 7,000 prebuilt log parsers. | 中 | SE002 |
| CE006 | Exabeam Nova operates as an embedded multi-agent AI framework featuring six specialized agents—Investigation, Search, Visualization, Threat Scoring, Analyst Assistant, and Advisor—integrated across security operations workflows. | 中 | SE003, SE004 |
| CE007 | Exabeam claims the Nova AI co-investigator reduces incident investigation times by 50% and improves security analyst productivity by up to 80% while saving three hours per shift on alert triage. | 中 | SE003, SE004 |
| CE008 | Exabeam's behavioral analytics engine builds baseline models of normal user, asset, and peer group behavior from 90 days of historical logs to detect anomalous activities that static correlation rules miss. | 高 | SE001, SE008 |
| CE009 | In 2026 Exabeam introduced Agent Behavior Analytics to extend behavioral baselining and anomaly detection to autonomous AI agents including Claude Enterprise, ChatGPT, Google Gemini, and Microsoft Copilot. | 中 | SE003, SE004 |
| CE010 | Exabeam's integration architecture supports data ingestion from more than 650 third-party security products with more than 2,500 pre-built behavioral models and rules to detect anomalies. | 中 | SE001 |
| CE011 | Threat Center unifies alert management, automated evidence collection, timeline generation, and response playbooks into a single analyst workbench. | 高 | SE001, SE007 |
| CE012 | Exabeam New-Scale Fusion holds compliance certifications including SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018, and completed an IRAP assessment at the PROTECTED level for Australian public-sector workloads. | 中 | SE002 |
| CE013 | Exabeam was recognized as a Leader in the 2025 Gartner Magic Quadrant for Security Information and Event Management. | 中 | SE002, SE004 |
| CE014 | Exabeam enforces platform-level trust controls by providing end-to-end data encryption and ensuring enterprise customer data is never used to train shared external AI models. | 中 | SE004 |
| CU001 | Exabeam provides cloud-native New-Scale Security Operations Platform and self-managed LogRhythm SIEM across parallel product tracks for diverse enterprise infrastructure architectures. | 高 | SU001, SU006 |
| CU002 | Enterprise organizations commonly ingest more than 10 terabytes of log data daily across cloud services, endpoints, SaaS tools, and operational technology. | 中 | SU005 |
| CU003 | Exabeam's core enterprise customer base spans financial services, government, healthcare, higher education, and manufacturing verticals requiring compliance and threat detection. | 中 | SU006 |
| CU004 | Exabeam Nova autonomous AI delivers multi-agent case investigation and behavioral pattern correlation to accelerate security analyst triage. | 高 | SU002, SU006 |
| CU005 | Mastronardi Produce deployed Exabeam Nova to automatically generate contextualized security case summaries and reduce alert triage burden for security operations analysts. | 中 | SU002 |
| CU006 | Managed security services provider Lumifi partners with Exabeam to deliver AI-assisted threat investigation and actionable contextual insights for SOC analysts. | 中 | SU002 |
| CU007 | Managed service provider The Missing Link deployed Exabeam UEBA to customize behavioral modeling and gain deep insights across enterprise client environments. | 中 | SU003 |
| CU008 | Japanese IT services provider MTI Ltd. utilizes Exabeam New-Scale Fusion to maintain continuous operational upgrades and accelerate threat detection, investigation, and response. | 中 | SU007 |
| CU009 | Mexican electronic transaction processor E-Global deployed Exabeam Nova AI to prioritize security incidents and improve triage efficiency without displacing human analysts. | 中 | SU009 |
| CU010 | Following the July 2024 merger with LogRhythm under Thoma Bravo ownership, the combined operating entity reported serving more than 3,000 enterprise customers worldwide. | 中 | SU009 |
| CU011 | In the 2025 Gartner SIEM Magic Quadrant, LogRhythm ceased to appear as an independent vendor brand, reflecting brand consolidation under Exabeam. | 中 | SU004 |
| CU012 | Existing self-hosted LogRhythm customers face migration friction and rule re-tuning requirements when transitioning years of customized correlation rules to Exabeam New-Scale. | 中 | SU004 |
| CU013 | Exabeam offers New-Scale Analytics as an augmentation overlay for customers wishing to keep existing SIEM data lakes like Splunk or Microsoft Sentinel without a full rip-and-replace. | 中 | SU001, SU003 |
| CU014 | Enterprise security teams manage an average of 76 security tools while utilizing approximately 20% of owned feature capabilities, creating integration fatigue across the SIEM customer base. | 中 | SU004 |
| CR001 | European NIS2 and U.S. SEC cybersecurity disclosure rules mandate timely incident reporting and rigorous event log retention for regulated enterprise environments. | 中 | SR009 |
| CR002 | International data sovereignty legislation requires organizations to process and store telemetry data within designated geographical regions, complicating global cloud SIEM deployments. | 中 | SR006 |
| CR003 | Exabeam New-Scale Fusion maintains certified compliance with ISO 27001, SOC 2 Type II, and European GDPR data protection requirements. | 中 | SR007 |
| CR004 | Exabeam completed its merger with LogRhythm on July 17, 2024, operating under the Exabeam brand under majority private equity ownership by Thoma Bravo. | 高 | SR002, SR004 |
| CR005 | The standalone LogRhythm brand was sunset in the 2025 Gartner SIEM Magic Quadrant, concentrating long-term roadmap investment into the cloud-native Exabeam New-Scale platform. | 中 | SR002 |
| CR006 | Migrating from on-premises LogRhythm SIEM to Exabeam New-Scale requires enterprise customers to re-tune existing AIE correlation rules into UEBA behavioral models, introducing operational transition friction. | 中 | SR002 |
| CR007 | Prior to the merger, Exabeam executed an approximate 20% global workforce reduction in October 2023 amid slowing growth in its standalone SIEM and SOAR product lines. | 中 | SR001 |
| CR008 | Industry analysts from Forrester highlighted that both Exabeam and LogRhythm faced persistent difficulties transitioning customers to cloud architectures and keeping pace with market innovation prior to merging. | 中 | SR001 |
| CR009 | Exabeam introduced Nova AI autonomous investigation capabilities in October 2026, claiming internal case triage times dropped from five hours to approximately ten minutes. | 中 | SR003 |
| CR010 | Exabeam maintains an on-premises deployment tier via LogRhythm SIEM alongside its cloud-native New-Scale SaaS architecture to mitigate customer churn among air-gapped and data-residency-constrained buyers. | 中 | SR003, SR006 |
| CR011 | Enterprise SIEM environments face rising telemetry scaling pressure as large organizations ingest more than ten terabytes of security logs per day from cloud, endpoint, and operational systems. | 中 | SR009 |
| CR012 | Insider threat mitigation platforms utilize automated permission audits and centralized compliance audit logging to detect privilege escalation across enterprise identity systems. | 中 | SR008 |
| CR013 | Thoma Bravo and Francisco Partners maintain controlling private equity governance over Exabeam following the 2024 transaction without publicly disclosing fund exit timelines or recapitalization horizons. | 高 | SR002, SR005 |
| CR014 | Exabeam relies on co-management Managed Security Service Providers such as UnderDefense to maintain customer rule continuity and prevent operational disruptions during post-merger migrations. | 中 | SR002 |
| CV001 | Exabeam completed a $200 million Series F financing round on June 1, 2021, establishing a $2.4 billion post-money private valuation. | 高 | SV002, SV003 |
| CV002 | Exabeam has raised cumulative equity funding of approximately $390 million to $393 million across its financing rounds prior to its private equity merger. | 中 | SV001, SV002 |
| CV003 | Exabeam and LogRhythm entered into a definitive merger agreement in May 2024 and formally completed the transaction on July 17, 2024. | 高 | SV006, SV007 |
| CV004 | The merged organization operates under the Exabeam corporate name and brand with private equity ownership from Thoma Bravo and Francisco Partners. | 中 | SV005, SV007 |
| CV005 | Following the merger closing, Christopher O'Malley was appointed Chief Executive Officer and Barry Capoot was named Chief Financial Officer of the combined company. | 中 | SV007 |
| CV006 | Former Exabeam CEO Michael DeCesare positioned the company long-term expansion toward a multi-billion dollar destiny in the broad security operations category. | 中 | SV003 |
| CV007 | Exabeam product strategy emphasizes an agentic security operations center (SOC) that combines cloud-native SIEM, user behavior analytics, and automated investigation assistance. | 中 | SV008, SV009 |
| CV008 | Industry analysts identify post-merger operating frictions, including the risk of customer attrition as self-hosted LogRhythm customers evaluate cloud migration timing. | 中 | SV005 |
| CV009 | The independent LogRhythm brand ceased appearing in the 2025 Gartner Magic Quadrant for SIEM, signaling the consolidation of product roadmaps under the Exabeam banner. | 中 | SV005 |
| CV010 | Pre-merger public offering expectations targeting a 2024 listing date were deferred following the private equity transaction with Thoma Bravo. | 中 | SV001, SV003 |
| CV011 | Enterprise customers deploy Exabeam Nova as an analyst assistance layer that follows security workflows and automates background threat context retrieval. | 中 | SV008 |
| CV012 | Security research highlights autonomous AI agents as an emerging insider risk category requiring behavioral analytics and continuous activity inspection. | 中 | SV010 |
| CV013 | At a baseline valuation of $2.4 billion, Exabeam valuation stance is assessed as fair given its combined scale, private equity sponsorship, and AI-driven growth trajectory. | 中 | SV001, SV002, SV007 |
| CV014 | Peer comparisons against public security analytics vendors indicate enterprise value multiples ranging between 6.0x and 10.0x for growth-stage cloud SIEM and observability providers. | 中 | SV001, SV004 |
| 编号 | 出版方 | 标题 | 引文 |
|---|---|---|---|
| SO001 | Exabeam | Exabeam | Cybersecurity & Compliance with Security Log Management and SIEM | Whether it’s insider threat defense for users and agents, securing AI adoption across your enterprise. or advanced threat detection, investigation, and response (TDIR) powered by AI and automation, Exabeam has you covered. |
| SO002 | Exabeam | About Us | Exabeam | Pete Harteveld is the Chief Executive Officer of Exabeam, where he leads with a steadfast commitment to customer success, innovation, and sustained business growth. |
| SO003 | Exabeam | New-Scale Fusion | Exabeam | This data sheet explains how New-Scale Fusion brings SIEM, user and entity behavior analytics (UEBA), Agent Behavior Analytics (ABA), and automated response into one cloud-native platform. |
| SO004 | Exabeam | What CRN’s 2026 Annual Report Card Says About the Next Phase of AI Security | In the AI Security category, Exabeam earned the top overall score at 90.6, leading all four subcategories and every one of the 21 individual evaluation criteria. |
| SO005 | Business Wire | Exabeam and LogRhythm Complete Merger and Announce New Company Details | The company will retain the Exabeam name and refresh the visual brand to represent the merging of two industry leaders and honor the legacy of the long-established LogRhythm brand. |
| SO006 | SDxCentral | $2.4B Valuation Shows ‘How Big Exabeam Can Be,’ CEO DeCesare Says | The latest funding round, led by the Owl Rock division of Blue Owl Capital and supported by existing investors Acrew Capital, Lightspeed Venture Partners, and Norwest Venture Partners, brings Exabeam’s total raised to $390 million over six funding rounds beginning in 2014. |
| SO007 | SC Magazine UK | Thoma Bravo Announces Intention to Merge LogRhythm and Exabeam | Thoma Bravo has announced the intention to merge its SIEM vendor LogRhythm with Exabeam, a rival provider of log management services. |
| SO008 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger | The signal worth watching: 2025 was the first Gartner SIEM Magic Quadrant where “LogRhythm” no longer appeared as an independent name. |
| SO009 | FinancialContent | The Agentic SOC, Delivered: Exabeam Accelerates AI-Powered Security Operations to Machine Speed | As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. |
| SO010 | Cybersecurity Excellence Awards | Exabeam New-Scale Security Operations Platform | At the core of the platform is Exabeam Nova, launched in April 2025 as the industry’s first and only multi-agent AI capability integrated throughout the entire security operations workflow. |
| SM001 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | According to recent market research, the global SIEM market is expanding steadily. It is valued at USD 10.67 billion and is projected to reach USD 20.78 billion by 2031, growing at a CAGR of 11.5%. |
| SM002 | Exabeam | SIEM Tools: Top 5 SIEM Platforms, Features, Use Cases and TCO | Gartner’s 2024 Magic Quadrant for SIEM report selected five solutions for the Leader’s Quadrant: Exabeam – Exabeam Fusion SIEM, previously known as SaaS Cloud, is available as a SaaS in hybrid and local co-deployment. |
| SM003 | Exabeam | AI Innovation | Exabeam Nova is a platform-wide AI co-investigator that follows analysts throughout the console. It automates background context collection, secondary searches, and triage, so your team can detect, investigate, and respond faster. |
| SM004 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | New-Scale Fusion is a cloud-native platform that combines New-Scale SIEM and New-Scale Analytics in one experience. It applies behavioral analytics, dynamic risk scoring, automation, and AI-driven investigation to help security teams detect, investigate, and respond to threats faster. |
| SM005 | Yahoo Finance / Business Wire | The Agentic SOC, Delivered: Exabeam Accelerates AI-Powered Security Operations to Machine Speed | The evolution toward an agentic SOC is less about removing analysts from the process and more about changing where their time and judgment are applied... As AI agents take on more investigation, context gathering, and repetitive execution, security teams can focus human expertise on the decisions that matter most. |
| SM006 | Wikipedia | Exabeam | The merger was finalized in July 2024... named as the CEO of the newly combined company operating under the Exabeam name. |
| SM007 | PeerSpot | Compare Exabeam vs NetWitness NDR | Thus, we had to do significant fine-tuning regarding what data context we provided to the AI orchestrator to get meaningful results. |
| SM008 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger | LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. Self-hosted LogRhythm SIEM continues as a supported product, with the 7.21 release shipping in 2025. The signal worth watching: 2025 was the first Gartner SIEM Magic Quadrant where “LogRhythm” no longer appeared as an independent name. |
| SM009 | SDxCentral | $2.4B Valuation Shows ‘How Big Exabeam Can Be,’ CEO DeCesare Says | All the on-prem systems, the SIEMs, the data lakes that have grown up for 20 years on prem are all moving into Snowflake, and [Amazon Web Services], and [Microsoft] Azure, usually for ROI purposes. And Exabeam took perfect advantage of that movement happening. |
| SP001 | Palo Alto Networks | Best Exabeam Alternatives: Top Competitors in 2026 | Exabeam's behavioral analytics foundation delivers real value for insider threat detection and user behavior analysis. But as security operations mature, teams running Exabeam at scale tend to hit a consistent set of friction points. |
| SP002 | CyberCompare | Exabeam - CyberCompare | Exabeam provides an industry-leading, cloud-delivered, SIEM platform that delivers value on week, combining the scale and power of the cloud with the strength of our industry-leading behavioral analytics and automation, organizations gain a more holistic view of security incidents, uncover anomalies missed by other tools, and achieve faster, more accurate and repeatable responses.. |
| SP003 | Exabeam | Agentic AI Tools: Key Capabilities and 10 Tools to Know in 2026 | Exabeam Nova is a combination of six AI agents that are purpose-built for security operations centers (SOCs). It combines multiple specialized agents that can analyze logs, detect anomalies, score risk, and recommend or initiate response actions. |
| SP004 | Business Wire | Exabeam and LogRhythm Complete Merger and Announce New Company Details | The merger combines unparalleled technological innovation with reliable data to create an AI-driven security operations platform that delivers the most efficient and accurate security information and event management (SIEM) and user and entity behavior analytics (UEBA) solutions in the industry. |
| SP005 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | On-premises SIEM systems still held 55.27% of the market share in 2025. However, cloud deployments are growing faster, with a projected CAGR of 12.84% through 2031. |
| SP006 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | New-Scale Fusion combines New-Scale SIEM and New-Scale Analytics in a modular platform. It unifies log management, SIEM, behavioral analytics, dynamic risk scoring, and automation. Use it to replace your SIEM or augment your current system with advanced analytics and automation to detect insider threats, reduce manual work, and meet compliance goals. |
| SP007 | Exabeam | The “New” Exabeam: Brand Evolution for our Next Phase of Innovation and Growth | Exabeam is now the largest, fully dedicated, independent vendor in the SIEM and security operations space. We are incredibly excited to bring together two cybersecurity SIEM and UEBA innovation leaders with renowned and demonstrated track records in serving customers with effective threat detection, investigation, and response (TDIR) – now under one unified Exabeam organization. |
| SP008 | Exabeam | Exabeam | Cybersecurity & Compliance with Security Log Management and SIEM | Whether it’s insider threat defense for users and agents, securing AI adoption across your enterprise. or advanced threat detection, investigation, and response (TDIR) powered by AI and automation, Exabeam has you covered. |
| SP009 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger | LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. Self-hosted LogRhythm SIEM continues as a supported product, with the 7.21 release shipping in 2025. The signal worth watching: 2025 was the first Gartner SIEM Magic Quadrant where “LogRhythm” no longer appeared as an independent name. |
| SP010 | PeerSpot | Compare Exabeam vs NetWitness NDR | Automation has streamlined multi-tenant SOC workflows and improves alert handling efficiency ... Thus, we had to do significant fine-tuning regarding what data context we provided to the AI orchestrator to get meaningful results. |
| SI001 | Thoma Bravo | Exabeam | Year Invested 2018 |
| SI002 | Artificial Intelligence Companies | Exabeam – AI Cybersecurity Profile & Pricing [2026] | Licensing follows SIEM economics and is driven by daily data-ingest volume, with reseller SKUs sized in gigabytes per day and no published list pricing, so forecasting ingest growth is the main cost exercise before signing |
| SI003 | Exabeam | New-Scale Security Operations Platform | The New-Scale Security Operations Platform unifies cloud-native SIEM and analytics into an AI-driven solution for threat detection, investigation, and response, automating investigations with context-aware risk scoring, playbooks, and visualizations. |
| SI004 | Exabeam via Business Wire | The Agentic SOC, Delivered: Exabeam Accelerates AI-Powered Security Operations to Machine Speed | As measured by our own security operations team, Nova AI triaged an average case in approximately 10 minutes — 30 times faster than the five hours a human analyst would typically require. |
| SI005 | LogRhythm and Exabeam via Thoma Bravo | LogRhythm and Exabeam Announce Intent to Merge | Customers will benefit from enhanced R&D investments and product innovation, greater service and support coverage and access to a larger AI-driven product portfolio, including cloud-native and on-premises options. |
| SI006 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | As a next-gen SIEM, Exabeam Fusion is a cloud-delivered solution that uses a behavior-based approach for Threat Detection, Investigation, and Response (TDIR). |
| SI007 | Exabeam | Cybersecurity & Compliance with Security Log Management and SIEM | Control costs with advanced data pipeline management that allows you to search data in place and leverage low-cost storage. |
| SI008 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | New-Scale Fusion combines New-Scale SIEM and New-Scale Analytics in a modular platform. It unifies log management, SIEM, behavioral analytics, dynamic risk scoring, and automation. Use it to replace your SIEM or augment your current system with advanced analytics and automation to detect insider threats, reduce manual work, and meet compliance goals. |
| SI009 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger | “Supported” means the vendor fixes bugs, ships patches, and answers your tickets. Exabeam put that commitment in writing for LogRhythm SIEM customers, and the 7.21 general-availability release in July 2025 is real proof, not a press line. “Invested in” means net-new capability, and that energy is clearly flowing toward the cloud-native New-Scale platform. |
| SI010 | Exabeam and LogRhythm via Business Wire | Exabeam and LogRhythm Complete Merger and Announce New Company Details | The company remains committed to quarterly launches to its cloud-native and on-premises SIEM offerings as demonstrated by LogRhythm since July 2022. |
| SE001 | Howard Technology Solutions | The Exabeam Security Operations Platform | Pre-built integrations are powered by ingestion from more than 650 third-party security products, more than 2,500 pre-built rules and behavioral models which automatically learn normal user and device behavior to detect, prioritize, and respond to anomalies based on risk. |
| SE002 | Security Stack | Exabeam New-Scale Fusion Security Operations Platform | Security Stack | The platform collects data through prebuilt collectors that process more than 2 million events per second and over 7,000 prebuilt log parsers, normalizing it at ingestion with a Common Information Model. |
| SE003 | Exabeam | AI Innovation | Exabeam Nova is a platform-wide AI co-investigator that follows analysts throughout the console. It automates background context collection, secondary searches, and triage, so your team can detect, investigate, and respond faster. |
| SE004 | Cybersecurity Excellence Awards | Exabeam New-Scale Security Operations Platform | At the core of the platform is Exabeam Nova, launched in April 2025 as the industry’s first and only multi-agent AI capability integrated throughout the entire security operations workflow. Unlike passive AI assistants, Exabeam Nova provides six specialized AI agents: Investigation, Search, Visualization, Threat Scoring, Analyst Assistant, and Advisor. |
| SE005 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | As a next-gen SIEM, Exabeam Fusion is a cloud-delivered solution that uses a behavior-based approach for Threat Detection, Investigation, and Response (TDIR). By aggregating all relevant events and weeding out illegitimate events, Fusion SIEM boosts analyst productivity and detects threats missed by other tools. |
| SE006 | Exabeam | Exabeam | Cybersecurity & Compliance with Security Log Management and SIEM | Whether it’s insider threat defense for users and agents, securing AI adoption across your enterprise. or advanced threat detection, investigation, and response (TDIR) powered by AI and automation, Exabeam has you covered. |
| SE007 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | New-Scale Fusion is a cloud-native platform that combines New-Scale SIEM and New-Scale Analytics in one experience. It applies behavioral analytics, dynamic risk scoring, automation, and AI-driven investigation to help security teams detect, investigate, and respond to threats faster. |
| SE008 | Exabeam Documentation Portal | What is Exabeam? | Exabeam Documentation Portal | The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR. Exabeam builds a layer of intelligence from the logs collected in an environment either through a SIEM platform or directly ingested via Syslog. |
| SU001 | Kandi Brian | Exabeam: A Technical Guide to the Behavioral Analytics-First Security Operations Platform | Kandi Brian | The merged company operates under the Exabeam name and maintains two product lines in parallel: the cloud-native New-Scale Security Operations Platform for organizations moving to or already on cloud architectures, and the LogRhythm SIEM for organizations that need a mature, self-managed on-premises deployment. |
| SU002 | Business Wire | Exabeam Nova Unleashes the Future of Agentic AI in Cybersecurity | The ability to automatically generate meaningful, accurate case summaries lifts a massive burden off our analysts and gives them back time to focus on what matters most: stopping threats. |
| SU003 | Exabeam | UEBA | Exabeam | No other technology provides insights and behavioral model customization like Exabeam. They pioneered user and entity behavior analytics (UEBA). |
| SU004 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger: Keeping Your Rules, Retention, and Audit Continuity | LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. Self-hosted LogRhythm SIEM continues as a supported product, with the 7.21 release shipping in 2025. |
| SU005 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | Large enterprises now ingest more than 10 TB of logs per day from endpoints, cloud services, SaaS platforms, and operational technology. This growth requires scalable storage models such as tiered retention and streaming analytics pipelines. |
| SU006 | Exabeam | Exabeam | Cybersecurity & Compliance with Security Log Management and SIEM | Machine-speed threats demand more than reactive response. Exabeam uses AI, behavioral analytics, and intelligent agents to accelerate security operations. |
| SU007 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | Using Exabeam reminded me of how surprisingly fast the platform updates. There is an almost daily improvement on desired functions, and with Exabeam, it all keeps getting better. |
| SU008 | Exabeam | Best Threat Intelligence Solutions: Top 8 Platforms in 2026 | The global threat intelligence market is expanding rapidly. It is valued at USD 6.87 billion and is expected to grow to USD 31.58 billion by 2034, with a CAGR of 18.30%. |
| SU009 | FinancialContent | The Agentic SOC, Delivered: Exabeam Accelerates AI-Powered Security Operations to Machine Speed | Exabeam Nova AI has helped us prioritize cases more effectively, giving our analysts faster access to the context they need to make confident decisions. |
| SR001 | SDxCentral | SIEM and UEBA vendors LogRhythm and Exabeam to merge, analysts express mixed feelings | Both of these companies have faced challenges in recent years that are not solved by a merger: difficulty keeping pace with market innovation and with the transition to the cloud |
| SR002 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger: Keeping Your Rules, Retention, and Audit Continuity | LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. |
| SR003 | Morningstar | The Agentic SOC, Delivered: Exabeam Accelerates AI-Powered Security Operations to Machine Speed | Exabeam advances the Agentic SOC with new AI-driven investigation, execution, visibility, and governance capabilities that keep analysts in control. |
| SR004 | Business Wire | Exabeam and LogRhythm Complete Merger and Announce New Company Details | The company will retain the Exabeam name and refresh the visual brand to represent the merging of two industry leaders and honor the legacy of the long-established LogRhythm brand. |
| SR005 | Thoma Bravo | LogRhythm, Exabeam Announce Intent to Merge Their Strengths | The merger is expected to close in the third quarter of 2024 and is subject to regulatory approvals and customary closing conditions. |
| SR006 | Exabeam | Best SIEM Tools: Top 6 Solutions in 2026 | Data sovereignty laws add complexity, as organizations must store and process data within specific regions. |
| SR007 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | New-Scale Fusion meets ISO 27001 and SOC 2 Type II standards and aligns with Privacy Shield principles. |
| SR008 | Exabeam | Best Insider Threat Products: Top 5 in 2026 | Compliance reporting capabilities ensure that organizations can meet internal and external regulatory requirements for data handling and monitoring. |
| SR009 | Exabeam | Best SIEM Solutions: Top 11 SIEM systems and How to Choose 2026 | Frameworks such as the European NIS2 Directive and the U.S. SEC cybersecurity disclosure rules require timely incident reporting and proper log retention. |
| SV001 | Investing in the Web | Exabeam IPO: Revenue, Investors, Valuation & How to Invest | Total Funding $391 million USD IPO Date 2024 (expected) Valuation estimate $2.4 billion USD |
| SV002 | Tracxn | Exabeam - 2026 Company Profile & Team | Its latest funding round was a Series F round on Jun 01, 2021 for $200M. |
| SV003 | SDxCentral | $2.4B Valuation Shows 'How Big Exabeam Can Be,' CEO DeCesare Says | Exabeam this week announced that it closed a $200 million late-stage funding round on a $2.4 billion valuation and hired a new CEO: Michael DeCesare |
| SV004 | Silicon Valley Investment Club | Exabeam — Funding, Valuation & Leadership | Valuation (Apr 2021) $2.4B Headquarters US Investors 32 |
| SV005 | UnderDefense | Co-Managing LogRhythm After the Exabeam Merger: Keeping Your Rules, Retention, and Audit Continuity | LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. |
| SV006 | Thoma Bravo | LogRhythm, Exabeam Announce Intent to Merge Their Strengths | The combined company will bring together two cybersecurity SIEM and UEBA innovation leaders with renowned and demonstrated track records in serving customers |
| SV007 | Business Wire | Exabeam and LogRhythm Complete Merger and Announce New Company Details | The combined organization will empower customers with a best-of-breed, AI-driven security operations platform fortified with high-integrity data ingestion |
| SV008 | Exabeam | Exabeam New-Scale Fusion Security Operations Platform | Exabeam Nova is now a platform-wide sidebar that follows analysts across screens and preserves context. |
| SV009 | Exabeam | Exabeam | Cybersecurity & Compliance with Security Log Management | Exabeam Accelerates AI-Powered Security Operations to Machine Speed |
| SV010 | Exabeam | The Agentic Insider: From Monitoring to Understanding | The rise of AI agents as a new class of insider risk |