Sumo Logic released its 2025 Security Operations Insights report at the AWS Summit in Washington, DC. Based on a survey of more than 500 IT and security leaders, the report reveals that a majority are reevaluating their SIEM strategies, with AI and cloud-native scale emerging as top priorities for enabling more modern, adaptive security operations.

"Security teams today are balancing fast-changing threats, growing data volumes, and rising demands for operational efficiency," said Chas Clawson, Security CTO at Sumo Logic. "Our research confirms that even organizations confident in their current solutions' adaptability are exploring new options, prioritizing AI-powered, cloud-native solutions that unify detection, automation, and context. It marks a shift towards Intelligent Security Operations, where AI enhances visibility and accelerates response, with the ultimate goal of shrinking resolution time to near zero." 

The report, developed in partnership with independent research firm UserEvidence, surfaces the evolving priorities of security leaders as they evaluate the next generation of SIEM solutions. Key findings include:

SIEM remains critical, but security leaders are demanding more from their tools:

• Nine out of ten respondents still consider the SIEM approach relevant for safeguarding their organization, and one-third say enhancing threat detection and response is their top cybersecurity priority this year. 
• Even among those who are confident in their current SIEM, 75% still say they are considering alternative solutions like AI-powered cloud-native solutions to keep up with emerging threats and help modernize their SOC.
• Concerns around vendor lock-in remain high, with 95% of those evaluating new options citing flexibility as a critical factor. This highlights a growing demand for adaptable, intelligent platforms.
• Integration challenges are also widespread: 50% of leaders report difficulty aligning legacy SIEM tools with their broader technology stack, fueling interest in solutions with pre-built integrations and faster time to value.

AI is reshaping how security leaders evaluate the future of SIEM:

• AI is now a leading factor in the buying process, with 90% reporting that it is extremely or very important in their decision to purchase a new security solution.
• Confidence in SIEM capabilities increasingly depends on intelligent tooling, with 70% of security leaders saying AI shapes their trust in current and future solutions.
• 34% of respondents report a reduction in average incident response time when using AI playbooks, signaling real performance gains as automation becomes more embedded in SecOps.
• Security teams are also prioritizing built-in automation and intelligence: 84% rate integrated SOAR as important or extremely important, and 85% cite out-of-the-box threat intelligence integration as essential for improving detection accuracy and accelerating decisions.

Customers around the world rely on Sumo Logic Cloud SIEM to help detect, investigate, and respond to threats faster through the power of real-time data and logs-first intelligence. These report findings align with what Sumo Logic customers are experiencing as they begin to prioritize AI-powered, cloud-native solutions that unify detection, automation, and context.

"We needed a solution that could scale with our AWS environment and reduce the noise from legacy systems," said John Sacchetti, Director of Security at Destination XL. "Sumo Logic's cloud-native platform and AI-driven insights have helped us improve detection accuracy, streamline response, and gain the visibility we were missing in our previous SIEM."

The 2025 Security Operations Insights report reflects these same industry shifts and offers a snapshot of how security leaders are rethinking their SIEM, prioritizing platforms that align with the demands of modern security. As teams seek to reduce complexity, improve visibility, and respond with greater speed and precision, the findings underscore the growing need for more intelligent, automated, and integrated operations.