LogRhythm
SIEM and security analytics vendor, now a product line inside Thoma Bravo-owned Exabeam.
The call
LogRhythm's installed base still pays the bills, but Microsoft's bundled Sentinel and a shrinking workforce are squeezing the runway while its future gets folded into New-Scale.
Exabeam sells software that watches computer networks for security threats and stores logs (the record of what happened on a system). It got this business from buying LogRhythm in mid-2024. The company is hard to replace because customers have spent years setting it up, training it to spot their specific problems, and connecting it to their other tools. But Microsoft, Palo Alto, and others are fighting back by bundling similar tools into packages they already sell, and newer companies like Databricks and Datadog are building simpler cloud-based versions from scratch instead of upgrading old technology. The real question is whether Exabeam can convince customers to stick around and pay for its newer cloud product instead of just using what came bundled with software they already buy, especially while the company is cutting staff and preparing to sell itself to a new owner.
Why
01
AI pressure: Databricks Lakewatch, Datadog Cloud SIEM, AI-agentic SOC triage tools. AI-native lakehouse SIEMs and autonomous triage agents threaten to replace the log parsing and correlation work LogRhythm sells. Could AI do the core job? Only partly.
02
Bigger players: Microsoft Sentinel (bundled in E5), Palo Alto Cortex XSIAM, Cisco/Splunk. Sentinel ships free inside E5 licenses customers already own, undercutting renewal economics for standalone SIEM tools like LogRhythm. Could a giant copy it? Yes, easily.
03
What protects it. 7,000+ prebuilt log parsers, compliance-driven switching costs, and UEBA baselines that took years to tune.
What would change this call
Thoma Bravo announces IPO or sale of Exabeam within 6-18 months. Shows whether the PE owner sees enough value to exit profitably or is forced into a distressed sale.
Exabeam headcount count in future Revelio Labs or LinkedIn data releases. Reveals whether the 44% workforce decline since 2023 has stabilized or is still accelerating.
LogRhythm on-prem SIEM roadmap announcements or end-of-life notices vs New-Scale investment. Confirms whether legacy SIEM customers face forced migration or deprecation risk.
Exabeam headcount count in future Revelio Labs or LinkedIn data releases. Reveals whether the 44% workforce decline since 2023 has stabilized or is still accelerating.
LogRhythm on-prem SIEM roadmap announcements or end-of-life notices vs New-Scale investment. Confirms whether legacy SIEM customers face forced migration or deprecation risk.
Key numbers
- Headcount fell 43.8%, from 1,471 to 827
- Job postings down 46.6% YoY (28 vs 45)
- Revenue estimates range $96.5M to $176.7M (unverified)
Named risks
- Headcount fell 43.8% since 2023 with no confirmed floor, signaling ongoing restructuring strain.
- Core SIEM workflows (parsing, correlation, triage) are increasingly automatable by AI-native and agentic entrants.
- Uncertain PE exit path; IPO or sale within 6 to 18 months as of May 2026 with unclear employee equity outcome.
- Legacy LogRhythm on-prem SIEM product line at risk of deprecation as strategy shifts to New-Scale.
- Microsoft Sentinel E5 bundling pressures pricing and renewal rates against Exabeam.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Microsoft Sentinel | gaining on | Bundled into E5 licenses customers already pay for, called single largest structural pricing threat, 2026 |
| Palo Alto Cortex XSIAM | gaining on | Consolidated-platform competitor cited directly against Exabeam in 2026-03-31 comparison guide |
| Cisco/Splunk | contesting | Post-acquisition consolidation cited as incumbent pressure on SIEM market, 2026 |
| Databricks Lakewatch | gaining on | Cited as emerging lakehouse-native SIEM entrant challenging legacy architecture, 2026 |
| Datadog Cloud SIEM | contesting | Listed as cloud-native adjacent entrant in competitor comparisons, 2026 |
Questions people ask
- Is LogRhythm still an independent company?
- No. LogRhythm merged with Exabeam on July 17, 2024, and the combined company now operates under the Exabeam name, majority-owned by Thoma Bravo, with LogRhythm SIEM continuing as a product line.
- Is LogRhythm (Exabeam) laying off employees?
- Yes. Revelio Labs data shows the combined workforce fell from about 1,471 in 2023 to 1,032 in 2024 to 827 by Q4 2025, a 43.8% cumulative decline, with job postings down 46.6% year-over-year in 2025.
- Who owns LogRhythm now?
- Thoma Bravo, which took a majority stake in LogRhythm in July 2018, became majority owner of the merged Exabeam entity after the July 2024 LogRhythm-Exabeam merger, with former Exabeam venture investors retaining minority stakes.
- Could AI replace LogRhythm's SIEM analysts?
- Core SOC tasks like log parsing, correlation-rule writing and Tier-1 alert triage are increasingly automatable. Exabeam responded by launching the Nova gen-AI SOC agent in October 2025 and Agent Behavior Analytics in April 2026 to stay ahead of AI-native rivals.
- Who is LogRhythm's biggest competitor?
- Microsoft Sentinel, bundled into Microsoft E5 licenses many enterprise customers already pay for, is described as the largest structural pricing threat, alongside Cisco/Splunk and Palo Alto Cortex XSIAM as of 2026.
- Will LogRhythm SIEM be discontinued?
- Not yet as of July 2026, LogRhythm SIEM v7.25 shipped that month with new AI Engine API endpoints, but the company's stated strategy is to standardize customers on cloud-native Exabeam New-Scale, creating ongoing product-line deprecation risk for legacy on-prem users.
Timeline
- 2026-06-24LogRhythm SIEM v7.25 GA ships with AI Engine API endpoints and Intelligence Sync Service to New-Scale
- 2026-04-23Agent Behavior Analytics shipped with native ChatGPT, Copilot, Gemini log ingestion
- 2026-01Data Indexer support for CentOS 7 and RHEL 7 ended with v7.23
- 2025-10-15Exabeam named Gartner Magic Quadrant SIEM Leader for sixth time
- 2025-10CEO Chris O'Malley retires, replaced by Pete Harteveld; Exabeam Nova gen-AI agent launched
- 2025-09-30LogRhythm SIEM v7.22 GA released with multi-cluster log forwarding
- 2024-07-17Exabeam and LogRhythm complete merger under Exabeam name, Thoma Bravo majority owner
- 2024-05LogRhythm and Exabeam announce merger, Exabeam valued at approximately $2.5B at last mark
- 2018-07Thoma Bravo acquires majority stake in LogRhythm
- 2005Company rebrands and relocates from Washington D.C. to Boulder, Colorado
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Exabeam and LogRhythm Complete Merger and Announce New Company Details (2024-07-17)
- CEO Chris O'Malley on Why LogRhythm, Exabeam Opted to Merge (2024-07-17)
- $96.5M Est. ARR, $289.4M Valuation (2025-09-17)
- Exabeam - Overview, News & Similar companies (2026-06-17)
- Exabeam Number of Employees 2026 (2026-06-29)
- 7.22.0 GA Release Notes (2025-09-30)
- 7.25.0 GA Release Notes (2026-06-24)
- Exabeam Named a Leader in the 2025 Gartner Magic Quadrant for SIEM for the Sixth Time (2026-07-12)
- What's New (2026-04-23)
- Exabeam is Named a Leader in the 2025 Gartner Magic Quadrant for SIEM (2025-10-15)
- Revenue, Investors, Valuation & How to Invest (2026-05-27)
- Best Exabeam Alternatives: Top Competitors in 2026