Key Takeaways<\/p>\n
- \n
- Detection engineering is not a tool question, but a discipline.<\/strong> Wazuh + Sigma + Shuffle do not replace a SIEM; they replace a specific operating model. Those who fail to build the discipline will face the same problems as they did with the more expensive vendor.<\/li>\n
- NIS2 requires auditability, not vendor conformity.<\/strong> Open-source stacks meet the requirements if the audit trail is documented. The hurdle lies in the internal effort, not in the choice of tools.<\/li>\n
- The TCO calculation is not trivial.<\/strong> License costs drop, but FTE effort rises \u2013 often not a net gain for small teams. From three senior detection engineers onwards, the stack becomes economically viable.<\/li>\n<\/ul>\n<\/div>\n
Related<\/span>NIS2 Audit: Vendor list breaks in 2h<\/a> \/<\/span> Adaptive MFA: NIS2 pressure as a lever<\/p>\n
Why vendor lock-in in the SIEM market is becoming an operational risk<\/h2>\n
SIEM renewals in DACH mid-sized companies and corporations have followed a pattern over the last 18 months. License costs are rising by double digits, EPS limits are tightening, and logging volume is growing faster than budgets due to cloud workloads. Those who signed a contract in 2018 are often paying double in 2026 for nominally the same architecture.<\/p>\n
Vendor lock-in is not just a cost issue. Once you have maintained 2,000 detection rules in a proprietary query language, you cannot switch without friction. This is precisely what makes detection engineering a discipline that must be anchored in the operating model, not in a vendor contract. Those who postpone this will pay for three years of negligence at renewal time.<\/p>\n
Hybrid cloud is not an architectural pattern, but the consequence of two teams failing to talk to each other in time. Vendor lock-in in SIEM is the consequence of no one treating detection rules as an independent asset.<\/p>\n
The stack at a glance: Wazuh, Sigma, Shuffle, DFIR-IRIS<\/h2>\n
The open-source stack discussed here consists of four components that cover distinct functions. While they can be tuned to work together, they do not constitute an integrated platform in the sense of a commercial SIEM. That is precisely their strength and, simultaneously, their hurdle.<\/p>\n
Wazuh<\/strong> serves as the detection platform. It combines HIDS functionality, log analysis, and compliance reporting based on Elasticsearch, providing a web UI for alert triage. Sigma<\/strong> is the detection rule standard, formulated to be platform-independent and capable of being translated into Wazuh rules, Elastic detection rules, or Splunk queries. Shuffle<\/strong> is the SOAR component that orchestrates workflows between detection, enrichment, and response. DFIR-IRIS<\/strong> is the case management tool for incident response workflows.<\/p>\n
Anyone hearing the term “agentic-AI-ready” should be cautious. While the components have integration points for LLM-based enrichment, that does not yet make the stack an autonomous security platform. Those who deploy AI agents in Shuffle workflows also assume responsibility for the hallucinations that every agent brings with it. Anyone who treats KMS keys like a drop-down menu has either never experienced an audit or has never had a good one. The same applies to AI agents in the detection pipeline.<\/p>\n
Pros and cons in an honest table<\/h2>\n
An honest comparison between a commercial SIEM and a Wazuh-centric open-source stack reveals clear trade-offs that are missing from most marketing decks. Anyone who puts this table on the table before a renewal deadline will at least gain a solid basis for discussion.<\/p>\n
\n - NIS2 requires auditability, not vendor conformity.<\/strong> Open-source stacks meet the requirements if the audit trail is documented. The hurdle lies in the internal effort, not in the choice of tools.<\/li>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-multi-cluster-kubernetes-ohne-ops-silo-35736207.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-m-and-a-integration-mittelstand-180-tage-92136245-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ai-betrieb-ownership-operating-model-dac-21400333-250x167.jpg\")
<\/span>