Loading a webpage used to be something you had to plan around.
“Think of 1995 when you were going on the web and it took three minutes to log onto your average website,” says Christophe Foulon, Executive Cybersecurity Advisor and vCISO at Quisitive. “Would you do that today? No. You’d probably give up, go get a cup of coffee, and forget that you were doing something on the web.”
Today that speed problem is solved for the web. After spending nearly 20 years in IT and cybersecurity, Christophe thinks security teams deserve the same standard for their data.
We sat down with him for the Hot Data series to talk about what changes for security teams when more of their data is queryable, all the time.
Threat Hunting Can’t Wait for a Restore
Most SIEMs keep somewhere between 30 and 90 days of data queryable. After that, logs get pushed to cold or archival storage. For day-to-day triage and alerting, that window is usually enough.
The problem shows up when security teams need to look further back.
“Should they need to go back and research an incident that was discovered in the past, or do what’s called threat hunting, where they’re specifically going back and looking for indicators of compromise of an event that may have been missed,” Foulon says. They’re searching for “those telltale signs of a threat actor in the past.”
That kind of investigation requires access to months of historical data. And if that data has been archived, the hunt stalls before it even starts. Teams either wait for a restore or narrow their scope to whatever is still queryable.
Foulon notes that most organizations only do this kind of deep threat hunting once a quarter, unless they have a dedicated team. But the threats they’re hunting for don’t operate on a quarterly schedule. An attacker who got in six months ago isn’t going to wait around while the data gets pulled out of cold storage.
This is one of the core problems Hydrolix addresses. By keeping log data hot and queryable for months or years, security teams don’t have to choose between what they retain and what they can actually search when it matters.
AI-Driven Security Breaks on Cold Data
Security teams are increasingly relying on AI-powered tools for detection and response. That means the data feeding those tools has to hold up on two fronts: quality and speed.
“Most leaders see AI as a black box,” Foulon says. “You put it in, you expect that on the other end it does the process that the data scientist and the prompt engineers tell you that it’s going to do and it’s going to help solve your problem. But that isn’t always the case if you don’t have the right data to help with solving that problem.”
That’s the garbage in, garbage out problem, and most teams are at least aware of it. What gets less attention is what happens when the data is right but not available fast enough.
“If it has to wait and wait for it to restore, it’s gonna add to latency in that processing,” Foulon says. “And then that AI or automation is going to think that there’s something wrong in the process and might give up along the way.”
So it’s not enough to have good data sitting in an archive somewhere. If the AI can’t access it in time, it either throws errors or silently moves on. For security teams building workflows around AI-powered triage or anomaly detection, that makes hot data a requirement, not a nice to have.
Proactive Reporting Replaces Fire Drills
There was a time when producing audit evidence was its own multi-hour project. Foulon remembers it well.
“What system is it in? And then let’s spin off and do a one-hour, two-hour session of trying to find the logs in that particular application or software to try to prove this particular use case,” he says. “And if not, it was like, okay, well, how can we prove that you have the controls and that the controls do seem to work for the most part? And the auditors would tend to take that as okay.”
Auditors accepted that controls existed because actually proving they worked was too painful. That was the bar.
The tooling has caught up. Christophe points to automated GRC systems, cloud-based data lakes, and on-demand reporting that make it possible to have evidence ready before anyone asks for it. “You can pre-run those reports and have them available as of the end of the month or as of the end of the year,” he says, “and have them available as hot data for the auditor to come in and look, but also for your executive team to come in and take a look at the health of their program.”
The same principle applies to operations. When teams know which alerts and error patterns matter, they can pre-build the reports that support faster incident remediation. Instead of scrambling to find data after something breaks, the data is already organized and waiting.
That shift from reactive to ready is what hot data actually looks like in practice.
The Takeaway
Whether it’s threat hunting that can’t wait for a restore, AI tools that break when data isn’t immediately available, or audit prep that used to take hours, the common thread is the same: security teams do better work when more of their data is hot. The challenge has always been making that economically viable. Keeping months or years of log data queryable sounds great until you see the storage bill. That’s the problem Hydrolix was built to solve. As a real-time data platform purpose-built for long-term retention and always-hot data with low-latency query performance, Hydrolix enables security teams to keep the data they need queryable for months or years without choosing between access and cost. If you want to see what that looks like for your team, request a demo.
