Signal in the Noise Platform
Why we stopped calling it a SIEM.
What the category was built for, what it still can't do, and why we picked a different word.
A SIEM is a database with a search box and a billing meter. That is not an insult. It is a description of what the category was designed to do in 2005: collect logs, keep them for the auditor, let someone search them later. Everything the industry bolted on afterwards, the correlation rules, the SOAR, the managed service, exists because the thing in the middle was never built to act.
We kept the part that matters. Convoy ingests everything you have, keeps it, and lets you search all of it with no per-gigabyte penalty. Then it does the thing a SIEM can't: it treats every alert as the start of a lead, every lead as something a person or a playbook will finish, and every finished lead as a line in one history you can read top to bottom.
That last part is why we dropped the word. "SIEM" tells a buyer to expect a console they will stare at. "Platform" tells them to expect an outcome: the attack stopped, the record written, the question answered before they asked it. If your current tool can't close a case, it isn't competing with us. It's feeding us.