Why SIEM projects stall, and what CISA's 2025 guidance says to do about it

Security information and event management (SIEM) platforms collect logs from across a company's systems and raise alerts when something looks wrong. They have been a security staple for nearly two decades. They also have a long record of expensive projects that never deliver the visibility they promised.

In 2025, CISA and the Australian Signals Directorate's Australian Cyber Security Centre published a set of guidance on implementing SIEM and security orchestration, automation and response (SOAR) platforms. It comes as three documents: one for executives, one for practitioners, and one listing which logs to collect first.

Read together, they explain where SIEM projects tend to go wrong.

Where projects go wrong

The data bill grows faster than expected

Many SIEM vendors price by the volume of data ingested, according to Petri's summary of the guidance. In a large or noisy environment, that bill climbs quickly. Teams then cut log sources to save money, and lose the visibility they bought the SIEM for.

Alerts nobody trusts

The guidance identifies alert tuning as a central challenge. A SIEM that fires on normal activity trains analysts to ignore it. CISA's advice is to tune the SIEM until its alerts are reliable before adding SOAR automation, because automation built on bad alerts just acts on noise faster.

Not enough skilled people

Deployment is complex and ongoing, and needs skilled staff. The guidance also cautions that handing the whole implementation to an outside party can reduce visibility and create gaps that lead to misconfiguration.

What the guidance recommends

1. Set a baseline first. Know what normal network, system and user activity looks like before you try to detect what isn't.
2. Scope around your highest risks. Start with the systems attackers target most.
3. Collect priority logs first, such as domain controllers, VPNs and cloud services, according to Petri's summary.
4. Tune before you automate. Get reliable alerts, then build SOAR playbooks.
5. Write and test playbooks that spell out the steps for each type of alert.
6. Keep reviewing. Test detection regularly and update rules as threats change.

Options for a mid-size company

Few mid-size companies can staff a full-time SIEM team. Common alternatives are a managed detection and response (MDR) service, or the security analytics built into Microsoft 365, Google Workspace and the major cloud platforms. If you take that route, apply the same tests: which logs are covered, who tunes the alerts, and who acts on them at 2 a.m.