Why CISOs Are Building Open Security Lakes with Iceberg

Legacy SIEM architectures are hitting cost and scalability limits as AI-driven threats generate unprecedented data volumes. CISOs are responding by building Open Security Lakes using Apache Iceberg as an open table format, decoupling data storage from vendor-proprietary analytics. This approach lets organizations own their data, bring any compute engine to it, and avoid lock-in. A data streaming platform acts as the central nervous system, routing high-volume logs, applying real-time threat detection via open standard rules, and reducing downstream SIEM costs by 30–50%. SIEM doesn't disappear but becomes focused on high-value analysis, while the security lake handles forensic data at scale. Confluent's Tableflow and Freight clusters are positioned as key enablers of this architecture.