Your Logs, Their Cloud: Why Data Ownership Defines Modern Detection & Response

Summary

A guide to understanding sovereignty, cost, and the true price of vendor-controlled data lakes.

Security teams have been conditioned to ship their logs into vendor-controlled data lakes – but that model is breaking.

It creates sovereignty risks, hides cloud spend, inflates storage without adding detection value, and locks organizations into architectures they can’t control.

This blog post explains why modern detection must evolve beyond the “Your Logs, Their Cloud” pattern. Cloud waste is rising because log volume grows quietly within cloud space organizations already pay for – much of which they never fully use or have visibility into – while the security value it delivers stays the same. Traditional SIEM and MDR tools amplify this problem by replicating and retaining data inside their own clouds, often far outside the organization’s governance.

A new model is emerging: keep your logs in your cloud, under your rules. With MDR Detect™, ON2IT analyzes, enriches, and correlates telemetry directly inside your environment – without building yet another vendor lake. This approach restores sovereignty, clarifies cloud costs, simplifies compliance, and prevents storage from dictating your detection strategy.

If you’re rethinking data ownership, cloud waste, or vendor lock-in in your managed detection and response program, this guide explains what needs to change – and how to start.

The Shift: Security Data Is Becoming a Liability – Not an Asset

For years, the industry has been conditioned to believe that shipping logs into a vendor’s data lake is simply “how MDR works.”
But that assumption is now eroding fast.

Research shows that 8 in 10 organizations are concerned about data sovereignty, and the impact of geopolitical and regulatory pressures on where their data is stored and processed. This concern is especially acute when critical security telemetry is processed, replicated, or retained in environments where organisations lack full visibility or control, heightening both compliance and cyber‑risk exposure

When logs leave your environment, three things happen immediately:

1. Your sovereignty diminishes
2. Your portability decreases
3. Your cloud costs rise

Today we cover why this happens-and why the next generation of detection is shifting toward architectures where organizations own their logs and the cloud they live in.

What You Lose When Logs Leave Your Cloud

For many organizations, detection pipelines were built around SIEM and data-lake architectures from a different era. These systems centralize everything, move data into vendor-managed storage, and create layers of replication that are invisible to the customer.

This introduces sovereignty risks that are no longer acceptable in a world shaped by GDPR, regional data residency commitments, and increasing audit pressure.

• What actually happens when logs leave your cloud?
• Retention becomes controlled by a third party
• Replication patterns are opaque
• Residency can shift across regions
• Governance teams lose visibility
• Retrieval becomes slow or expensive

The irony is that organizations are losing sovereignty not to attackers – but to the tools meant to protect them.

Cloud Waste Is Rising Because Logs Are Growing Faster Than Value

Cloud spending was supposed to scale with business need – but for many organizations, it has turned into an uncontrolled drag on budgets. The issue isn’t that cloud is expensive; it’s that most teams don’t have visibility into what’s driving the bill, especially when it comes to security logging.

Cloud costs rarely explode overnight – they creep. A few more days of retention here, a handful of new log sources there, and suddenly security teams are paying for cloud spaces they don’t use or have zero visibility into. It’s a familiar pattern: the logging footprint grows quietly within the cloud space you’re already paying for – but the detection value stays the same.

That quiet creep is why many organizations now believe around a fifth of their cloud spend goes to waste. Not because the cloud is inefficient, but because they’ve lost visibility into what’s being collected, why it’s being kept, and how it multiplies once it lands in a vendor’s data lake.

When detection depends on shipping everything to someone else’s storage, costs rise by default. Pipelines ingest too much, retention becomes a habit instead of a decision, and storage expands in the background with no natural ceiling. At that point you’re no longer paying for detection – you’re paying for gravity. This is the real problem with traditional data-lake-heavy approaches: the architecture itself guarantees growth, even if the security value doesn’t.

The Architectural Problem: When Detection Becomes a Storage

Traditional SIEM and centralized MDR pipelines assume that “more logs = better detection.”

But as data volumes explode, the opposite is happening:

• The storage footprint grows faster than the detection ROI
• Teams pay for cloud space they never use or for retaining data that contributes nothing to security outcomes
• Vendor pricing becomes unpredictable as ingestion increases
• Retention obligations balloon without clear justification
• Moving away from a vendor becomes financially painful

This is why many organizations now question whether sending all logs to a vendor’s cloud is still the right strategic choice.

A modern managed detection and response strategy requires something different: control.

A Better Approach: Keep Your Logs, Keep Control

Modern MDR doesn’t need your data to leave your environment. It doesn’t need another vendor-owned lake. And it definitely doesn’t need to turn security into a storage problem.

With MDR Detect™, your logs stay exactly where they belong – in your cloud, under your rules. We bring the detection to you: enrichment, correlation, analysis, and response all happen inside your environment, without siphoning your telemetry into someone else’s architecture.

The impact is immediate:

• Sovereignty isn’t a question mark anymore – your data stays in your region, your environment, your control.
• Cloud spend finally makes sense – no mysterious storage growth, no surprise retention charges.
• Retention becomes a choice, not a vendor default – you decide what stays, for how long, and why.
• Switching vendors doesn’t require a data extraction nightmare -your logs stay put, so migration is clean.
• Costs scale the way they should – on your terms, aligned with your governance, not a vendor’s footprint.

This is detection without the baggage.
A model built for outcomes, not for inflating storage metrics.
A shift away from “send us everything” and toward actual control.

It’s where managed detection and response needs to go – and where MDR Detect™ already is.

How to Move From “Your Logs, Their Cloud” to “Your Logs, Your Cloud”

Modernizing your detection strategy doesn’t require a full transformation on day one.

Here’s how organizations typically begin:

1. Start by assessing where your security data actually lives
Most organizations are surprised to learn just how many copies of their logs exist across vendors and regions.

2. Map retention requirements to real regulatory and operational needs
Retention should be intentional – not dictated by a vendor’s architecture.

3. Evaluate how much of your cloud bill is tied to logging and analytics
Even small ingestion reductions can lead to substantial savings.

4. Shift to MDR models that operate within your cloud
This is the key step that changes everything: sovereignty, cost control, portability, and long-term independence.

MDR Detect™ is built to support this transition without breaking workflows or losing visibility.

What’s Next: Take Back Control of Your Security Data

The old MDR model – ship everything to a vendor lake and hope for the best – is collapsing under its own weight. Too costly. Too opaque. Too dependent on someone else’s cloud.

Modern security demands the opposite:

• Your logs
• Your cloud
• Your rules

MDR Detect™ makes that shift real. Detection, enrichment, correlation, and response all happen inside your environment – without handing your data to a vendor or paying for storage growth you don’t control.

If you’re ready to reduce waste, regain sovereignty, and break free from data-lake lock-in, this cluster will show you how. Start exploring, compare architectures, and see why the future of detection belongs to organizations that keep control of their own data.

FAQ