The pipeline was never the destination

Gartner's Hype Cycle for Security Operations 2026 did something I didn't expect: it removed the standalone security data pipeline from security operations. And added a new category: Security Data Lakes.

That's not a coincidence. It's a market shift.

I was at the Gartner Security and Risk Management Summit in National Harbor last week. What I heard from Darren Livingstone, Eric Ahlm, and Kevin Schmidt confirmed something we've said internally since we started building: routing security data is infrastructure work. Infrastructure doesn't make the Security Hype Cycle. What makes the Hype Cycle is what you build on top of it.

We've been called a pipeline company from the beginning. That framing isn't wrong.

Axoflow routes, reduces, and processes security data before it reaches its destination. That work matters. But it was never the goal.

The argument for building a normalized data layer isn't "save on SIEM ingestion costs" - though it does that. It's that the quality of your data determines the quality of your detections, and the quality of your detections determines the quality of everything that runs above them. Cost reduction is a symptom. Data quality is the disease.

We built the pipeline because the security data layer required it. Not the other way around.

The Summit confirmed this in three separate sessions.

Kevin Schmidt's session on SIEM cost reduction named security pipelines as one of four discrete cost-reduction strategies. Discrete infrastructure. An enabler of architecture, not an architecture itself.

Darren Livingstone and Jonathan Nunez removed the dedicated pipeline profile from the Hype Cycle because security-focused pipeline vendors are getting absorbed by platform vendors. They're right. Pipelines that stayed at routing stopped being independent - they became features inside larger platforms, defined by someone else's roadmap. The vendors building new categories are the ones who didn't stop there. In the same session, Livingstone introduced Security Data Lakes as a new entry - "a highly extensible alternative to SIEM" and a direct response to a market fracturing under the weight of ingest pricing.

Eric Ahlm defined SDL in public: "Not a SIEM vendor that has a data lake. AI not as an overlay for workflow, but as a detection layer itself. A new paradigm." Vega, a federated detection and analytics platform, is in that conversation. Exaforce - an agentic SOC platform that just raised $125M - had Aqsa Taylor on stage talking about AI-driven threat detection at collection time. The vendors getting funded and covered at this event were building above the data layer. They all need that layer solved first.

"In terms of its potential to be disruptive, I think SDL is the one to watch." - Eric Ahlm, Sr Director Analyst, Gartner

The architecture the market is converging on is the one we've been building toward.

Detection logic runs at the collection layer, before data moves downstream. Sigma rules execute at the pipeline. Only alerts and normalized events travel forward. Raw telemetry goes to AxoLake - low-cost object storage, available for investigation, not paying SIEM-tier prices to sit there waiting. The result is a data layer that lets detection engineers work from a clean, schema-consistent foundation regardless of what any upstream vendor changed last week.

This is not new thinking for us. The data layer is the prerequisite. What you can do with the data is the point.

Security Data Lakes at Innovation Trigger on the 2026 Hype Cycle means we're early. It also means the category exists and Gartner is tracking it.

We didn't pivot to SDL when Gartner named it.

We arrived at the same place independently because it's where the logic of the problem leads. If detections should be portable, and detection quality should be a function of data quality, and data quality requires ownership of the data layer - you end up at the same architecture Gartner is now calling SDL.

Three days in National Harbor made that clearer than any internal memo has.