How BTG Pactual scales security investigations without replacing Splunk

Summary

BTG Pactual scaled security investigations by introducing Imply Lumi as a data layer underneath Splunk. Without changing dashboards, alerts, or workflows, the team reduced costs, increased data retention, and enabled faster access to historical data by separating how data is stored from how it is queried.

Highlights

• 60%+ lower cost per GB for observability data
• 10+ TB/day of additional security data retained and queryable
• 4x increase in data retention
• Faster, more responsive investigations across historical data
• No disruption to existing dashboards, alerts, or workflows
• No SIEM migration required

Challenge

BTG Pactual, a leading global investment bank, was generating approximately 25 terabytes of security telemetry per day—far more than it could efficiently retain and query within its existing security analytics platform. As costs increased, the team reduced indexed data and pushed more into cold storage, limiting access to historical data during investigations. This created a gap where critical data was either slow to access or unavailable, delaying response times and increasing risk. At the same time, finance leaders began evaluating a SIEM migration driven more by cost pressure than technical need.

Solution

BTG Pactual deployed Imply Lumi as a data layer underneath Splunk. Detection and investigation workflows stayed the same, with teams continuing to use the same dashboards, alerts, and SPL. What changed was how the data supporting those workflows is stored and accessed. Instead of forcing all telemetry into always on indexed infrastructure, data is stored more efficiently in Lumi. Detection and investigation no longer share the same infrastructure. Detection runs on always on compute optimized for continuous monitoring and alerting, while investigations run on elastic compute that scales on demand. Each workload now runs in an environment designed for how it actually behaves, without duplicating ingestion or rehydrating cold storage.

Impact

With this shift, BTG Pactual reduced Splunk related observability costs by more than 60 percent while bringing over 10 terabytes per day of additional security data back into scope. Data retention increased from 90 days to 365 days, giving teams access to a full year of historical data for investigations. Teams gained fast access to historical data while continuing to use the same workflows in Splunk. By changing how data is stored while keeping workflows the same, they removed the need to trade off cost, performance, and retention. This eliminated the need for a disruptive, finance driven SIEM migration and gave the team more flexibility in how they evolve their Splunk environment over time.