Arcsight Inc.

Name: Arcsight Inc.
Brand: Arcsight Inc.

Micro Focus Security ArcSight ESM is an enterprise security information and event management (SIEM) solution that uses real-time data correlation to dramatically reduce the time to detect and respond to cyber threats and protect your business

Est 2000|Valuation $1.5B|Raised $75.7M|4 Ref Customers

LinkedIn 28|Website|FTEs 512|HQ Cupertino, California, US

MarketsSecurity Information and Event Management (SIEM)Security Orchestration, Automation, and Response (SOAR)

Platform CoversCyber Risk Management Vulnerability Management Board Reporting for Cyber Risk

Published Oct 14, 2026

01Common complaints

- Small or understaffed SOCs: Multiple reviews indicate a substantial learning curve and a need for specialized personnel. - If fast, ad-hoc hunting and query responsiveness across wide time ranges is the primary requirement: some community and reviewer comments indicate slower response times for wide-range queries in certain deployments. - If a modern, self-serve user experience and minimal administrative overhead are required: some reviewers describe the UI as older in style and less intuitive than newer platforms. - If out-of-the-box connectors for specific modern identity providers are mandatory: some reviewers reported connector gaps for certain SSO providers at the time of their reviews. - If fully transparent, publicly documented pricing is a procurement requirement: ArcSight pricing is typically quote-based and may require more procurement time.

Deal disqualifiers (poor fit)

Small teams without SIEM engineering capability
Requirements for immediate, ad hoc search and dashboarding at scale without significant tuning
A strong preference for SaaS-first SIEMs with minimal infrastructure ownership and vendor-managed operations

Known limitations from customers/reviews

Search and reporting performance degradation with large datasets and longer queries
Complexity and training burden for operational teams
User interface and platform components (some reports reference Java-based console performance impacts)
Integration and parsing issues for specific data sources reported in community threads

Roadmap / future signals

A clear, product-specific public roadmap for ArcSight was not found in the reviewed sources. Purchasers should request:

A product roadmap briefing (12–24 months)
Support lifecycle and versioning policy
Vendor guidance on cloud and hybrid modernization strategies

Where it struggles (per reviews)

Long-range searches (for example, searches spanning multiple Logger instances or extensive retention windows) have been reported as slower in some deployments.
Reporting and search performance can degrade as EPS increases beyond certain levels in some reported environments.

02Why they buy

Unique selling points supported by customer feedback

Correlation rule capabilities and customization: reviewers and practitioners frequently cite the system’s rule-based detection capabilities as a primary strength.
Integration breadth in practiced deployments: many users report successful ingestion of diverse data sources and third-party integrations in their environments.

Claims that require validation

Vendor-stated capacity and productivity metrics (e.g., high EPS figures and quantified reductions in analyst workload) should be validated through sizing exercises and POCs.

Where competitors have advantages

Query responsiveness and user experience: some alternatives are perceived as faster for query-heavy workflows in typical community comparisons.
Operational simplicity: several cloud-native SIEMs reduce infrastructure management and may lower operational overhead for organizations that prioritize that model.

Why customers chose ArcSight (inferred from reviews)

Common purchase drivers in reviews and discussions include:

The correlation engine and rule-based detection capabilities
Broad integration and connector ecosystem in certain environments
Ability to operate on-premises with deep customization

03Field reports

Public, detailed ArcSight-specific case studies with independently verifiable metrics were not identified in the reviewed sources. OpenText product materials present operational efficiency and performance claims (for example, reported reductions in alert volumes and time savings). These should be treated as vendor-provided benchmarks and validated in a purchaser’s environment via a POC. Recommendation: Treat vendor-provided results as directional. Validate claimed benefits and performance using a POC that reflects the purchaser’s throughput, retention and correlation use cases.

Review platform highlights (G2) — summarized

G2 listings for ArcSight-branded OpenText products show limited review volume in the public listings reviewed; interpret these as anecdotal. Positive reviewer comments (summarized): - Some reviewers reported satisfactory performance of database and UI components in their environments. - Logger was described by some reviewers as aiding investigations when integrated with ESM; reviewers also noted ease of creating queries and reports in specific deployments. Negative reviewer comments (summarized): - Several reviewers reported slow search performance and periods of sluggish responsiveness when running multiple reports or queries across long time windows. - Reviewers cited a steep learning curve and complexity, and some noted licensing costs were significant in their procurement experiences.

Review platform highlights (Capterra) — summarized

Capterra reviewer themes include: Positive (summarized): - Reported ability to ingest large event volumes and integrate with third-party applications in certain environments. - Some reviewers noted scalability in data intake and integration breadth. - The correlation engine was frequently cited as a strong feature by some users. Negative (summarized): - Recurrent comments about complexity and the need for specialized personnel to operate and tune the platform. - Reports of degraded performance for reporting and searching at higher event rates. - Concerns about the user interface and reported slowness associated with specific platform components. - Instances of missing or limited out-of-the-box connectors for certain modern identity providers.

Community (Reddit / forums) — summarized

Community posts and operational discussions on forums tended to be more negative and detailed about operational challenges, including: - Reports of slower query performance compared with alternative platforms in some environments. - Operational impacts reported by some MSSP practitioners, including longer mean time to detect/triage due to platform responsiveness. - Migration discussions indicating some organizations forward ArcSight data into other platforms for improved search or dashboarding in specific use cases. These community observations are anecdotal and should be validated against an organization’s own POC results.

Why some customers leave / consider alternatives

Recurring reasons cited in reviews:

Search and reporting performance under heavy load
Complexity and staffing requirements
User interface perceived as dated by some users
Licensing and support costs

04Best fit

Company size

Typical fit:

Enterprise-scale organizations and regulated mid-market entities with a mature SOC
Organizations with high log volumes and requirements for long-term retention when appropriately sized

Industries

Common sectors where ArcSight deployments are observed:

Financial services
Government and defense
Large healthcare and critical infrastructure
Large enterprises with complex hybrid networks

Roles / personas

CISO / Head of Security Operations
SOC manager
SIEM engineer / detection engineer
Security architect

Pain points ArcSight addresses

Centralized log collection with normalization
Real-time correlation for detection workflows
Compliance reporting and audit trail capabilities

Qualification criteria (typical fit)

The organization can staff or contract experienced SIEM engineers or partners
The organization requires deep customization and on-premises control
There is a content and tuning strategy for correlation rules and ongoing maintenance

05The pitch

What the product does (objective)

ArcSight is an established enterprise SIEM and log management product line (notably ArcSight Enterprise Security Manager (ESM) and ArcSight Logger) now offered under OpenText Cybersecurity. Functionality includes: - Collecting and normalizing security telemetry from many sources (logs, events) - Real-time correlation and alerting (ESM) - Log retention, search, and reporting (Logger) - Supporting SOC workflows via dashboards, rules, reporting, and integrations OpenText describes Enterprise Security Manager as a real-time, high-throughput correlation SIEM and publishes performance figures; these vendor-published figures should be validated during evaluation using sizing guidance and proof-of-concept (POC) benchmarks.

Target market and market positioning

ArcSight is primarily positioned for: - Large enterprises and government organizations - Security Operations Centers (SOCs) requiring customizable correlation rules, on-premises or hybrid deployment models, and broad log-source integration - Managed Security Service Providers (MSSPs) in some deployments Market commentary on review platforms and community discussions indicates ArcSight is generally viewed as a capable but complex, legacy-oriented SIEM compared with more cloud-native offerings.

Get a comprehensive analysis of Arcsight Inc. including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 14, 2026

01Common complaints

Small or understaffed SOCs: Multiple reviews indicate a substantial learning curve and a need for specialized personnel.
If fast, ad-hoc hunting and query responsiveness across wide time ranges is the primary requirement: some community and reviewer comments indicate slower response times for wide-range queries in certain deployments.
If a modern, self-serve user experience and minimal administrative overhead are required: some reviewers describe the UI as older in style and less intuitive than newer platforms.
If out-of-the-box connectors for specific modern identity providers are mandatory: some reviewers reported connector gaps for certain SSO providers at the time of their reviews.
If fully transparent, publicly documented pricing is a procurement requirement: ArcSight pricing is typically quote-based and may require more procurement time.

Deal disqualifiers (poor fit)

Small teams without SIEM engineering capability
Requirements for immediate, ad hoc search and dashboarding at scale without significant tuning
A strong preference for SaaS-first SIEMs with minimal infrastructure ownership and vendor-managed operations

Known limitations from customers/reviews

Search and reporting performance degradation with large datasets and longer queries
Complexity and training burden for operational teams
User interface and platform components (some reports reference Java-based console performance impacts)
Integration and parsing issues for specific data sources reported in community threads

Roadmap / future signals

A clear, product-specific public roadmap for ArcSight was not found in the reviewed sources. Purchasers should request:

A product roadmap briefing (12–24 months)
Support lifecycle and versioning policy
Vendor guidance on cloud and hybrid modernization strategies

Where it struggles (per reviews)

Long-range searches (for example, searches spanning multiple Logger instances or extensive retention windows) have been reported as slower in some deployments.
Reporting and search performance can degrade as EPS increases beyond certain levels in some reported environments.

02Why they buy

Unique selling points supported by customer feedback

Correlation rule capabilities and customization: reviewers and practitioners frequently cite the system’s rule-based detection capabilities as a primary strength.
Integration breadth in practiced deployments: many users report successful ingestion of diverse data sources and third-party integrations in their environments.

Claims that require validation

Vendor-stated capacity and productivity metrics (e.g., high EPS figures and quantified reductions in analyst workload) should be validated through sizing exercises and POCs.

Where competitors have advantages

Query responsiveness and user experience: some alternatives are perceived as faster for query-heavy workflows in typical community comparisons.
Operational simplicity: several cloud-native SIEMs reduce infrastructure management and may lower operational overhead for organizations that prioritize that model.

Why customers chose ArcSight (inferred from reviews)

Common purchase drivers in reviews and discussions include:

The correlation engine and rule-based detection capabilities
Broad integration and connector ecosystem in certain environments
Ability to operate on-premises with deep customization

03Field reports

Public, detailed ArcSight-specific case studies with independently verifiable metrics were not identified in the reviewed sources.

OpenText product materials present operational efficiency and performance claims (for example, reported reductions in alert volumes and time savings). These should be treated as vendor-provided benchmarks and validated in a purchaser’s environment via a POC.

Recommendation: Treat vendor-provided results as directional. Validate claimed benefits and performance using a POC that reflects the purchaser’s throughput, retention and correlation use cases.

Review platform highlights (G2) — summarized

G2 listings for ArcSight-branded OpenText products show limited review volume in the public listings reviewed; interpret these as anecdotal.

Positive reviewer comments (summarized):

Some reviewers reported satisfactory performance of database and UI components in their environments.
Logger was described by some reviewers as aiding investigations when integrated with ESM; reviewers also noted ease of creating queries and reports in specific deployments.

Negative reviewer comments (summarized):

Several reviewers reported slow search performance and periods of sluggish responsiveness when running multiple reports or queries across long time windows.
Reviewers cited a steep learning curve and complexity, and some noted licensing costs were significant in their procurement experiences.

Review platform highlights (Capterra) — summarized

Capterra reviewer themes include:

Positive (summarized):

Reported ability to ingest large event volumes and integrate with third-party applications in certain environments.
Some reviewers noted scalability in data intake and integration breadth.
The correlation engine was frequently cited as a strong feature by some users.

Negative (summarized):

Recurrent comments about complexity and the need for specialized personnel to operate and tune the platform.
Reports of degraded performance for reporting and searching at higher event rates.
Concerns about the user interface and reported slowness associated with specific platform components.
Instances of missing or limited out-of-the-box connectors for certain modern identity providers.

Community (Reddit / forums) — summarized

Community posts and operational discussions on forums tended to be more negative and detailed about operational challenges, including:

Reports of slower query performance compared with alternative platforms in some environments.
Operational impacts reported by some MSSP practitioners, including longer mean time to detect/triage due to platform responsiveness.
Migration discussions indicating some organizations forward ArcSight data into other platforms for improved search or dashboarding in specific use cases.

These community observations are anecdotal and should be validated against an organization’s own POC results.

Why some customers leave / consider alternatives

Recurring reasons cited in reviews:

Search and reporting performance under heavy load
Complexity and staffing requirements
User interface perceived as dated by some users
Licensing and support costs

04Best fit

Company size

Typical fit:

Enterprise-scale organizations and regulated mid-market entities with a mature SOC
Organizations with high log volumes and requirements for long-term retention when appropriately sized

Industries

Common sectors where ArcSight deployments are observed:

Financial services
Government and defense
Large healthcare and critical infrastructure
Large enterprises with complex hybrid networks

Roles / personas

CISO / Head of Security Operations
SOC manager
SIEM engineer / detection engineer
Security architect

Pain points ArcSight addresses

Centralized log collection with normalization
Real-time correlation for detection workflows
Compliance reporting and audit trail capabilities

Qualification criteria (typical fit)

The organization can staff or contract experienced SIEM engineers or partners
The organization requires deep customization and on-premises control
There is a content and tuning strategy for correlation rules and ongoing maintenance

05The pitch

What the product does (objective)

Collecting and normalizing security telemetry from many sources (logs, events)
Real-time correlation and alerting (ESM)
Log retention, search, and reporting (Logger)
Supporting SOC workflows via dashboards, rules, reporting, and integrations

OpenText describes Enterprise Security Manager as a real-time, high-throughput correlation SIEM and publishes performance figures; these vendor-published figures should be validated during evaluation using sizing guidance and proof-of-concept (POC) benchmarks.

Target market and market positioning

ArcSight is primarily positioned for:

Large enterprises and government organizations
Security Operations Centers (SOCs) requiring customizable correlation rules, on-premises or hybrid deployment models, and broad log-source integration
Managed Security Service Providers (MSSPs) in some deployments

Market commentary on review platforms and community discussions indicates ArcSight is generally viewed as a capable but complex, legacy-oriented SIEM compared with more cloud-native offerings.

Get a comprehensive analysis of Arcsight Inc. including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →