OpenText Enterprise Security Manager
LeaderInformation Reimagined
Est 1991|Valuation $6.1B|Raised $14.3B
Information Reimagined
Published Oct 15, 2026
Public roadmap commitments and delivery dates were not identified in the sources reviewed. Buyers should request current roadmap and release cadence information during procurement.
Third-party vulnerability tracking exists for ArcSight ESM (historical product lineage) and can be used to monitor CVEs, but it is not an official vendor disclosure channel.
A TrustRadius review from an MSSP use case cited strengths in standardized log parsing (CEF), correlation capabilities, and operational vendor support for specific issues. The same review reported slow search times attributable to legacy storage/indexing architecture and mentioned slower delivery of newer plugins or dashboard features compared to some competitors.
G2 review snippets include feedback such as concerns about the timeliness of security patches in some instances; full G2 content was partially gated in the sources reviewed.
PeerSpot editorial summaries indicate mixed feedback on service and support responsiveness, and note that deployment complexity and integration effort vary substantially across engagements.
Reddit discussions reference ArcSight/ESM as an established enterprise SIEM with historical strengths but significant operational overhead in some deployments. Comments frequently compare ArcSight to newer platforms with respect to modernization and search performance. Many Reddit posts reflect cumulative experiences across product generations and ownership eras rather than product-specific reviews of recent releases.
Vendor-published customer outcomes included claims of scalability (e.g., handling very high event throughput), multi-tenancy support, and simplified log collection and user interface. Critical evaluation: these outcomes are vendor-published and do not include an independent methodology or workload description; they indicate that MSSP-style multi-tenancy was a target scenario.
Vendor materials describe use of ESM correlation to construct monitoring and reporting workflows, including a reported substantial number of automated use cases. Critical evaluation: this supports the role of correlation content engineering but implies a substantive investment in developing and maintaining detections.
Vendor materials describe a telecom deployment where ArcSight ESM was selected to correlate and report across diverse device and application types. Critical evaluation: the story highlights typical buyer drivers but does not provide independently verifiable ROI metrics.
Evidence of adoption in sectors such as finance, oil & gas, retail, telecom, and government/smart-city projects.
Get a comprehensive analysis of OpenText Enterprise Security Manager including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →Organizations that require fast, exploratory threat hunting at very large scale with minimal tuning effort.
Organizations that cannot accommodate complex on-premises SIEM operations.
Situations where SOAR stability and highly reliable automation are a primary decision criterion.
Procurement processes that require public list pricing and predictable self-serve packaging.
Organizations fully committed to cloud-native operations with minimal infrastructure ownership.
Gartner Peer Insights lists OpenText Enterprise Security Manager in the SIEM category with an overall rating visible in the accessible summary. The service and support subscore is lower than product capability scores in the available summary, indicating mixed feedback on support.
Example reviewer summaries (paraphrased):
OpenText Enterprise Security Manager (ESM), historically known as ArcSight ESM, is an enterprise Security Information and Event Management (SIEM) platform. It is designed to ingest security telemetry from multiple sources, normalize and enrich that data, correlate events in real time, and support SOC workflows such as alerting, dashboards, reporting, and compliance-oriented log management. OpenText describes the product as including native SOAR capabilities and an integrated threat intelligence feed.
Vendor-claimed product attributes include:
Key caveat: performance, scalability, and ROI figures cited in vendor materials were not independently validated in the sources reviewed. These vendor claims should be validated through a proof-of-concept using the customer’s actual event mix, correlation content, and storage/search requirements.