Debunking AI & ML Myths
AI is evolving fast. See how AI and humans can thrive together in this free guide.
Data Gravity, Not Data Volume, Is What’s Holding You Back
By
Cory Minton
When IT and security leaders talk about data, the conversation usually starts with cost. Storing more. Retaining longer. But the real issue holding organizations back isn’t really price per terabyte — it’s data gravity created by outdated strategies that focus on centralizing data.
Organizations have built up such a mass of data that’s almost impossible to move, forcing them to create applications around the data. This gravitational pull creates silos, slows performance, and erodes digital resilience at the exact moment where speed and responsiveness matter most.
But digital resilience goes beyond uptime; it’s about adaptability. It’s your ability to see, decide, and act faster than whatever’s trying to knock you offline, whether it’s a cyberattack, a cloud misconfiguration, or AI gone rogue. And that means flipping the script on data management. It's not “collect all data,” but “activate the right data.” Storing data is a given. Acting on it is how you win.
Not all data is created equal, and that’s a good thing
CISOs and CIOs often tell me that if data is valuable, then more must be better. I get the logic. If data is gold, why not vault it all? But not all data is gold. Some of it is bronze, some of it is dust. And treating it all equally is like trying to win the F1 Monaco Grand Prix with a tow truck. Sure, it's got a lot of power and a big fuel tank — but it is not purpose-built for a race won with speed and precision.
In The New Rules of Data Management research study, 91% of organizations said they increased data management spend last year, yet 69% still struggle with maintaining compliance and extracting value. Why? Because they’re stuck in the “store everything” mindset, rather than evolving to an “orchestrate everything” model. The goal shouldn’t be to centralize everything, but to connect everything.
What actually matters now is gaining value from data at speed. Think about incident response: if a security team has to comb through weeks of raw logs during an outage, they’ll waste precious hours. But if high-value telemetry like authentication anomalies, system errors, and endpoint activity is already prioritized and activated in real time, security and IT teams can zero in on the root cause within seconds. That’s data value in action, where teams can cut through the noise to accelerate decisions when every minute matters.
You don't all the data. You need the right data, right now.
Hybrid is the reality but siloed data shouldn’t be
Michael Dell said it well: “Cloud is not a place, but an operating model.” And he’s right. The truth is, hybrid cloud is not a compromise — it’s the reality for modern enterprise IT.
But the issue is that a hybrid approach means more environments, more tools, and more fragmentation. And with fragmentation comes friction. Most IT leaders I speak with are juggling observability tools, security platforms, and compliance systems, each with its own data layer, schema, and blind spots.
This is where leaders need what I call a “monitor of monitors” (MOM) mindset. It’s a way of stitching together telemetry, security, AI, and operational signals into a connected view. It’s not another tool — it’s an approach that treats observability as a fabric, not a stack. In practice, this means breaking down silos by creating shared visibility across teams and systems, so data can be activated in real time rather than trapped in isolated stacks.
Why data activation is the new differentiator
For years, the default play was to centralize and store as much as possible. But with today’s scale and complexity, that model collapses under its own weight.
The vision now is to be smarter by leveraging federated search, edge processing, and tiered retention. Research indicates organizations that incorporate data reuse into their data management strategies experience significant value. This includes reduced impact of incidents (52% vs. 35% all other respondents) and better threat detection performance (62% vs. 47% all other respondents). My experience tells me this isn’t because they collected more, but because they connected more.
Today, I tell organizations the shift is toward activation over accumulation. What does that look like?
- Prioritize activation over accumulation: Don’t store what you won’t search.
- Unify without migrating: Federated visibility is your friend.
- Design data pipelines for humans and machines: Security teams, ITOps, and AI systems all need data in context.
Data activation can be your differentiating strategy and competitive edge. The companies that win won’t be the ones with the biggest data warehouses, but the ones who are faster and smarter about turning data into outcomes.
AI can be a proof point and a risk multiplier
In terms of adopting a modern data management strategy, many organizations I work with find that data gravity is the drag and AI is the accelerator. Simply put, AI is pushing organizations to act on data faster, but it also exposes cracks in old approaches.
AI thrives on quality, contextualized data. Without it, models drift, hallucinate, or amplify bias. And because AI is no longer experimental but embedded in your production systems, failures carry real business, regulatory, and reputational risk. According to McKinsey, 40% of organizations are now working to mitigate the cybersecurity risks associated with generative AI.
The answer isn’t more data, but rather connected data that reflects the full picture of systems, users, and environments. When teams can see across hybrid infrastructures, feed models high-quality signals, and observe performance in real time, AI becomes a force multiplier rather than a liability.
Leaders seeking to activate their data without forcing centralization to enable greater AI insights should focus on:
- Unifying data with federated search and analytics so teams can access data where it lives, and bringing AI and machine learning algorithms across various data repositories, including relational databases and data lakes.
- Are your AI systems receiving the same quality of security and observability data as your human teams?
- Can your data architecture deliver context across silos, in real time?
- How are you ensuring AI outcomes are connected to the same data foundation as your ITOps and security workflows?
The future of data-driven resilience
For AI-focused hybrid-powered organizations, data gravity — not cost — is the real pull on performance. And breaking free of it means building architectures that treat observability, security, and AI readiness as one connected fabric.
Data gravity isn’t going away. But leaders who activate rather than accumulate will define the next era of secure, resilient enterprise operations.
Let’s talk. Want to dive deeper into making your data a force multiplier? Connect with me on LinkedIn.
Subscribe to the Perspectives by Splunk newsletter and get actionable executive insights delivered straight to your inbox to stay ahead of trends shaping security, IT, engineering, and AI.
Related Articles
About Splunk
The world’s leading organizations rely on Splunk, a Cisco company, to continuously strengthen digital resilience with our unified security and observability platform, powered by industry-leading AI.
Our customers trust Splunk’s award-winning security and observability solutions to secure and improve the reliability of their complex digital environments, at any scale.
