The logs you need are already in the bin

Half of large enterprises discard or never collect roughly 86 percent of the log data their systems generate. That figure comes from a Dynatrace survey of 450 senior IT leaders, and it isn't an accident. It's a deliberate cost decision. At the average large enterprise, logging tools burn through close to $2.5 million a year and account for about half the observability budget.

The data that does get kept tends to age out quickly. Retention windows shrink, common events get sampled, and whole categories deemed repetitive get dropped at the pipeline.

Logs are the receipts

This matters because logs are the receipts. They record, in order, what happened inside an application or piece of infrastructure, and they're almost always the first thing a security team reaches for when something looks wrong.

Intrusions are rarely loud on day one. They sit quiet for weeks or months while attackers move around. By the time someone goes looking for the trail, the entries that would have told the story may have been sampled away or deleted to keep last quarter's invoice down.

The people making the call aren't in security

Log retention is almost never owned by the security team. It sits with observability, platform engineering, or functions measured against spending targets. Two thirds of organisations in the Dynatrace survey said their logging costs have outgrown the value they get back, and AI workloads are pushing volumes higher still.

So teams trim. Shorter retention. Aggressive sampling. Categories quietly dropped. None of this is unreasonable as a budget exercise. It just means the answer to "how far back can we look?" is often very different from what the incident response plan assumes.

A new wrinkle: agents reading logs

There's a second issue worth flagging. AI agents now read logs and act on them. That turns log data from a passive record into a live input for automated decisions. Tampered or injected entries could nudge an agent toward the wrong action, and the research flags training data poisoning as a related concern, though it stops short of joining the dots.

In other words: the same log streams that are getting thinned for cost are also becoming a more attractive surface to mess with.

A blunt exercise for security leaders

The useful question isn't philosophical. It's operational:

• What does your organisation actually collect?
• What gets thrown away before it ever hits storage?
• How long does the rest survive before it's aged out or sampled?
• Who owns those decisions, and what are they measured against?

The answers are often uncomfortable. They're also worth knowing before, rather than after, the day someone asks what happened ninety days ago.