We’re Noel and Trevor, co-founders and co-CEO’s of Bronto - where we are on a mission to reinvent logging from end to end for the AI era.

‍

We have been building SMB, Mid-Market and Enterprise facing technology companies in both the US and Europe from the ground up for over 20 years now. We’ve spanned a very wide array of categories and technologies from ‘Email’ to ‘Logs’ to ‘eCommerce Analytics’ to ‘Voice-AI’ to ‘Customer Intelligence’ to ‘Digital Healthcare’, ‘Search’ and more.

‍

We’ve been very fortunate to work with incredible people and build amazing teams – many of whom we’ve worked with again and again on multiple businesses. We’ve also been very fortunate to originate, develop, scale and sell our companies to the likes of Rapid 7, Apple, Publicis and many more of the world’s largest technology companies.

‍

On our journey to date we have been founders, co-founders, investors (both private

and institutional VC), dirt-road CEOs, Chairman – both exec and non-exec and very

often we’ve worn multiple hats at the same time. To date, we have always focused on

creating enterprise value up to US $300m and building companies from zero revenue to $30m + and we’ve always been exit-focused from the start. Until now that is.

Our team has 150 years+ of log-domain specific expertise — this is our fourth time building a logging platform. And along the way we’ve had lots of industry firsts:

‍

• We built the first real time logging architecture as part of IBM’s on-prem solution back in the early 2000's
• We founded Logentries, one of the first SaaS log management platform companies, and we were the first to provide 'live tail' capabilities to the world (our board hated the name!)
• First to introduce bloom filters as an indexing approach (vs. inefficient inverted indexes)
• Plus decades of research papers, patents and logging innovation

Our logging journey started when building an on-prem logging platform for IBM - as part of our post doctoral research - in the mid 2000s. We then started Logentries in 2010, which attracted thousands of SMB and mid-market customers, before being acquired by NASDAQ-listed cybersecurity leader Rapid7 in 2015. From 2016 to 2022 we built our third logging platform as part of Rapid7's InsightIDR security platform. We scaled to thousands of mid market and enterprise customers, built a petabyte scale technology that was ultra efficient and ultra reliable. InsightIDR grew from being a brand new product when we joined to becoming the engine that powered a US $5 billion business at its peak.

‍

In late 2023 when we started to look closely again at the observability space a few things that were readily apparent felt very off -

‍

• The market was comprised of vendors that all came to market pre 'separation of storage and compute’, never mind pre the AI era.
• Almost $70bn of market cap was accounted for by just two companies, Splunk and Datadog - companies founded in the early 00’s and early 10’s respectively.
• Datadog’s pricing was exorbitant and confusing and ‘justified’ by endless features nobody cared about.
• New Relic and Sumo had been taken over by private equity firms so we could assume that value and innovation creation would be replaced by a focus on growing topline and cutting costs before selling on these companies to the ‘next guy’ in the food chain. 
• Honeycomb’s CEO was trumpeting a spend on observability of 20% to 30% of your Infrastructure costs…...for real!!
• Nobody was innovating on behalf of the user and customer.

‍

As we started to dig deeper, we were astonished to see that logging alone was in fact in a much worse state than when we started Logentries a decade earlier, and every tech organization seemed to be afflicted by this in some way. Months and months of diligence including conversations with Mid-market and Enterprise users and customers, across all industries and geographies confirmed everything we believed about how companies were logging in 2024….it was fundamentally broken and nobody was addressing it at a fundamental level. 

‍

Bronto was thus born. We are now on a mission to build the logging layer for the AI era, which will involve fundamentally reinventing logging from end to end. We envisage this being a 10-20 year journey, but as a team we are motivated by the challenge and committed to seeing it through. As a founding team we are at a stage in our lives where we are motivated to do it right and take the long view. We are super excited for this journey.

By definition a log is a record of a specific system event. Everything that happens on a system can be recorded in the system’s log data. Back in the day, we used to talk about logs as akin to “CCTV for your systems”, which we think still holds somewhat true today. Not unlike CCTV which has become much higher fidelity with the advent of HD cameras etc. logs have become richer and richer (thanks to OTel and wider log events) making them more useful than ever.  

Logs are the essential foundation of observability:

• Everything can be built from a log…logs, traces and metrics.
• If something goes wrong or breaks engineers and SREs need logs to understand what happened.
• If there are compliance or audit requirements compliance teams need logs (maybe for the last 18 months, maybe going back years)
• If there are security breaches you need logs to see who did what and when (most security breaches go unnoticed for 300 days +)
• If a customer complains about slow APIs or page loads your customer support team need logs to validate their complaint and attach log events to tickets/bugs to be fixed by engineers
• And so on…

Logging, and observability in general, are fundamentally broken. This is a universal problem that every tech organisation is grappling with today.

‍

The immediate problem

‍

Logging is shockingly expensive. By default, most organisations go with one of the well-known logging/observability vendors (think Splunk, New Relic, Data Dog etc.). 

‍

But the high costs of such platforms mean they have to tightly manage how much data they can 'fit' into them. This quickly creates a coverage problem as organizations reduce the retention period down to as little as 3, 7 or 15 days, and high volume logs are simply too expensive to even consider capturing.

‍

Faced with a lack of coverage and blackspots organisations turn to sub-par logging solutions that on the surface look cheaper, but when total cost of ownership is baked in can work out even more expensive than the big vendors whose egregious pricing they are trying to solve for. Typically companies use some of the cloud platforms logging tools with sub-optimal experiences (Cloudwatch, Google Cloud Logging, Azure Log Monitor) etc or start to roll their own using open source (ELK, Clickhouse etc) as well as sending data to object store and using tools like Athena when analysis is required. What results is a hodge podge of logging infrastructure that is not fit for purpose, creates a painful management overhead and introduces needless complexity. In our experience the internal logging infrastructure is usually hacked together from at least 5, and quite often over 7, different solutions and technologies.

‍

The immediate problem is a trifecta of high costs, lack of coverage and complexity. We call this the flywheel of compromises that every organization today is faced with when it comes to logging. 

‍

The wider problem

‍

The wider problem however is that organizations and end users have come to accept a dysfunctional end to end logging experience - even with 'best of breed' providers.

‍

Configuration is complex, whether its deploying vendor specific agents, setting up grok parsers, writing rules to remove PII data (that will commonly have gaps), use of regex and vendor specific query languages for searching and analytics, management of complex retention policies, managing hot vs cold data, archiving and rehydration of data (and again managing of archiving retention policies with the cloud provider), interacting via a 15+ year old user interface, opaque billing and the inability to understand what and who are driving costs/data volumes, 15 year old pricing and business models… etc.

‍

Right now logging is like the vacuum cleaner industry before Dyson, electric cars before Tesla, “smart” phones before the iPhone.  

Centralised logging entered the mainstream with the rise of the cloud and SaaS. It had been there for security/compliance a little earlier driven by the likes of Sarbanes-Oxley legislation and regulation (for more on this here’s a great YouTube clip on the history of logging from Raffael Marty, one of the founders of Loggly).

‍

Vendors like Loggly, Logentries, Papertrail, Sumologic etc. popped up to provide the first cloud based centralized logging services. These services charged on a per GB ingestion and storage model for a given retention period. For example, at the time Logentries came in around $1.50 per GB for 30 days retention. End users could now log into a centralized service to see all their cloud logs in one place…voila!

‍

For vendors this was a great business. Logging platforms are a lot like bank accounts…as an end user you don't want to go through all the hassle of switching providers unless you really have to. The business also has built-in growth because log volumes tend to grow significantly year on year. Even if you don’t add new customers, your existing base can grow your revenue nicely — at Logentries we used to grow significantly month over month from our existing base alone. 

‍

Not surprisingly vendors prioritised their “innovation” efforts on “higher value” features like complex query, alerting and dashboard capabilities (joins, lookup tables, machine learning based alerting etc) that could be used to justify the customer's price tag growing year on year. These capabilities were great demo-ware but rarely used. This became the dirty secret of logging vendors – innovation on behalf of the vendor….not innovation on behalf of the customer.

‍

This practice continues today. Along with the same 15 year old business model, where vendors charge per GB ingested and stored.

‍

For example Kevin Lin's superb analysis of logging vendor costs shows the per GB price of 'best of breed' vendors coming in between $4 and $5 per GB for only 14 day retention. Furthermore with the arrival of containers and the likes of Kubernetes, log volumes have exploded. So not only are volumes increasing significantly year on year, but the price per GB has also continued to increase (even as cloud costs have decreased and innovation has significantly lowered the cost to the vendor - e.g. separation of storage and compute). 

‍

Vendors have tried to normalise this by claiming it is best practice to spend up to 30% of your total infrastructure costs on observability. We think that's like going out and spending $200k on a new Porsche and then being asked to spend another $60k on the dashboard…wtf?! 

‍

As a result vendors have frankly been making out like bandits…e.g. Datadog's logging business, which is just 6 years old, hit $600m in revenue at the end of 2023 and now accounts for 30% of total company revenues. At its current growth rate it will be closer to $1bn in revenue by the end of the year and is one of the main pillars of DataDog’s ~$40bn market cap!

‍

Vendors have been innovating to grow revenue not to solve customer problems. The customer problem today is a cost, coverage and complexity problem. This is not solved by adding more 'features'. Spending 30% of your infra costs on observability is out of balance. When things fall out of balance however, they tend to get corrected over time.

‍

With the arrival of Gen AI and the new Agentic world it is ushering, this problem is set to be exacerbated as log volumes will increase yet again (and likely significantly). Yet log data will be even more relevant as service as a software becomes a reality in fields like  devops as a software, developers as a software, support as a software etc. where you will be able to spin up 1000 Devops agents during an outage to trawl your logs in different ways and identify the issue.

‍

To be fair, new entrants to this space have identified the problem and are coming in with lower pricing models which are more closely aligned with this new age where one can separate storage and compute and use much more efficient indexing (e.g. bloom filters) and storage (e.g. columnar stores). However they tend to be mere iterations of the incumbents (e.g. cheaper logs, traces and metrics) and are falling into many of the same traps of the past where their solutions are based on Opensource DBs that have not been designed for logging at scale. In the 2010's many used elastic search and had horror shows when it came to scaling clusters, rebalancing data etc. Today many have decided to run on the likes of Clickhouse - which is a super technology and an easy way to get started for logs you can control the structure of (the team at Shopify have used this very effectively to build their own internal logging infra). But again not designed from the ground up for logging vendors managing 1000s of clients log data and in turn runs into issues at scale, when building a logging platform where you can not control the shape/volume of logs and are designing for beyond PB scale.

‍

At Bronto, we think there’s a better way. We imagine, and are building for, a world where…

‍

• You have a single logging layer for your entire organization
• That is cost effective (orders of magnitude cheaper), gives you full coverage, removes the hodge podge of logging infrastructure within orgs today, is full SAAS and requires no management
• Is easy to use and has a business model aligned with the value you derive from the service not the merely the amount of data you store
• Is fit for the purpose for the AI era in terms of capabilities, user experience and cost model
• Does not require the use of grok or regex to parse your logs
• Does not require the user to create lists of PII rules for data scrubbing
• Does not penalize customers for overages they can not control
• Provides log hygiene and automatic volume controls
• Provides value attribution capabilities…. i.e. clear and transparent billing and usage information (hard to believe but it almost impossible today to figure out what is driving your logging bills)
• Provides lightening fast search across TB, PB of data and beyond
• Does not rely on vendor specific/complex query languages
• Does not provide a 15 year old user interface from the Splunk-era but instead provides an experience in line with the AI era
• Does not require management of hot and cold data
• Does not require the dropping of high volume logs, or reducing retention to 3 days
• Does not require management of complex retention policies
• Does not require rehydration of logs and managing of object storage (retention policies, access control)
• Is enabled for the AI era and integrates with your LLM of choice and the Agentic world
• Forms a core part of your data pipeline and integrates with all the tools you use (e.g. incident management, security, analytics etc)

‍

Imagine a single logging layer within your organisation that “just works”…….