Skip to main content

Observability Costs Rising Faster Than Value

The gap is widening between what teams spend on observability tools and the value they receive amid surging data volumes and budget pressures, according to The Breaking Point for Observability Leaders, a report from Imply.

Top findings of the report include:

  • More than half of leaders allocate over 25% of their observability budget to a single platform, yet only 13% say they are very satisfied with the cost-to-value ratio.
  • Nearly 80% of teams are filtering, archiving, or offloading logs to control costs—reducing critical data visibility when teams need it most.
  • 87% of leaders report that slow queries on observability data were caused by inaccessible data delay workflows such as threat detection and incident response.
  • 87% of respondents are exploring or open to platform alternatives that reduce cost and scale pressure without disrupting current workflows, and 98% say they would adopt a fully compatible option.

Observability Spending Is Increasing While Value Declines

Enterprise teams report rising observability costs year over year, but confidence in platform ROI is slipping. Leaders say platform-centric licensing models and the rapid growth of observability data have created an environment whereby retaining essential logs or adding new workloads often requires difficult trade-offs.

Rising Costs Are Forcing Cuts to Visibility

To manage spend, many organizations are reducing retention or shifting data into lower-cost storage tiers. These common cost-saving measures directly reduce visibility and degrade query performance, and come with significant operational consequences:

  • High-value logs get filtered out before ingestion
  • Investigations slow as teams move data out of cold storage
  • Real-time responsiveness suffers during incidents

"Too many organizations are being priced into flying blind," said Eric Tschetter, Chief Architect at Imply. "They're cutting retention because budgets force their hand, and it shouldn’t be that way. Teams tell us they're pushing data into cold storage to keep costs in check and that can slow investigations, can create dangerous blind spots, and can weaken resilience. In a crisis, those trade-offs are unacceptable."

Teams Want Compatibility, Not Replatforming

Despite these challenges, leaders are not looking to rebuild their entire observability stack. Their frustration centers on the cost and scale limits of current approaches, not the workflows themselves.

  • 98% of leaders would adopt a fully compatible option that eases cost and scale pressure
  • Workflow continuity remains a top priority across respondents

"Teams aren't looking for a rip and replace," said Tschetter. "They want to keep their workflows and scale them. If you can separate cost from data volume and work with the tools they already trust, that's a breakthrough."

The Latest

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

Top-performing businesses prioritize data-driven decision making, enabling leaders to move from intuition and gut feel towards evidence-based judgment. But that judgment is only sound when the data underpinning decisions is accurate. With incident management, data accuracy is particularly important. Long-term revenue, customer trust, and operational stability depend on high-quality data that enables teams to quickly identify and address the root cause of major incidents. Against this backdrop, governance becomes a critical endeavor to ensure the right data drives the right action ...

In MEAN TIME TO INSIGHT Episode 26, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses network compliance ... 

Most production autonomous agents do not run in a vacuum. They run inside cloud infrastructure: virtual machines, containers, pods, managed clusters or private servers. That is where most operations teams start monitoring. Is the VM alive? Is the container running? Did the pod restart? Is memory stable? Is CPU too high? Did the health check pass? Those signals are useful. They tell you whether the shell around the agent is alive. They do not tell you whether the agent inside is actually operational ...

Enterprise IT environments have never been more observable ... Yet many organizations still grapple with outages, lengthy incident resolution cycles, and increasing complexity. Most teams do not suffer from a shortage of data. They struggle to determine what deserves attention and what action to take next ... Enterprise IT operations must move beyond monitoring and visibility. The next stage of maturity is decision operations, an approach that helps teams make faster, better-informed decisions ...

Observability Costs Rising Faster Than Value

The gap is widening between what teams spend on observability tools and the value they receive amid surging data volumes and budget pressures, according to The Breaking Point for Observability Leaders, a report from Imply.

Top findings of the report include:

  • More than half of leaders allocate over 25% of their observability budget to a single platform, yet only 13% say they are very satisfied with the cost-to-value ratio.
  • Nearly 80% of teams are filtering, archiving, or offloading logs to control costs—reducing critical data visibility when teams need it most.
  • 87% of leaders report that slow queries on observability data were caused by inaccessible data delay workflows such as threat detection and incident response.
  • 87% of respondents are exploring or open to platform alternatives that reduce cost and scale pressure without disrupting current workflows, and 98% say they would adopt a fully compatible option.

Observability Spending Is Increasing While Value Declines

Enterprise teams report rising observability costs year over year, but confidence in platform ROI is slipping. Leaders say platform-centric licensing models and the rapid growth of observability data have created an environment whereby retaining essential logs or adding new workloads often requires difficult trade-offs.

Rising Costs Are Forcing Cuts to Visibility

To manage spend, many organizations are reducing retention or shifting data into lower-cost storage tiers. These common cost-saving measures directly reduce visibility and degrade query performance, and come with significant operational consequences:

  • High-value logs get filtered out before ingestion
  • Investigations slow as teams move data out of cold storage
  • Real-time responsiveness suffers during incidents

"Too many organizations are being priced into flying blind," said Eric Tschetter, Chief Architect at Imply. "They're cutting retention because budgets force their hand, and it shouldn’t be that way. Teams tell us they're pushing data into cold storage to keep costs in check and that can slow investigations, can create dangerous blind spots, and can weaken resilience. In a crisis, those trade-offs are unacceptable."

Teams Want Compatibility, Not Replatforming

Despite these challenges, leaders are not looking to rebuild their entire observability stack. Their frustration centers on the cost and scale limits of current approaches, not the workflows themselves.

  • 98% of leaders would adopt a fully compatible option that eases cost and scale pressure
  • Workflow continuity remains a top priority across respondents

"Teams aren't looking for a rip and replace," said Tschetter. "They want to keep their workflows and scale them. If you can separate cost from data volume and work with the tools they already trust, that's a breakthrough."

The Latest

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

Top-performing businesses prioritize data-driven decision making, enabling leaders to move from intuition and gut feel towards evidence-based judgment. But that judgment is only sound when the data underpinning decisions is accurate. With incident management, data accuracy is particularly important. Long-term revenue, customer trust, and operational stability depend on high-quality data that enables teams to quickly identify and address the root cause of major incidents. Against this backdrop, governance becomes a critical endeavor to ensure the right data drives the right action ...

In MEAN TIME TO INSIGHT Episode 26, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses network compliance ... 

Most production autonomous agents do not run in a vacuum. They run inside cloud infrastructure: virtual machines, containers, pods, managed clusters or private servers. That is where most operations teams start monitoring. Is the VM alive? Is the container running? Did the pod restart? Is memory stable? Is CPU too high? Did the health check pass? Those signals are useful. They tell you whether the shell around the agent is alive. They do not tell you whether the agent inside is actually operational ...

Enterprise IT environments have never been more observable ... Yet many organizations still grapple with outages, lengthy incident resolution cycles, and increasing complexity. Most teams do not suffer from a shortage of data. They struggle to determine what deserves attention and what action to take next ... Enterprise IT operations must move beyond monitoring and visibility. The next stage of maturity is decision operations, an approach that helps teams make faster, better-informed decisions ...