Security Incident and Event Management (SIEM): A Plain-English Guide

Security incident and event management, better known by the acronym SIEM, is the technology that pulls together the logs from across your IT systems, spots the patterns that point to an attack, and raises an alert before a small problem becomes a breach. The formal name is security information and event management, but plenty of people search for “security incident event management” because that is what it feels like in practice: a system for catching security incidents from the flood of events your network produces every day. This guide explains what SIEM actually does, why cyber insurers and Cyber Essentials assessors keep asking about it, and how a UK small business should think about whether it needs one.

What SIEM actually does

Every device on your network writes logs. Servers record logins, firewalls record connections, cloud apps record file access, laptops record software installs. On their own these entries are meaningless noise. A single failed login is nothing. Fifty failed logins from three different countries in five minutes, followed by one success and a large download, is an attack in progress.

SIEM does three jobs that turn that noise into something useful:

• Collection. It gathers logs from every corner of your environment into one place, so you are not logging into a dozen separate consoles to piece together what happened.
• Correlation. It links related events across systems and applies rules and, increasingly, machine learning to flag the combinations that matter. This is where the failed-login example gets caught.
• Retention and reporting. It stores the logs securely for months or years, so that after an incident you can reconstruct exactly what happened and when. That audit trail is what an insurer’s claims team, or the ICO, will ask for.

Think of it as the central nervous system of your security. Endpoint tools protect individual laptops, firewalls guard the perimeter, but SIEM is the thing watching the whole picture at once.

SIEM, EDR and antivirus are not the same thing

People muddle these three, so it is worth being clear. Antivirus scans files for known malware. EDR (endpoint detection and response) watches the behaviour of a device and can isolate it if something looks wrong. SIEM sits above both, collecting the signals they produce along with everything else, and correlating them so a threat that moves between systems is not missed.

A modern setup usually runs EDR on the endpoints and feeds its alerts into a SIEM. If you are still weighing up the endpoint layer, our guide to EDR versus antivirus covers why underwriters no longer accept basic AV, and our overview of endpoint security management explains how the pieces fit together.

Why insurers and Cyber Essentials keep asking about it

Cyber insurance underwriting has tightened sharply. Insurers learned the hard way that businesses without monitoring cannot tell them how a breach happened, which makes claims slow and expensive. So the proposal form now asks whether you have centralised log management and continuous monitoring. SIEM is the control that answers yes to both.

It does not tick every box. Continuous monitoring and log retention are covered directly by SIEM; controls like multi-factor authentication, backups and staff training sit elsewhere. But because SIEM produces the auditable evidence that a claim or a regulatory investigation depends on, having it strengthens your whole application. Our security controls checklist sets out the full list of what insurers now expect, and the wider cyber security risk assessment guide shows how to work out which controls your business actually needs first.

For Cyber Essentials, SIEM is not one of the five controls and is not required to pass. It becomes relevant at the Cyber Essentials Plus and ISO 27001 level, and for any business that has to prove ongoing monitoring to win contracts.

Does a small business actually need one?

Honestly, not every one does. A five-person consultancy running Microsoft 365 with MFA, managed endpoints and good backups may get most of the monitoring value from the security tooling already built into its cloud platform. Buying and running a full SIEM on top would be over-engineering.

The picture changes when any of these apply:

• You handle sensitive personal data or regulated information and need to prove monitoring to clients or regulators.
• You have on-premise servers, multiple sites, or a mix of cloud platforms that no single console covers.
• Your cyber insurer or a big customer’s supplier questionnaire is asking for centralised logging and threat detection.
• You have grown past the point where one person can keep an eye on everything by hand.

If two or more of those ring true, monitoring stops being optional and SIEM becomes the practical way to deliver it.

Running it yourself versus managed SIEM

A SIEM platform is only as good as the person reading its alerts. Left unwatched it becomes an expensive log bucket that quietly buries real warnings under false positives. This is the trap small businesses fall into: they buy the tool, nobody tunes it, and the alerts get ignored.

That is why most smaller organisations use managed SIEM, where a security provider or a managed detection and response service runs the platform, tunes the rules, and watches the alerts around the clock so you are not staffing a night shift. You get the monitoring and the evidence trail without hiring a security operations team. Our guide to managed cyber security services explains what to look for in a provider and the questions worth asking before you sign.

The trade-off is cost and control. Self-hosting an open-source SIEM is cheaper on licensing but demands real in-house expertise. Managed SIEM costs more per month but is the only realistic route for a business without a dedicated security function.

How to get started sensibly

You do not need to solve everything at once. A sensible order for a UK small business is:

1. Get the basics right first: MFA everywhere, managed endpoints, tested backups and patching. SIEM watches over these controls; it does not replace them.
2. Turn on and actually review the security and audit logging already included in your cloud platforms, so you understand what you have before buying more.
3. Run a cyber security risk assessment to identify what you genuinely need to monitor and why.
4. If the risk assessment and your insurer point to centralised monitoring, scope a managed SIEM or MDR service sized to your environment, not the enterprise tier a vendor would love to sell you.

The National Cyber Security Centre’s logging and protective monitoring guidance is a free, vendor-neutral starting point that explains what good monitoring looks like without pushing a product.

Frequently asked questions

What is security incident and event management (SIEM)? It is a system that collects logs from across your IT environment, correlates events to spot patterns that indicate an attack, and stores those logs so you can investigate afterwards. The formal name is security information and event management, though many people call it security incident event management because its job is to surface real security incidents from ordinary event noise.

What is the difference between SIEM and EDR? EDR watches the behaviour of individual devices and can isolate one that looks compromised. SIEM sits above the endpoints, gathering signals from EDR, firewalls, servers and cloud apps and correlating them so a threat that moves between systems is caught. Most modern setups run EDR on endpoints and feed its alerts into a SIEM.

Do small businesses need SIEM? Not always. A small, cloud-only business with MFA, managed endpoints and good backups may get enough monitoring from its existing platform tools. SIEM becomes worthwhile when you handle sensitive data, run mixed or on-premise systems, or when an insurer or major customer asks for centralised logging and continuous monitoring.

Does cyber insurance require SIEM? Not universally, but insurers increasingly ask whether you have centralised log management and continuous threat detection, and SIEM is the control that answers both. It also produces the audit trail a claims team needs, so having it strengthens an application even where it is not strictly mandatory.

Is SIEM part of Cyber Essentials? No. SIEM is not one of the five Cyber Essentials controls and is not needed to pass basic certification. It becomes relevant at the Cyber Essentials Plus and ISO 27001 level, and for businesses that must prove ongoing monitoring to win or keep contracts.

What is managed SIEM? Managed SIEM is where an external security provider runs the platform for you, tuning the detection rules and monitoring the alerts around the clock. It is the practical option for most small businesses because a SIEM is only useful if someone is actually watching and acting on what it flags.