Exabeam ‘Reinventing’ MSSP Model In SIEM Partner Push: Channel Chief

The company is seeking to accelerate its work with the channel through a new commercial model for MSSPs and enhanced incentives launching in January, Exabeam Global Channel Chief Craig Patterson tells CRN.

Exabeam is seeking to accelerate its work with the channel around the massive SIEM opportunity, including with a new commercial model for MSSPs and enhanced incentives for VARs launching in January, Global Channel Chief Craig Patterson told CRN.

The moves come in connection with Exabeam’s recent debut of its new Apex Partner Program, which unifies the programs from Exabeam and LogRhythm following the merger of the two major SIEM (security information and event management) vendors in 2024.

Key components that have already rolled out to partners include a unified partner portal and refreshed training, but a number of updates are forthcoming as of Jan. 1, Patterson (pictured) said in an interview. Those include a new commercial model for MSSPs that addresses a main point of friction with the prior model.

In the past, there hasn’t been a clear way for an MSSP to consume a single license and then allocate its license across its customer base, which often will vary in size by organization, Patterson said.

“We’re reinventing that right now,” he said. “As we launch Jan. 1, we'll be rolling out a new commercial model that will be solving that particular gap that the MSSPs presented to us.”

Among Exabeam’s global base of about 3,000 partners, roughly a quarter are MSSPs, Patterson noted.

For the company’s VAR partners, meanwhile, Exabeam has overhauled numerous aspects of its channel effort with the new Apex program launch, he said. That includes a brand-new incentive package featuring revamped rebates, aimed at enabling both the initial sale as well as the retention of the end customer, in addition to new spiffs, according to Patterson.

“Really what we’re trying to achieve here is consistency on sales, quarter over quarter,” he said.

Exabeam is also launching new goals for partners and “including those in a strategic plan, so we can make sure we’re incentivizing [partners] across that entire life cycle,” Patterson said.

The new incentives and an updated deal registration system will launch Jan. 1, he said.

As Exabeam has worked to evolve its program, the vendor has excelled when it comes to including partners in the process, according to Optiv’s Scott Goree.

“They’ve been involving us early as a co-design partner, and that builds that immediate trust,” said Goree, senior vice president for partners, alliances and ecosystems at Denver-based Optiv, No. 28 on CRN’s Solution Provider 500 for 2025. “The fact that we can have these conversations on as they’re designing a program like Apex, that’s meaningful to us.”

SIEM Market Shakeup

The timing is ideal for Exabeam to double down on its work with partners, given the huge demand right now for technologies that can enable security operations transformation, Patterson said.

Exabeam has long been a top provider of UEBA (user and entity behavior analytics) and can offer that tool as a stand-alone offering, in addition to providing UEBA as part of its full SIEM platform, according to Patterson.

When it comes to UEBA, “we are the gold standard in industry,” he said. “We have the ability to overlay and augment all the major SIEM providers out there.”

The expansion drive by Exabeam also comes amid “turmoil happening in the partner space” resulting from shifts in ownership for some of the best-known SIEM vendors, Patterson said. Those included Cisco Systems’ acquisition of Splunk and Palo Alto Networks’ acquisition of IBM’s QRadar SaaS business, both of which closed in 2024.

“There’s this whole pent-up demand from partners coming [from those vendors], and looking for another good option,” Patterson said.

Exabeam was recognized as one of five “leaders” on SIEM in Gartner’s most recent Magic Quadrant ranking for the category, released in 2024.

Standing Out In SIEM

Exabeam has long stood out in the SIEM space for its technology, which is both highly configurable and easier to use than many other vendors, according to Grant Leonard, field CISO at Lumifi, a Scottsdale, Ariz.-based MSSP.

“They’ve always been really good at ensuring high-end users are successful,” Leonard said.

Likewise, “the interface is beyond easy to navigate when I compare it to every other SIEM that’s out there,” he said. “It’s easy to get to where you want, what you want. I can put granular controls around it and extend functionality into a business unit that would not have had it before.”

For instance, there might be a need for a compliance officer to see certain reports that are relevant to their role, but to not have access to other parts of the system, Leonard noted.

“I can control their experience within the tool to allow them do what they want,” he said.

When it comes to working with its MSSP partners such as Lumifi, Exabeam has consistently gone the extra mile, according to Leonard.

“Sometimes you work with the vendor and you get the A-team up front, and then the D-team for support. Or you get a bunch of promises, and then after the second meeting, they’re not there,” he said.

By contrast, Exabeam has “only increased our ability to interact with people in their company,” Leonard said.

All in all, Exabeam remains open to feedback and has shown it is committed to building trust with partners as it looks to expand with the channel, he said.

“It’s not a one-way street,” Leonard said. “They continue to help us [to] help them.”