There might be pricing pressure, and a lot of people entering the space, but it is more than a nice to have. If you do not have some sort of SIEM solution, you will pay more for or not be insurable for cybersecurity/ransomware insurance.

Implementing observability/SIEM yourself has also become a lot more complicated because the domain of things that have to be observed is increasing. There are many organizations now that have things that need to be monitored in several clouds, infrastructures like k8s, and stuff on prem. So you need a vendor that has the tools to collect this data easily and aggregate it.

The startup world and startup whales might be dying now. But there is a giant iceberg of companies that are becoming more hybrid and their systems that used to do things like funnel syslogs and firewall flow logs to a collector are no longer adequate.