Real migrations. Real savings.

Sentinel's classified networks ran a commercial observability platform that was always two or three major versions behind. Every upgrade required importing an entire monolithic software package through a one-way transfer — USB drives, DVDs, and sneakernet — even when only a single feature was actually needed. As Splunk's own engineers acknowledged at .conf19, getting data across an air gap is a nightmare: "A resounding no!" was their assessment of the most common approach. Sentinel's team spent weeks per upgrade cycle coordinating physical media transfers, re-validating security controls, and re-certifying the environment — only to discover that the new version introduced cloud-dependent "phone home" features that broke in disconnected mode. Meanwhile, known vulnerabilities sat unpatched because the next full version wasn't approved yet.

ExitGraph deployed forward-deployed engineers with active security clearances directly into Sentinel's classified environment. Instead of importing a monolithic commercial platform, the team built an open-source observability stack — OpenTelemetry collectors, Prometheus-compatible metrics, and structured log pipelines — that could be tailored and improved incrementally while running on the air-gapped network. Need a new alerting rule? Add it. Need a different retention policy? Change it. No waiting for the vendor's next major release. No importing 40 GB of software to get one minor feature. The platform adapts and gets refined over time until it's exactly what the mission requires.

By deploying on infrastructure the customer already controlled, the implementation was dramatically faster than previous commercial tool upgrades. The team eliminated the quarterly "upgrade dread" cycle entirely. Sentinel now runs observability that evolves continuously inside the perimeter — no data leaves, no vendor dependencies, no forced version upgrades that break air-gapped operations.

Atlas ran Splunk Enterprise across AWS and Azure for log management and security monitoring. Their annual Splunk license renewal was approaching $1.2 million, and the platform team had been told to find alternatives. But every vendor they evaluated wanted to deploy their own infrastructure — new clusters, new storage backends, new networking rules — adding months of procurement, security review, and compliance certification. Atlas already had well-provisioned Kubernetes clusters, S3-compatible object storage, and a mature DevOps team. They didn't need another vendor's infrastructure. They needed someone to build the right observability stack on what they already had.

ExitGraph's approach was fundamentally different: deploy on the customer's existing cloud. The team provisioned the open-source stack directly on Atlas's existing EKS clusters and S3 buckets — no new infrastructure procurement, no new vendor security reviews, no additional cloud accounts. Because the target-state platform ran on infrastructure Atlas already owned and operated, the security and compliance teams had far less to review. The SOC 2 Type II audit scope didn't expand because no new third-party data processors were introduced. Atlas's existing IAM policies, VPC configurations, and encryption standards applied automatically.

Implementation took six weeks — 60% faster than Atlas's previous platform migrations. The team eliminated $1.2 million in annual Splunk licensing while gaining full ownership of their observability data. Because the stack runs on Atlas's own infrastructure, there are no per-GB ingest fees, no per-host charges, and no surprise invoices. Costs scale with the infrastructure they already budget for.