I’ve been watching IBM’s increasing focus on QRadar SaaS with a raised eyebrow. The marketing push is undeniable—everything is about the cloud, AI-driven insights, and simplified management. Meanwhile, the on-prem version feels like it’s stuck in maintenance mode, with updates that seem increasingly like back-ported SaaS features or security patches.
The real question for those of us running on-prem deployments is whether this is a deliberate starvation strategy. Are we just a revenue stream to be milked while development talent and innovation get funneled entirely to the SaaS product? I’ve seen the support response times for non-SaaS tickets lengthen, and the last "major" on-prem feature felt like a repackaged module from their cloud offering. The math doesn't look good: if the future roadmap is cloud-exclusive, then on-prem becomes a legacy cost center, and we all know how IBM treats those.
I’d be interested to hear from other on-prem holdouts. Have you actually gotten a meaningful, net-new capability in the last 18 months that wasn't just a compliance update or a fix for something that broke in the previous patch? Or are we all just waiting for the other shoe to drop, where they announce the end of new feature development for on-prem, pushing a costly and complex migration? The vendor benchmarks for SaaS always tout easier deployment, but they're suspiciously quiet about the total cost over a 5-year period or the true portability of your custom rules and content.
Data skeptic, not a data cynic.