June 2026 Summaries

In the June 2026 DevRel newsletter by the Elastic DevRel team, the focus is on the release of jina-embeddings-v5-omni, a model that integrates seamlessly with the Elastic Inference Service to handle text, images, audio, and video in a unified embedding space, enabling comprehensive multimodal search capabilities across varying media types with a single index. This new model, stemming from Elastic's acquisition of Jina AI in 2025, provides a compact and efficient alternative to larger, slower models, boasting superior performance on benchmarks like Charades-STA. It facilitates cross-modal queries, allowing, for example, a text query to retrieve a relevant video frame, and highlights its integration with Elasticsearch, ensuring backwards compatibility and storage efficiency through innovations like Better Binary Quantization and Matryoshka representation learning. Additionally, the newsletter highlights various blogs, videos, and upcoming events, offering insights into Elastic's ongoing projects and community engagements, while cautioning users about the use of generative AI tools and emphasizing the importance of understanding their privacy practices.

Elastic has significantly reduced the cost of TSDS metrics on Elastic Observability Serverless by 75%, pricing them at 25% of the standard per-GB rate for both ingestion and retention. This pricing change makes Elastic's offering much cheaper than competitors like Datadog, as Elastic charges based on data volume rather than per host or custom metrics, leading to substantial cost savings, especially in high-cardinality and densely instrumented environments. The revamped metrics platform, built around a columnar storage engine for time series data, enhances efficiency by allowing metrics to be stored up to 2.5 times more efficiently and reducing query latency by up to 30 times compared to competitors. These improvements, along with native Prometheus ingest and PromQL support, enable Elastic Observability to offer significant cost savings of over 50% in illustrative comparisons with Datadog, demonstrating its efficiency and cost-effectiveness in managing metrics.

Australian businesses are increasing their AI budgets despite previous overspending, driven by the misconception that high AI usage equates to productivity gains, a phenomenon known as "tokenmaxxing." Research by Elastic highlights that many companies are not effectively measuring AI's return on investment, with only a small percentage tracking revenue or cost savings. The main issue lies in the data foundation, as poor data quality forces AI models to consume more resources, leading to higher costs without corresponding benefits. Additionally, AI adoption is outpacing governance, with insufficient monitoring and risk management practices in place. Companies are funding AI expansion by reallocating budgets from areas like IT infrastructure and operations, but caution is advised against diverting funds from cybersecurity. The workforce impact of AI is nuanced, as automation of routine tasks allows employees to focus on strategic initiatives, and many businesses are creating new AI-focused roles. To ensure sustainable AI investment, businesses must prioritize building strong data foundations and support the human element alongside technological advancement.

A SaaS provider of enterprise digital safety software significantly improved its security operations by migrating from a legacy QRadar system to Elastic Security on Elastic Cloud, with the assistance of UnderDefense, an Elastic partner. This transition involved a comprehensive log ingestion audit, the creation of over 100 custom detection rules aligned with the MITRE ATT&CK framework, and the development of 25 tailored Kibana dashboards for different organizational roles. As a result, the company achieved an 85% reduction in security incidents and a 61% decrease in mean time to respond, transforming its two-person security team from reactive triage to proactive threat hunting. The migration also addressed compliance challenges by implementing audit-ready data retention with Elastic frozen-tier snapshots, optimizing storage costs and ensuring regulatory adherence. This shift not only enhanced operational efficiency and visibility but also strengthened the company's market position by providing documented, reproducible audit evidence that meets enterprise customer demands.

Elastic CEO Ashutosh Kulkarni announced a reorganization that includes a 7% workforce reduction, driven by the need to adapt to industry changes such as AI and automation, and to meet evolving customer expectations. This restructuring aims to simplify operations, with a focus on innovation and investment in new skills, ensuring the company remains competitive. While some areas, particularly customer-facing sales, will see team growth, other areas will operate with leaner teams due to technological advancements. Engineering will be streamlined into three core areas to enhance accountability and focus. Despite the workforce reduction, Elastic is optimistic about future growth and plans to increase its total headcount over the fiscal year. The company remains committed to leading in its sector and is poised for continued success, as reflected in its forward-looking statements.

Elastic 9.4 introduces two innovative tools for custom integrations: Automatic Import and Integration Skills, catering to both no-code and full-code development needs. Automatic Import simplifies the integration process by supporting multiple data streams and automating various tasks such as ECS mapping and Fleet installation, allowing users to continue working without interruption while integrations process in the background. It is particularly beneficial for security teams seeking immediate value from custom integrations. Integration Skills, on the other hand, is a comprehensive, open-source toolkit for developers seeking full lifecycle control over integration development, compatible with various AI-powered coding environments. This tool is designed to streamline the integration process through agentic workflows that cover research, creation, and maintenance, providing a structured and efficient approach for developers. Elastic's unique approach in version 9.4 distinguishes it from competitors by offering both a user-friendly no-code option and a robust, developer-driven toolkit simultaneously, ensuring a tailored experience for security analysts and developers alike.

Financial institutions are advancing towards an agentic security operations center (SOC) model to combat increasingly sophisticated AI-driven cyber threats, which are overwhelming traditional security operations with high alert volumes and fragmented tools. This model leverages agentic AI systems that enhance human expertise by reasoning across vast data sets, correlating signals, and automating parts of response workflows, without replacing analysts. The effectiveness of these AI systems hinges on the availability of unified and contextual enterprise data, as fragmented data limits their ability to accurately identify threats. Financial services, with their history in data-driven risk management, are uniquely positioned to adopt agentic SOCs, which offer improved threat detection, reduced alert fatigue, and strengthened cyber resilience. This shift is supported by regulatory frameworks emphasizing continuous monitoring and operational continuity. The success of agentic SOCs depends on a holistic enterprise data strategy that ensures real-time access to structured and unstructured data, explainable analytics, and strong governance. As institutions transition from AI experimentation to large-scale implementation, those investing in unified data architectures and contextual intelligence will be better equipped to tackle future cyber challenges.

Elastic has been recognized as a Leader in the IDC MarketScape: Worldwide SIEM 2026 Vendor Assessment due to its architecture, deployment flexibility, detection engineering, and AI capabilities. As security teams face increasingly complex environments and higher demands for data security, Elastic offers a unified platform for SIEM, XDR, and automation, built on Elasticsearch, which supports scalability and observability. The platform provides a consistent user experience across various deployment models and allows for flexible AI integration, enabling teams to prevent, detect, investigate, and respond to threats efficiently. Elastic's approach emphasizes transparency and control over AI processes, offering customizable AI agents and workflows to fit individual security operations. This recognition highlights Elastic's emphasis on reducing tool fragmentation, operational complexity, and enhancing response times through AI-driven investigations and native automation.

Elastic has been recognized as a Strong Performer in The Forrester Wave™: Extended Detection And Response Platforms, Q2 2026, for its innovative approach to security solutions. The report highlights Elastic's strong SIEM-replacement capabilities, open data architecture, and AI-driven innovations such as Automatic Migration and Attack Discovery, which streamline security operations by automating routine tasks and enhancing threat detection. Elastic's platform is distinguished by its flexibility, allowing security teams to ingest data from various sources and customize their workflows, reducing vendor lock-in and adapting to unique organizational needs. The company’s commitment to open standards and transparency is reflected in its open architecture, which minimizes the costs associated with switching platforms and enhances integration capabilities. Additionally, Elastic's endpoint protection, rooted in its Endgame acquisition, has shown consistent efficacy, achieving high ratings in independent malware protection tests. The platform is designed to eliminate barriers found in traditional security stacks, offering unified SIEM, XDR, and native automation without additional licensing fees, thereby enabling real-time access to historical data and fostering an agentic security operations center.

The blog post discusses the integration of Claude's Compliance API with Elastic Security to enhance monitoring and security operations. It details how the Compliance API tracks over 300 event types within Claude systems, providing information on users, sign-ins, configuration changes, and more, all of which can be ingested into Elastic Security. The integration enables security teams to search, detect, and investigate risky activities using AI-powered detection rules and prebuilt dashboards, offering a comprehensive view of Claude activities alongside existing security telemetry. Additionally, the post highlights how pairing Compliance API data with runtime telemetry from Claude Code and Cowork via OpenTelemetry can provide a complete picture of both administrative changes and agent behavior. The integration supports seamless investigations, compliance reviews, and security operations without needing a separate SOAR, while emphasizing the importance of understanding and using third-party generative AI tools responsibly.

Elastic Security introduces a novel approach to compliance using its Elastic Agent Builder, which integrates agentic compliance skills to enhance security telemetry analysis, enabling teams to shift from static posture reviews to dynamic response workflows. This approach is first implemented with a PCI DSS v4.0.1 compliance skill, utilizing a composable skill model for interactive compliance experiences. It facilitates scope discovery, compliance evaluation, and data gap identification with ES|QL-backed checks, offering an evidence-driven approach to compliance rather than a simple "push-button" solution. The skill aids users in discovering PCI-relevant data, evaluating requirements, generating compliance reports, and handling non-standard data, while maintaining transparency and audit readiness. Elastic's method acknowledges the limitations of automated compliance checks, emphasizing the importance of manual verification for certain requirements and the need for clear communication of confidence levels and data limitations. This initiative marks a step towards a broader compliance-as-code model, potentially applicable to various frameworks, and underscores the importance of grounded, evidence-backed compliance auditing that leverages live operational data.

OMB Memorandum M-26-14 introduces a new compliance framework for cybersecurity logging within US federal agencies, replacing the previous M-21-31 model with a risk-based, outcome-driven approach to address the rapidly evolving threat landscape, including AI-enabled attacks and complex IT environments. The new directive emphasizes the importance of maintaining searchable and accessible logs, enabling effective threat detection and response through Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response, and Forensics (THIRF). By reducing retention requirements and allowing decentralized storage, M-26-14 aims to alleviate issues faced under the previous model, such as high storage costs and inconsistent log formats, while enhancing interoperability and data sharing among agencies. With a tighter compliance timeline and integration of Zero Trust principles, the memo requires agencies to assess their current capabilities, identify gaps, and develop comprehensive logging plans aligned with CISA's forthcoming Logging Reference Architecture (LRA). Elastic's secure, AI-powered logging platform is highlighted as a suitable solution to meet these new requirements, offering decentralized storage, scalable search capabilities, and integration with CISA's systems, underscoring the critical need for agencies to build resilient, future-proof cybersecurity infrastructures.

Artificial intelligence and quantum computing are poised to transform the financial services sector, with a focus on contextual intelligence platforms that integrate vector search, observability, and security. Quantum computing is being explored for applications like portfolio optimization and fraud detection, with McKinsey predicting a potential economic impact of $1.3 trillion to $2.7 trillion by 2035. As financial institutions transition to AI-native and quantum-enhanced architectures, operationalizing, securing, and governing autonomous systems are emerging as key challenges. The importance of vector search is highlighted, as it allows retrieval based on semantic meaning, enhancing AI performance in applications such as fraud detection and customer service. Observability is evolving beyond infrastructure monitoring into a real-time operational intelligence layer, essential for understanding AI outcomes and troubleshooting hybrid environments. The security landscape is also changing, with a focus on post-quantum cryptography standards and the development of contextual intelligence architectures that combine vector search, semantic retrieval, and real-time analytics. The convergence of these technologies is forming a new architectural model that supports AI-native operations, potentially offering significant competitive advantages in the next decade.

Agentic Security Operations Centers (SOCs) are emerging as a critical response to the increasing use of AI in cyberattacks, which demand rapid detection and response times that outpace traditional security measures. These AI-driven SOCs, such as those offered by Elastic, incorporate autonomous agents that manage the full security threat lifecycle, allowing human analysts to focus on judgment and verification while maintaining transparency and oversight. Elastic's platform aims to address key challenges in the public sector, such as fragmentation of systems and slow response times, by providing a unified, open-source solution that integrates seamlessly with existing infrastructures, including air-gapped environments. This approach not only reduces the operational costs and inefficiencies associated with fragmented security tools but also accelerates response times by providing real-time context and automated narratives for alerts. As governments globally, including the United States, adopt AI-powered cybersecurity measures, there is a strong emphasis on ensuring transparency and understanding of AI operations, aligning with joint guidance from international alliances like the Five Eyes. Elastic's agentic SOC platform is positioned as a scalable solution that enhances visibility, reduces alert fatigue, and improves overall cybersecurity resilience, achieving notable reductions in security incidents as validated by independent assessments.

Jesse Sladek discusses the evolving role of partners in the technology landscape, emphasizing their growing importance in helping customers navigate changes driven by AI and platform consolidation. As enterprises shift towards fewer, more comprehensive platforms to reduce complexity and costs, Elastic is positioned as a key player with its AI-powered search, observability, and security operations on a unified data layer. The recent integration of Elastic with Dell and NVIDIA highlights its strategic role in the enterprise AI infrastructure. Sladek underscores the need for clarity, alignment, and opportunity within the partner ecosystem, advocating for a unified leadership team to enhance partner experiences and investment returns. He highlights Elastic's expanding partnerships with major cloud providers and emphasizes the importance of early adoption in capitalizing on the current platform cycle. As Elastic continues to invest in its partner program, Sladek invites partners to collaborate and capitalize on the opportunities within Elastic's ecosystem, particularly as it expands into AI-driven solutions.

Data gravity, which refers to the increasing difficulty and cost of moving and analyzing large volumes of data, poses a significant challenge to effective AI security in Security Operations Centers (SOCs). With 88% of organizations using multiple tools for threat detection and response, fragmented infrastructure hinders AI's ability to quickly and accurately identify threats. To counteract data gravity, SOCs are encouraged to adopt unified search, open standards, flexible storage tiering, and AI-native architectures, which can streamline processes, reduce costs, and improve threat response times. Unified search allows analysts to query data across multiple systems without unnecessary duplication, while open standards prevent vendor lock-in and facilitate integration. Flexible storage tiering optimizes the balance between performance and cost by categorizing data into fast-access, interactive, long-term, and offline tiers. An AI-native foundation embeds intelligence directly into workflows, enabling faster and more proactive threat detection. By addressing these aspects, organizations can transform data from a burden into a strategic asset, enhancing their security posture and reducing incident response times.

LivePerson's observability team undertook a benchmarking study across five GCP machine types to optimize Logstash and Kafka performance, highlighting that infrastructure selection is crucial for cost optimization at scale. They discovered that the n4d-standard-2 (AMD Milan) machine type offered over 100% throughput improvement on Logstash compared to the e2-standard baseline, and similar gains were achieved on Kafka through the use of LZ4 compression instead of GZIP. These optimizations led to a significant reduction in processing costs, from $5.95 to $2.70 per 1,000 events per second, and allowed for a smaller Kafka cluster with reduced overhead. The study underscores the importance of recurring infrastructure benchmarking, as cloud providers frequently update instance families, and what was once cost-effective may no longer be competitive. This methodology is particularly relevant for high-volume observability workloads where compute efficiency directly influences cost and pipeline stability, and the insights gained are applicable beyond GCP to other cloud platforms like AWS and Azure.

Elastic in 2026 introduced several advancements aimed at enhancing AI, search, and security capabilities for Azure developers, notably with the integration of Elastic Inference Service and Elastic Agent Builder. The platform now supports a unified Elasticsearch index for diverse media types, enabling efficient retrieval across text, images, video, and audio. Enhanced context management and skills in AI agents improve accuracy in long conversations, while native Microsoft 365 connectors streamline data retrieval. Elastic's metrics engine, rebuilt with a columnar design, significantly boosts storage efficiency and query performance for OpenTelemetry data. Additionally, Elastic Security Labs developed a CI/CD pipeline detector to thwart attacks on GitHub Actions and Azure DevOps, while the introduction of MCP Apps facilitates seamless integration within VS Code Copilot. These updates position Elastic as a comprehensive solution for AI, observability, and security within the Azure ecosystem, offering tools for efficient data management and threat detection.

In the AI era, protecting critical infrastructure has become increasingly complex due to the rise of AI-powered cyber threats and the interconnected nature of systems via IoT devices. Traditional security measures are proving inadequate as AI-driven attacks grow in sophistication, necessitating modern security frameworks that ensure real-time visibility, detection, and response. A robust data foundation is essential, as data is both a valuable asset and a vulnerability that attackers exploit. Critical infrastructure, including energy, transportation, finance, telecommunications, and healthcare, relies on safeguarding sensitive data to prevent disruptions. This requires innovative strategies such as Zero Trust Architecture, which minimizes unauthorized access and enhances visibility, and threat hunting, which proactively identifies threats that may bypass automated defenses. Elastic offers AI-enabled security solutions, such as an agentic security operations platform, that streamline incident response and enhance resilience. By adopting these advanced measures and fostering a unified data approach, organizations can protect critical infrastructure from modern threats while maintaining operational efficiency.

Financial services companies face significant pressure to implement AI solutions, promising enhanced customer experience, reduced risk, and improved operational efficiency, with 42% planning to increase spending on AI agents in 2026. However, the main challenge in scaling AI lies in unifying fragmented data and enforcing governance, as poor data quality can undermine trust and regulatory compliance. Early AI adoption focused on customer-facing applications, but the emphasis has shifted to strengthening infrastructure, data, and governance. Organizations are now treating AI as an enterprise capability, requiring robust data foundations, pervasive governance, comprehensive observability, and cross-functional collaboration to drive business value and mitigate risks. Success in AI deployment depends on starting with small projects, ensuring secure agentic AI systems, and leveraging partnerships with technology providers to build a scalable, resilient AI architecture.