[Live Webinar] Next-Level O11y: Why Every DevOps Team Needs a RUM Strategy Register today!

Tessian cover

Case Study

How Tessian Migrated to Coralogix in 2 Days for Optimized, Full-Stack Observability


Daily Data Ingestion


Days to Migrate Logs


Reduced Overhead


Saved Per Year


About Tessian

Tessian uses machine learning technology to automatically stop data breaches and security threats caused by human error – like data exfiltration, accidental data loss, business email compromise, and phishing attacks – with minimal disruption to employees’ workflow. As a result, employees are empowered to do their best work without security getting in their way.

Founded in 2013, Tessian is backed by renowned investors like Sequoia, Accel, March Capital, and Balderton, and has offices in San Francisco and London.


Tessian adopted Coralogix as part of their work to consolidate observability tooling and move away from self-hosted solutions. By replacing their homegrown Prometheus instances, the team significantly reduced the amount of time spent on maintenance and firefighting.

They have also reduced their logging costs and streamlined payment by signing up through the AWS Marketplace. In addition to optimizing for spend, Coralogix’s Remote Query capabilities provide unparalleled access to archived data and relieve the pressure on Platform Engineers to support developers with the complex queries previously needed to access log data after the retention period.

Beyond the power of the platform itself, the level of partnership offered by the Coralogix team both during and after the evaluation period really sold the team on the solution. Together with Coralogix’s customer success team, Tessian was able to fully migrate their monitoring systems in just 2 days. With support available 24/7 via in-app chat, Tessian benefits from Coralogix acting almost as an extension of their internal teams.

Driving Motivations to Switch to Coralogix

Like many modern companies, Tessian’s monitoring infrastructure before Coralogix included a variety of solutions, including both self-hosted and managed platforms. Moving towards not only a more centralized, but a more efficient approach to observability became a key focus for the Platform Engineering team.

Tessian’s Platform Engineering team was spending a disproportionate amount of time managing these systems and trying to address their growing costs. The team was constantly pulled to put out fires in Prometheus instances and ensure basic functionality of the system at scale.

Avnish Pundir

Avnish Pundir
Lead Platform Engineer

We started with cost as the primary factor, but by the time we were in the middle of the process, cost became second priority to the support.

The team’s managed logging platform was also frequently a source of overhead and frustration. The platform was not easy for developers to use and only provided access to the logs while they were in hot storage. The team chose a limited retention period due to cost restraints, after which developers would rely on the Platform team for archival log access.

“There were regular exercises of trying to get teams to reduce their logging or renegotiate the contract, if that’s what we needed to do. The onus would be on the dev teams to review how they log. Obviously that’s good practice, but it was taking up more time than it was worth. Overall, we wanted the experience for our developers to be a lot better than it was.” – Niki Tailor, Platform Engineering Manager

Not only was the overall volume of logs problematic, but fluctuation in log generation throughout the week also caused issues with their previous solution. Due to the nature of Tessian’s business, intelligent cloud email security, log volumes fall off over the weekend and spike during business hours.

“We started with cost as the primary factor, but by the time we were in the middle of the process, cost became second priority to the support.” – Avnish Pundir, Platform Engineer

Eventually, the team began an evaluation of new tooling that could act as a full-stack observability platform to consolidate their logs, metrics, and tracing data and reduce overhead for the team.

Migration: From Zero to Hero in 2 Days

Tessian’s Platform team was impressed with Coralogix’s ability to reduce their overall spend while also centralizing all observability data in a single, managed platform. But it was the speed and ease of migration afforded by Coralogix’s world-class support team that showed them the solution’s real power and potential.

“We got access Thursday around lunchtime, and we’d fully migrated by Monday night.” -Oliver Stone, Senior Platform Engineer

Log collection was set up using existing tooling such as FluentD for Amazon ECS logs, and Amazon services and Lambda functions. Not only was there no need to make any changes to their existing setup, the Coralogix team was there every step of the way to offer assistance and guidance according to best practices.

“This is not my first rodeo, but it is certainly the first time I’ve come across a migration that has been that ridiculously fast. Being able to lift and shift the whole thing in that period of time, and then just get better and better over the weeks afterwards, it’s ridiculous. It shouldn’t be possible.” – Robert Small, Platform Architect at Tessian

Whereas many platforms require implementation of a custom agent or complicated configurations that demand the purchase of additional services to get working, Coralogix partners with customers to ensure a seamless transition from previous solutions and optimal value from the platform.

“Would we have been able to do a migration in just 2 days with another vendor? Probably not, given the evaluation that we’ve done.” – Niki Tailor, Platform Engineering Manager

The initial migration of log data to Coralogix took just 2 days to complete with the platform already being actively used. Within 3 months, the platform was fully optimized with all logs, metrics, and tracing data being sent to the platform with seamless onboarding and adoption of the platform across the organization.

Oliver Stone

Oliver Stone
Senior Platform Engineer

We got access Thursday around lunchtime, and we'd fully migrated by Monday night.

Streamlining Dev Access to Secure Logs

As part of their security protocols, to ensure data protection, the team at Tessian encrypts parts of their logs before sending them to any external vendor. That means that when engineers want to access the logs, they can do so in the Coralogix platform but parts of the logs need to be decrypted to view them.

In the previous solution, the engineer would run their queries, download the logs, pick up the specific encrypted base, and then decrypt them using a standalone tool. During the migration to Coralogix, the team wanted to streamline this process by extending that tool.

The team adapted the functionality of the tool to accept the link from the Coralogix UI, which includes the exact parameters of the query including the timeframe, to automatically download and decrypt the logs. This gives them the ability to maintain their security posture without compromising the engineer’s ability to do their job.

This significant improvement to workflow was made not only possible but simple, using out-of-the-box support for the Elastic API and Coralogix’s persistent URL format.

The Extended Value of Partnering with Coralogix

The value of Coralogix goes beyond centralizing observability data with optimized cost of ownership. Coralogix partners with each customer to provide continuous support and insights to ensure their data is actionable.

Unlike other vendors that charge extra for onboarding, support, and professional services, Coralogix provides world-class customer support for every user with a 24/7 in-app chat service and under 1 minute response time for every customer.

Robert Small

Robert Small
Platform Architect

The support we are definitely getting is better value for our spend, but it’s not just support. It’s the fact that everything is better but we’re not having to pay ridiculous prices to have everything be that much better.

In addition to providing the support needed to run a smooth migration, Coralogix’s customer success team helps to offload the ongoing maintenance and support efforts of the Platform team and provides expert guidance to continually optimize their systems.

“The Coralogix team was not afraid of going the extra mile, guiding us through, and even recommending better ways to do something. In a word, two great teams working together produce great results. That’s something which is very true in this engagement.” – Avnish Pundir, Platform Engineer

Your data is telling yesterday’s story —
Find out what it can tell you today.

Live Webinar
Next-Level O11y: Why Every DevOps Team Needs a RUM Strategy
April 30th at 12pm ET | 6pm CET
Save my Seat