How Securonix reduced cache costs by 20% with Amazon ElastiCache for Valkey

When protecting over hundreds of global enterprises from cybersecurity threats and processing millions of security events per second, system performance isn’t just a benchmark, it’s mission critical. Securonix, a six-time Gartner Magic Quadrant Leader for Security Information and Event Management (SIEM), delivers AI-powered security analytics and operations at enterprise scale. The system combines SIEM, User and Entity Behavior Analytics (UEBA), and Security Orchestration, Automation and Response (SOAR) capabilities into a unified, cloud-native solution.

In this post, we share how Securonix migrated hundreds of Amazon ElastiCache clusters from Redis OSS to Valkey, achieving a 20% reduction in caching costs. This amounts to over $100,000 in annualized savings. The migration also improved CPU utilization and overall throughput across Securonix’s global SIEM platform, which processes hundreds of terabyte data volumes daily for enterprise security teams worldwide.

Challenges with scaling constraints and rising costs

Securonix operates a cloud-native SIEM platform that processes multi-terabyte data volumes per day relying heavily on caching to deliver the sub-millisecond response times required for threat detection and security orchestration. With hundreds of ElastiCache clusters across multiple regional deployments, cache throughput requirements were increasing an estimated 20–30% year over year. Their caching infrastructure needed to evolve to keep pace with growing demand. Under bursty, high-ingestion workloads, the team observed increased latency during peak loads, and inefficient resource utilization led to over-provisioning in some clusters to absorb peak demand. Optimizing cost and performance became a priority.

At the scale Securonix was operating, the single-threaded caching layer became a bottleneck. During peak loads, CPU utilization spiked sharply, requiring additional nodes to handle traffic, which increased costs and operational complexity.

Faced with these compounding pressures, Securonix sought a more efficient and cost-effective caching solution that could scale alongside their platform’s growth. This led them to explore Amazon ElastiCache for Valkey as a cost-effective alternative.

Solution overview

Securonix partnered with AWS to evaluate a path forward from their existing Amazon ElastiCache for Redis OSS deployment. The goal was to address their infrastructure challenges while positioning them for continued growth.

The decision to migrate to ElastiCache for Valkey was driven by several factors. As a Linux Foundation-hosted, open source fork of Redis 7.2, Valkey maintains full protocol compatibility, making it a straightforward transition from their current ElastiCache for Redis OSS environment. The managed service model they already relied on would continue to reduce operational overhead at scale, while Valkey’s multi-threaded architecture improves CPU utilization during peak workloads.

Valkey’s multi-threaded architecture delivers up to 230% improved throughput, which reduces the need for additional read replicas during scaling. From a cost perspective, ElastiCache for Valkey offers approximately 20% cost savings on node-based clusters. Additional benefits included up to 20.6% lower memory consumption and full compatibility with existing Jedis client libraries, requiring zero application code changes during migration.

Securonix’s deployment was designed around a per-tenant model with cluster mode disabled for isolated workloads. Other clusters use cluster mode enabled to support microservices at scale, spread across AWS Regions to support their global customer base and data residency requirements. This architecture serves three distinct workload types:

• SIEM platform: Caching layer for data ingestion and query performance, storing threat intelligence indicators, entity attributes, and geolocation data for real-time enrichment and correlation.
• SOAR workflows: Shared clusters supporting short-lived sessions, JWT token management, distributed logging, workflow state including rate limiting and quotas, and session authentication.
• Spark jobs: Enrichment data lookups for each customer, including user metadata, security policies, and detection rules.

Together, the per-tenant clusters handle data-intensive SIEM ingestion and Spark enrichment in isolation, while the shared microservice clusters provide low-latency session and workflow state management across tenants. This enables Securonix to balance tenant isolation with operational efficiency at scale.

The following diagram illustrates the solution architecture.

Executing a phased migration at enterprise scale

The migration was completed in two weeks across 250+ clusters. The first sprint focused on proof-of-concept validation and compatibility testing. After performance benchmarking confirmed readiness, the team executed a phased production rollout without downtime.

Securonix drove the evaluation process, with their engineering team taking the lead on validating the migration path and reviewing cluster configurations. AWS Solutions Architects supported the effort by providing technical expertise from initial proof of concept through final production cutover.

The migration team developed a comprehensive three-phase plan designed to validate performance at each step before proceeding:

• Phase 1 (Compatibility validation): The team analyzed their Redis usage patterns against Valkey’s command set. They identified two primary workloads for initial migration: enrichment lookups (read-heavy operations for identity, asset, and threat intelligence data) and correlation windows (read/write operations for analytics rule state management). Valkey supports all Redis data structures used by both workloads, confirming zero application code changes would be required.
• Phase 2 (Parameter group configuration and one-click upgrade): After compatibility validation, the team created custom Valkey parameter groups mirroring their existing Redis configurations. Using the AWS Management Console’s one-click upgrade feature, the team executed the migration in the development environment. AWS automatically provisioned new Valkey nodes, migrated data without interruption, and maintained service availability throughout.
• Phase 3 (Incremental production cutover): With validation complete, Securonix executed a carefully orchestrated production migration. They began with low-impact customer clusters and progressively rolled out to all 250+ clusters. Each cluster migration was performed as a single in-place upgrade operation through the AWS Management Console, taking approximately 10–20 minutes with zero downtime.

Monitoring and observability

Securonix implemented monitoring using Amazon CloudWatch metrics tailored for ElastiCache for Valkey performance tracking. Valkey’s multi-threaded architecture improved CPU efficiency and allowed each node to handle higher concurrency. Key metrics, including CPU utilization and real-time latency, confirmed that performance was maintained throughout and after the migration, with sub-millisecond response times. One of the most notable post-migration observations was the complete elimination of replication lag that had previously introduced data consistency challenges.

The team also used CloudWatch alarms to monitor cluster health across all regional deployments, providing the operational visibility needed to manage a fleet of 250+ clusters with confidence.

Results

The migration to ElastiCache for Valkey achieved their primary goals: 20% cost reduction while maintaining zero downtime and sub-millisecond latency.

“Our collaboration with AWS reflects a shared commitment to building scalable, secure, and high-performance cloud-native platforms that empower customers to stay ahead of evolving cyber threats. At Securonix, we successfully migrated our Redis-based caching layer to Amazon ElastiCache for Valkey with zero downtime. ElastiCache for Valkey’s low-latency architecture significantly enhanced our high-throughput security analytics pipeline, delivering an over 30% improvement in query performance for real-time threat detection. The migration also drove about 20% overall cost reduction, aided by Graviton-based compute optimization and fully managed clustering with auto-failover. The transition was smooth, eliminating operational bottlenecks while improving resiliency, observability, and scalability across global regions.”

— Sanjeev Kishore Yarnapati, Director of Infrastructure at Securonix

Business impact: The migration delivered a 20% reduction in caching infrastructure costs across all 250+ clusters (approximately $135,000 in annual savings), freeing the team to reinvest in other technical innovations. The zero-downtime migration demonstrated that large-scale infrastructure transitions can be executed without disrupting the enterprise security operations that Securonix’s customers depend on.

Performance enhancements: CPU utilization became more predictable and efficient due to Valkey’s multi-core, asynchronous I/O model. This reduced the need for additional read replicas during peak workloads, allowing each node to handle higher concurrency. Sub-millisecond latency was consistently maintained for enrichment and correlation workloads.

Operational benefits: Full Redis protocol compatibility meant zero application code changes were required across the entire fleet. ElastiCache’s in-place upgrade path delivered consistent, auditable migration across 250+ clusters while preserving operational simplicity for ongoing scaling, patching, backups, and high availability management.

Lessons learned and best practices

Through their migration journey, Securonix gained valuable insights that can benefit other organizations considering a similar transition.

“If we were starting over, we would profile workloads first and invest in thorough development environment validation earlier — it gave us the confidence to move quickly in production” the team reflected. Understanding specific performance requirements and usage patterns upfront saves significant time and reduces risk.

The migration’s success stemmed from three strategies that other organizations can apply.

First, thorough preparation proved essential. Securonix began by conducting workload profiling to understand their specific performance patterns and requirements. This baseline data informed every subsequent decision and helped identify potential challenges before they became problems.

Collaboration with AWS early in the process accelerated the timeline significantly. Rather than attempting the migration independently, Securonix engaged AWS Solutions Architects during the planning phase. This partnership provided access to best practices, technical guidance, and support that streamlined the entire process.

The phased approach minimized risk while maintaining momentum. Starting with development environments allowed the team to validate the migration process, test performance benchmarks, and refine their procedures before touching production systems. Each phase built confidence and refined the process for the next.

Conclusion

In this post, we shared how Securonix migrated to ElastiCache for Valkey to achieve cost savings without sacrificing performance or operational simplicity. Through careful workload profiling, a phased in-place upgrade strategy, and close collaboration with AWS, Securonix reduced annual caching costs by 20% while improving application performance. The team completed the migration of 250+ clusters in only two weeks without service interruption and with no application code changes required.

The successful migration has positioned Securonix for continued innovation. They plan to upgrade to ElastiCache 8.x for additional memory optimizations and to expand automation coverage across their global deployment. The cost savings have strengthened Securonix’s ability to invest in the AI and analytics capabilities that power their next-generation SIEM platform.

If you run caching workloads on AWS, you can use ElastiCache for Valkey to reduce costs while maintaining or improving performance. Migrate your existing ElastiCache for Redis OSS workloads to ElastiCache for Valkey. Contact your AWS account team to discuss migration strategies tailored to your workloads.

If you have questions or suggestions about this post, leave a comment in the comments section.

About the authors