OpenText Enterprise Security Manager is ArcSight ESM rebranded. For two decades ESM has been the on-prem flagship SIEM for high-throughput regulated environments, running in banks, government agencies, defense organizations and healthcare systems at log volumes other SIEMs cannot ingest economically. Programs that can run cloud SIEM should evaluate Threat Detection and Response or Splunk Cloud. Programs that cannot, because of regulatory, sovereignty, or volume constraints, run ESM as the right answer for as long as those constraints hold.
Throughput at scale is the historical strength. Programs that ingest 500,000 to 5,000,000 events per second find that cloud-SIEM pricing models become punishing while ESM stays linear. Combined with the regulated content library and the on-prem operational shape required by some sovereign-cloud and air-gapped programs, ESM remains the operational fit. Renaming ArcSight ESM to OpenText Enterprise Security Manager in 2024-2025 did not change the engine.
ESM also anchors OpenText's SecOps products on-prem. ESM integrates with Network Detection and Response, Behavioral Signals (Interset UEBA), Adversary Signals (MITRE), Threat Intelligence, and Security Log Analytics. Programs running ESM with the rest of the line get unified SOC operations on-prem the way TDR delivers them in SaaS.
ESM demands steady operational effort. Content tuning, parser maintenance, scale-out architecture, and SOC operating-model design all require discipline. Programs that adopt ESM without operational headcount or partner support find the platform underused. Merito's engagement designs the operating model alongside the deployment, and Managed Services run ESM long-term for programs that want OpenText engineering without internal headcount.
Ideal use cases
- High-throughput regulated SIEM for banks, government agencies, defense and healthcare
- On-prem SIEM where cloud is ruled out by regulation or sovereignty
- Air-gapped or sovereign-cloud SOC environments
- ArcSight ESM upgrade and modernization
- Cross-product on-prem SecOps with NDR, UEBA, MITRE content, and long-retention logging