Almost as soon as “Big Data” came along, there was someone to explain that it wasn’t the size that mattered; it was how you used it. Vendors touted their “line speed” or their ability to do all their analysis in-memory (since writing to disk tends to slow down the pipe a lot). We’ve known for a long time that stateful firewalls, IDS/IPS and web application firewalls magically get a lot faster if you turn enough high-level checks off. Vendors also tout the number of inputs that go into their offerings: how many other security technologies they integrate with (where “integrate” may just mean “we consume syslog, CSV and XML”). If you want to get fancier than just saying what data formats you accept, you can say you have an API, regardless of how many other tools actually use it.