Why does one company pay a few thousand dollars a month for security information and event management while another pays six figures for what sounds like the same job? The answer rarely comes down to the software alone. SIEM pricing is one of the murkiest corners of enterprise software, full of consumption meters, retention tiers, and add-on modules that only surface after the first quote. This guide breaks down how SIEM vendors actually price their products, where budgets quietly leak, and what buyers can do to keep costs predictable.
What SIEM Pricing Is Really Built On
A SIEM collects logs from across an organization, correlates them, and alerts analysts to threats. Every part of that workflow costs money, and vendors meter whichever part is easiest to measure. In practice, most pricing models rest on one or more of these consumption meters:
| Meter | How it works | Who tends to use it |
|---|---|---|
| Data ingestion (GB/day) | You pay for the volume of logs sent into the platform | Most cloud-native SIEMs |
| Events per second (EPS) | You pay for the rate of events processed | Traditional enterprise SIEMs |
| Endpoints or devices | You pay per monitored asset | MSSP and mid-market offerings |
| Users or analysts | You pay per seat | Smaller, simpler platforms |
The critical detail is that these meters are not interchangeable. A GB/day figure and an EPS figure cannot be compared directly without knowing average event size, and vendors rarely publish that conversion. That is why two quotes that look similar on paper can produce wildly different bills once real traffic flows in.
According to general vendor practice, cloud SIEM list prices commonly land in a broad range of roughly $2 to $6 per GB ingested per month, before committed-volume discounts. Treat that as a planning range, not a quote. Actual pricing depends on vendor, tier, and contract length, and list prices change frequently.
The Three Cost Layers Most Buyers Miss
Layer One: License or Subscription
This is the number on the proposal. It covers the platform itself: search, correlation rules, dashboards, and basic alerting. It is also the smallest part of the story.
Layer Two: Ingestion and Storage
Ingestion is where budgets get interesting. Hot storage — data that is instantly searchable — is priced far above cold or archive storage. Many vendors charge separately for long-term retention, and compliance rules often force organizations to keep logs for a year or more. A common mistake is sizing the platform for 30 days of hot retention and then discovering that regulatory requirements demand twelve months of searchable history. That single oversight can multiply storage costs.
Layer Three: People and Operations
The largest line item usually is not on the invoice at all. Implementation, log source onboarding, tuning detection rules, and analyst labor typically exceed the license cost over a three-year horizon. Industry surveys repeatedly find that total cost of ownership skews toward operational expenses rather than software fees, though exact percentages vary by survey methodology. A SIEM that costs less to license but requires two extra analysts is not cheaper.
How the Major Platforms Structure Their Pricing
Microsoft Sentinel
Microsoft Sentinel has historically used pay-as-you-go pricing per GB of analytics data, paired with a Commitment Tier model that offers discounts in exchange for a pre-purchased daily volume. Microsoft has revised Sentinel packaging and pricing multiple times, so any figure circulating online should be checked against current Microsoft documentation before it goes into a budget.
Splunk
Splunk Cloud has traditionally been priced by daily ingest volume in GB/day, with workload-based licensing options added in later years. Splunk Enterprise, the on-premises product, is licensed by a daily license volume. Organizations that exceed their daily quota face either dropped data or overage charges, which makes accurate volume forecasting essential.
IBM QRadar
IBM QRadar has been offered in both appliance-based and consumption or event-based licensing forms. IBM moved its QRadar SaaS offerings under the Cloud Pak for Security umbrella, which changed packaging and how components are bundled. Buyers comparing older QRadar quotes to newer ones are often comparing two different products.
Open Source and Managed Options
Open source options such as the ELK stack shift cost from licensing to engineering labor. Managed SIEM services from MSSPs are usually priced per endpoint per month or per GB with a service fee layered on top, trading capital expense for a predictable operating cost.
Where SIEM Budgets Actually Leak
Practical experience from procurement cycles points to a handful of recurring traps.
Forecasting ingestion from a pilot. A proof-of-concept with five log sources tells you almost nothing about enterprise volume. Firewalls, endpoint detection tools, and cloud audit logs generate dramatically different volumes. The fix is to measure existing log output for at least 30 days before signing, using the same normalization the vendor applies.
Forgetting about noise. Verbose logging settings can triple ingestion overnight. A single misconfigured debug level on a domain controller has blown through monthly quotas at more than one organization. Normalize and filter at the source before data ever reaches the SIEM.
Ignoring retention tiering. Ask specifically what happens to data after day 31, day 90, and day 365. Get the answer in writing, with the price per GB for each tier.
Skipping the professional services line. Onboarding, content development, and migration are frequently quoted separately, and they are not small. Budget them explicitly rather than treating them as a rounding error.
Overlooking the surrounding stack. A SIEM is one piece of a security program. Teams evaluating broader tooling often find the same consumption-pricing logic in adjacent categories, whether they are comparing endpoint protection or reviewing something like the options covered in this breakdown of best internet security Australia offerings. The lesson is consistent: price the whole program, not the headline product.
EPS vs. GB per Day: Why Comparisons Break Down
Vendors love to quote whichever meter makes their product look cheaper. An EPS-based quote and a GB-based quote cannot be compared without normalization, because event size varies enormously by source. A syslog line from a router might be 200 bytes; a structured cloud audit event might be several kilobytes.
The practical approach is to build a normalized cost model before evaluating any quote:
- Measure actual daily log volume in GB from existing infrastructure.
- Estimate average events per second from the same data.
- Convert both quotes to a single common unit, usually cost per GB per month.
- Add retention costs at 30, 90, and 365 days.
- Add estimated implementation and analyst hours at a loaded labor rate.
- Compare three-year totals, not first-year totals.
That last step matters more than any other. Multi-year commitments secure discounts, but they also lock in a volume estimate that may be wrong in either direction.
Questions to Ask Before Signing a SIEM Contract
A short list of questions separates a workable contract from an expensive surprise.
- What exactly counts toward the ingestion meter — raw bytes, compressed bytes, or normalized events?
- What happens when the daily quota is exceeded: dropped data, throttling, or overage billing?
- Is long-term storage included, and at what price per GB?
- Are detection content updates, threat intelligence feeds, and compliance reports included or add-ons?
- What are the egress or data transfer charges?
- How is the price protected at renewal, and what is the uplift cap?
Getting written answers to those six questions eliminates most of the ambiguity that makes SIEM pricing feel opaque. Buyers negotiating complex software contracts often benefit from the same discipline used in other high-stakes purchases, whether they are structuring a multi-year service agreement or comparing something as straightforward as BMW M3 lease deals — the total cost of the term matters more than the monthly headline.
Managed SIEM and MSSP Pricing
For organizations without a 24/7 security operations team, managed SIEM is often the pragmatic route. Pricing typically combines a per-endpoint or per-GB platform fee with a service retainer covering monitoring, triage, and escalation. The advantage is predictability and access to expertise. The trade-off is less control over detection content and a dependency on the provider’s response times.
When evaluating managed options, ask how the provider handles log source onboarding, whether tuning is included or billed hourly, and what the escalation path looks like at 3 a.m. on a Sunday. Those operational details determine whether the service actually reduces risk or simply generates tickets.
Open Source vs. Commercial: The Real Math
Open source SIEM platforms carry no license fee, which makes them attractive on paper. The honest comparison includes engineering headcount, hardware or cloud infrastructure, and the opportunity cost of maintaining detection content internally. For a small team with strong engineering capability, open source can be genuinely cheaper. For a lean security team without dedicated platform engineers, the hidden labor often exceeds what a commercial subscription would have cost.
A useful rule of thumb: if the organization cannot dedicate at least one full-time engineer to platform maintenance, a commercial or managed option usually wins on total cost.
How to Build a Realistic SIEM Budget
Start with measured data, not vendor estimates. Pull 30 days of actual log volume from existing sources. Apply a growth factor for new log sources planned over the contract term — cloud workloads and SaaS audit logs are common additions that inflate volume quickly. Then layer in retention at each tier, implementation services, and analyst hours. (NIST Cybersecurity Framework)
A defensible budget typically includes four lines: platform subscription, storage and retention, implementation and content development, and ongoing operations. Organizations that budget only the first line are the ones most likely to face an uncomfortable conversation at renewal.
It also helps to look at how other software categories structure their pricing, because the patterns repeat. Consumption meters, tiered features, and multi-year commitments appear across the market, from security tooling to the plans detailed in this guide to Leonardo ai pricing plans and features explained. Recognizing the pattern makes it easier to spot where a SIEM quote is hiding its real cost.
Conclusion
SIEM pricing is not a single number; it is a structure. The license is the visible part, but ingestion volume, retention tiers, implementation services, and analyst labor determine what the platform actually costs over three years. Buyers who measure their real log volume before negotiating, normalize every quote to a common unit, and ask blunt questions about overages and renewal uplifts consistently end up with better outcomes than those who compare headline figures.
The most reliable approach is also the least glamorous: measure first, model the full term, and get the retention and overage terms in writing. A SIEM that fits the organization’s actual data profile and staffing will always beat one that looked cheaper on the first page of the proposal.
Frequently Asked Questions
How is SIEM pricing usually calculated?
Most vendors meter either data ingestion in GB per day, events per second, endpoints, or users. Cloud-native platforms lean toward GB per day, while traditional enterprise products often use EPS or daily license volume. Many contracts combine several meters, so the only reliable comparison is a normalized cost per GB per month across the full term.
Is SIEM priced per user or per data volume?
It depends on the vendor. Smaller and mid-market platforms sometimes charge per analyst seat, but most enterprise SIEMs price on data volume or event rate because that reflects the infrastructure cost the vendor carries. Per-user pricing is more common in simpler security tools than in full SIEM platforms.
Why is my SIEM bill higher than the quote?
The most common causes are underestimated log volume, verbose logging settings that inflate ingestion, separate charges for long-term retention, and add-on modules for threat intelligence or compliance reporting. Overage charges for exceeding a committed daily volume are another frequent culprit. Measuring actual volume before signing prevents most of these surprises.
What is the difference between EPS and GB per day pricing?
EPS measures the rate of events processed per second, while GB per day measures total data volume. They are not directly comparable because event size varies widely by source. To compare quotes fairly, convert both to a common unit such as cost per GB per month, using measured data from your own environment.
Is open source SIEM really cheaper?
Sometimes, but not automatically. Open source eliminates license fees while adding engineering labor, infrastructure costs, and internal content maintenance. Organizations without a dedicated platform engineer often find that the hidden labor exceeds a commercial subscription. The honest comparison includes staff time at a loaded rate over three years.
How much should a mid-sized company budget for SIEM?
There is no universal figure because volume, retention, and service level drive the number. A defensible budget covers four lines: platform subscription, storage and retention, implementation and content development, and ongoing operations. Building the estimate from measured log volume rather than vendor rules of thumb produces the most accurate result.
