SIEM pricing models: per-GB vs per-EPS vs per-user vs flat-rate

The dominant SIEM pricing model in 2026. The vendor meters every log byte that crosses the ingest boundary. Compression at rest does not reduce the bill. Splunk, Sentinel, Datadog, and most newer cloud SIEMs use this model.

Wins when security data is high-value (authentication logs, EDR alerts, threat detections) and low volume. Per-GB lines up cost with detection value.

Loses when verbose, low-value sources dominate. Firewall syslog, NetFlow, and DNS query logs can quickly consume 80 percent of GB billing while contributing 10 percent of detection value.

Worked example. 50 GB per day at $5.22/GB Sentinel PAYG = $95,265 per year. Filter 30 percent of low-value logs at the agent and the same environment costs $66,686. Filtering pays back faster than negotiation.

QRadar and ArcSight bill on event rate, not data volume. The metric is sustained events per second across all log sources, with a separate peak ceiling. EPS billing flatters quiet sources and penalises spiky ones.

Wins when log sources are predictable and balanced. Compliance environments with steady audit logging benefit.

Loses when bursty sources push the peak EPS ceiling. Web traffic spikes, batch jobs, or attack waves can force a tier upgrade based on bursts that don't reflect sustained value.

Worked example. 50 GB per day with mixed sources averages roughly 3,500 EPS sustained. QRadar on Cloud at this tier runs $95K-$110K per year on licence. Equivalent per-GB billing would run $95K-$135K depending on vendor.

Elastic Security tiers and LogRhythm bill primarily on named user count, often with a base platform fee and a separate component for ingested or stored data. Per-user pricing decouples cost from log volume.

Wins when analyst headcount is small and stable. A two-analyst team can ingest substantial volume without the bill scaling.

Loses when the team grows, when MSSPs need many low-touch viewer accounts, or when audit requires every department head to access reports.

Worked example. Elastic Platinum at 25 users = $37,500 per year on user fees. Add resource-based ingest at 50 GB per day (~$45K) for $82,500 total before storage or staff. Comparable to per-GB Sentinel but without ingest pressure.

Sumo Logic, Panther, and Blumira sell tiered subscriptions: a fixed monthly fee covers a defined ingest ceiling, log retention period, and feature set. Cross the ceiling and you either upgrade tier or pay overage rates.

Wins when volume is predictable and growth is slow. The bill is genuinely flat for budgeting.

Loses when volume crosses the ceiling. Overage rates are typically 1.5-2x the in-tier per-GB equivalent. Tier upgrades create cliffs.

Worked example. Sumo Logic Enterprise at 50 GB per day runs ~$80K-$95K per year. The same volume on Splunk Cloud would run $135K. Flat tiers genuinely save money inside the tier; the discipline is monitoring ingest against the ceiling.