Wazuh pricing in 2026: it is free and open source, and here is the real cost
The independent Wazuh pricing reference. The self-hosted platform is free and open source under GPLv2, so the real cost is infrastructure and operations, not a licence. This page gives honest total-cost-of-ownership scenarios plus Wazuh Cloud managed pricing (from $571/mo, agent-based). Figures verified against Wazuh's own site, August 2026.
The core platform is free and open source (GPLv2). Managed pricing from wazuh.com/cloud: Small from $571/mo (100 agents), Medium from $923/mo (250), Large from $1,467/mo (500), 14-day free trial. Self-hosted total cost of ownership figures below are honest estimates, not a Wazuh rate card.
How Wazuh pricing actually works
Most people searching for Wazuh pricing are surprised by the answer: the self-hosted platform is free. Wazuh is open source under the GPLv2 licence, with no licence fee, no per-agent charge, and no feature paywall on the core XDR and SIEM capabilities. The agents, the manager, and the indexer are all included. That is genuinely the case, and it is why Wazuh is one of the most widely deployed open-source security platforms.
The honest nuance is that free software is not free to run. Self-hosted Wazuh costs you infrastructure and operations: compute and storage for the manager and indexer, and the engineering time to deploy, tune, upgrade, and maintain the cluster. Storage, driven by how long you retain searchable data, is usually the largest infrastructure line. Budgeting zero for Wazuh and then absorbing the operations cost by accident is the single most common mistake, so the right approach is to size infrastructure and headcount up front.
For teams that would rather not run any of that, Wazuh Cloud is the managed option, priced by active agent count. It starts at $571 per month for up to 100 agents, $923 per month for up to 250, and $1,467 per month for up to 500, with a custom tier above that and a 14-day free trial. Wazuh Cloud folds the infrastructure and operations into the subscription, so the agent-count tier is genuinely all-in.
The real decision is therefore not licence cost, which is zero for self-hosting, but where you want the operational burden to sit. A team with platform engineering capacity and existing infrastructure will usually self-host more cheaply. A lean team without cluster-operations time will often find Wazuh Cloud cheaper once the engineering hours of self-hosting are counted honestly. Either way, Wazuh sits well below commercial per-GB SIEMs on total cost for comparable coverage.
Wazuh Cloud managed pricing
| Tier | Scale | Price |
|---|---|---|
| Small | Up to 100 agents | From $571/mo |
| Medium | Up to 250 agents | From $923/mo |
| Large | Up to 500 agents | From $1,467/mo |
| Custom | 500+ agents / bespoke | Contact sales |
Wazuh Cloud published tiers, agent-based, with a 14-day free trial (no credit card). Retention typically 1-3 months indexed, 3-12 months archived depending on plan.
Honest total cost of ownership
| Profile | Licence | Real cost | Note |
|---|---|---|---|
| Self-host, small (50 agents) | $0 (open source) | Infra ~$300-800/mo + ops time | One modest cluster; a few hours of engineering a week |
| Self-host, mid (250 agents) | $0 (open source) | Infra ~$1-3K/mo + part of an FTE | Multi-node indexer; retention drives storage cost |
| Self-host, large (1,000+ agents) | $0 (open source) | Infra $4K+/mo + dedicated engineer(s) | Serious cluster sizing and tuning; ops is the real cost |
| Wazuh Cloud, small | From $571/mo | All-in managed | No infra or ops to run; agent-count tier |
| Wazuh Cloud, large | From $1,467/mo | All-in managed | Up to 500 agents; custom above that |
Self-hosted infrastructure and operations figures are honest estimates that vary widely by retention, event volume, cloud region, and salary. They are planning anchors, not quoted prices.
Four Wazuh cost optimisations that genuinely work
Be honest that free software is not free to run
Avoids a budgeting mistakeWazuh core is genuinely free and open source, but the total cost of ownership is real: compute and storage for the indexer and manager, and the engineering time to deploy, tune, upgrade, and maintain it. The most expensive Wazuh mistake is budgeting zero and then absorbing the ops cost by accident. Size infrastructure and headcount up front and compare that honest number against managed alternatives.
Right-size retention, it drives storage
The biggest infra leverOn self-hosted Wazuh the dominant infrastructure cost is indexer storage, and storage is a direct function of retention. Keeping 12 months of hot, searchable data costs far more than keeping 30 to 90 days hot and archiving the rest cheaply. Decide retention by compliance requirement, not by default, and tier cold data to object storage.
Tune agents and drop noise at the source
Compute and storageVerbose agent configurations and unfiltered log collection inflate both the events the manager processes and the data the indexer stores. Tuning agent modules to what you actually detect on, and dropping low-value events at collection, reduces the cluster size you need. On self-hosted Wazuh this maps straight to smaller infrastructure.
Compare Wazuh Cloud against your true self-host cost
Deal-dependentWazuh Cloud starts at $571/mo for up to 100 agents, $923/mo to 250, and $1,467/mo to 500, all-in and managed. For a lean team, that can be cheaper than self-hosting once you count infrastructure plus the engineering hours to run a cluster properly. For a team with platform capacity and existing infrastructure, self-hosting is usually cheaper. Do the comparison with an honest ops number, not a zero.
When Wazuh is the right SIEM
Wazuh wins for cost-conscious teams with genuine engineering capacity. If you can run and maintain an OpenSearch-style cluster, the free open-source licence removes the largest line item in most SIEM budgets, and the platform delivers real XDR and SIEM capability, file integrity monitoring, and compliance mapping. It is a strong fit for startups, education, the public sector, MSPs building a margin-friendly stack, and any organisation that would rather invest in engineering than in per-GB licence fees.
Wazuh is less suitable for teams that need a fully managed, deeply featured platform with no operational burden, the broadest commercial content and app ecosystem, or vendor-backed SLAs on the core software. In those cases a commercial SIEM, or Wazuh Cloud if you want managed Wazuh specifically, is the better fit. The deciding question is simple and honest: do you have the engineering time to run it? If yes, Wazuh is one of the best value security platforms available; if no, price Wazuh Cloud or a commercial SIEM instead.