Ask a SIEM vendor what their product costs and the honest answer is “it depends”. It depends mostly on one thing: what the vendor counts. Some count gigabytes, some count events per second, some count devices or users, and some count computing power. The same company can get quotes that differ several times over, and the cheapest quote this year can become the most expensive one after a busy year of logs.
This guide explains each pricing model, what makes each one grow, the costs that never appear on the license line, and the questions that make two quotes comparable. We build UTMStack, which is priced by device, so we have a view on this; we have tried to be fair to the other models too.
The short answer: a SIEM’s total cost is the license or subscription, plus the infrastructure and storage to run it, plus the people who operate it. The license is often not the largest part. One security analyst earned a median of $129,180 a year in the United States in May 2025, according to the Bureau of Labor Statistics, and covering a single seat around the clock takes about five people. Pricing models decide how the license part grows: volume-based models grow with your logs, device-based models grow with your environment.
The quote shows one line. The total has seven.
What you pay for when you run a SIEM for a year
The five ways SIEMs are priced
| Model | You pay for | What makes the bill grow | Predictability |
|---|---|---|---|
| Data volume (per GB) | Gigabytes ingested per day, or per month | More logs: new sources, verbose logging, incidents, busy seasons | Low to medium |
| Events per second (EPS) | A licensed rate of events per second | More events, especially peaks | Medium |
| Per device or data source | Each server, endpoint, firewall or cloud account sending logs | New devices | High |
| Per user or employee | People in the organization | Headcount | High |
| Compute or workload | Processing and search capacity | More searches, detections and data | Medium |
Data volume (per GB)
The most common model for cloud SIEMs. Microsoft Sentinel, for example, bills its analytics tier by the gigabyte ingested, either pay-as-you-go or with commitment tiers that start at 100 GB per day, and bills its separate data lake tier on its own meters for ingestion, processing, storage and queries. Some sources are free to ingest, such as Azure activity logs and Office 365 audit logs. Splunk offers ingest pricing by data volume alongside its other models.
- Good for: small, stable environments where you know your volume and it rarely changes.
- Watch out for: every firewall rule that logs allowed traffic, every new Windows audit setting and every incident shows up on the invoice. Teams on volume pricing often switch off logs they should keep, which is the opposite of what a SIEM is for.
Events per second
Historically common with appliance and on-premises SIEMs. You buy a licensed EPS rate, and the product queues, drops or charges for events above it.
- Good for: steady environments with well-measured traffic.
- Watch out for: peaks. Log volume during an attack can be several times normal, and that is exactly when you need every event.
Per device or data source
You pay for each log source, whatever it sends. UTMStack works this way: a device is any individual log source, such as a server, a workstation agent, a firewall, a switch or a cloud account, and a console that collects from many machines, such as an antivirus console or Microsoft 365, counts as one.
- Good for: budgeting. Growth in log volume does not change the bill, so there is no reason to log less.
- Watch out for: what counts as a device. Ask for the definition in writing, especially for cloud services and consoles.
Per user or employee
Common in managed SIEM and managed detection and response bundles for small and midsize businesses. You pay per person, often with a minimum.
- Good for: simple budgeting when the service includes monitoring.
- Watch out for: limits on what data sources are included, and on how long logs are kept.
Compute or workload
You pay for the processing and search capacity your use needs, rather than for the data itself. Splunk’s workload pricing is one example. Self-hosted open source SIEMs are a variant: the license is free, and you pay for the servers.
- Good for: large teams who want to keep lots of data but search a small part of it.
- Watch out for: costs that grow with how actively you investigate, and capacity planning that becomes your job.
A worked example: what changes the bill
Take a 100-person company with 134 log sources: 100 laptops, 12 servers including two domain controllers, two firewalls, ten network devices, Microsoft 365, a cloud account and an antivirus console. Using typical values from our SIEM sizing calculator, that is about 272 events per second, or about 12 GB of raw logs a day.
Now watch what happens to each model when the company changes:
| Change | Data volume | Per device | Per user |
|---|---|---|---|
| Firewalls start logging all allowed traffic (+100 EPS, about +4 GB a day) | Up by about a third | No change | No change |
| A week-long incident triples log volume | Spike for that period, or overage | No change | No change |
| 50 new laptops | Up about 10% | Up by 50 devices | Up if headcount grows |
| Keep logs 12 months instead of 3 | Storage fees grow, often sharply | Depends on the plan’s retention | Depends on the plan |
| Add a new SaaS application | Up by its volume | Up by one source | No change |
Same company, two pricing models: how the bill moves
The example company over a year, with the bill indexed to month 1 = 100
- Firewalls start logging allowed traffic: logs grow by about a third
- A week-long incident triples the logs for that week
- Fifty new laptops: devices grow by about a third, logs by 7%
No model is cheapest for everyone. Volume pricing can win for a small company with few, quiet sources. Device pricing tends to win as soon as logging gets serious, because the thing that grows fastest in a security program is the amount of data you want to keep.
The costs that are not on the license line
- Infrastructure and storage. For a self-hosted SIEM: servers, fast disks for recent data, cheaper storage for archives, backups and high availability. For a cloud SIEM: retention beyond the included period, archive storage and fees to search or restore archived data.
- People. Someone has to triage alerts, tune rules, investigate and report. The Bureau of Labor Statistics put the median pay for an information security analyst at $129,180 in May 2025, before benefits. A seat covered 24 hours a day, 7 days a week is 168 hours a week, so with holidays, sick days and training it takes about five full-time people.
- Implementation. Connecting sources, writing parsers for unusual ones, setting up response actions and reports. Some vendors charge professional services for this; with others it is your team’s time.
- Tuning. A new SIEM produces too many alerts until it learns your environment. Budget the first two to three months for tuning.
- Add-ons. Behavior analytics, response automation (SOAR), threat intelligence feeds, compliance reports, extra connectors and AI assistants are separate products or tiers with some vendors.
- Renewals. Ask what happens at renewal, and how prices change in later years.
Why one seat around the clock takes about five people
The arithmetic behind 24/7 coverage
- Hours to cover16824 hours a day, 7 days a week
- Hours one analyst worksabout 35a week, once vacation, holidays, sick days and training are taken out
- People for one seatabout 5168 ÷ 35 = 4.8
How to compare SIEM quotes
Send every vendor the same list of log sources and the same retention requirement, then ask:
- What exactly is the unit (GB, EPS, device, user), and how is it measured?
- What happens if we exceed it? Is there an overage charge, throttling or dropped data?
- What does the price become if our log volume doubles?
- How long are logs kept at this price, and are older logs searchable without a restore or an extra fee?
- Which features are included: correlation rules, response automation, case management, threat intelligence, compliance reports, multi-factor sign-in and single sign-on?
- What does onboarding include, and who writes parsers for sources you do not support?
- What support is included, and is there a 24/7 option?
- What is the price in year two and year three?
Line up the answers in a table. The differences usually show up in the second and fourth questions.
Ways to lower SIEM costs
- Drop noise, not security logs. Debug messages, health checks and duplicate events can go. Authentication, privilege changes, firewall denies and endpoint alerts stay.
- Use tiered storage. Keep recent data on fast disks and move older data to cheaper storage that is still searchable.
- Pick a model that does not punish logging. If your volume grows faster than your number of devices, device-based pricing removes the reason to log less.
- Consolidate tools. Correlation, response automation, case management and compliance reports in one platform cost less than four products and their integrations.
- Automate the routine responses. Blocking an address or disabling an account automatically saves analyst hours on every repeat alert.
- Cut false positives. Every false alarm costs analyst time. Tuning pays for itself.
Managed SIEM pricing
A managed SIEM or managed detection and response service bundles the platform with the people who watch it. It is usually priced per device, per endpoint or per user, with a minimum term. Compare it with the cost of building the team above, not with the license alone. If you already have a security team that only needs help at night, on weekends or during incidents, extending it with outside analysts usually costs less than outsourcing everything. UTMStack’s SOC extension service works that way.
How UTMStack is priced
UTMStack is priced by device, never by log volume, so a busy week or a new logging policy does not change the bill.
- Community edition: free and open source (AGPL-3.0), on your own servers. You pay only for the hardware.
- UTMStack Cloud: a dedicated hosted instance, with plans from 25 to 500 devices and custom sizing above that. Cloud plans keep about one month of logs in fast storage and archive older logs for a year, and archived logs stay searchable without a restore.
- Enterprise license: the full feature set on your own servers, licensed by device.
There is no public price list, because UTMStack is also sold through partners who set their own prices. Ask for a quote with your device count and you will get a written answer within one business day, directly or through your partner. Details are on our pricing page.
Frequently asked questions
How much does a SIEM cost per month? It ranges from nothing for a self-hosted open source SIEM (plus hardware) to tens of thousands of dollars a month for large enterprises on volume-based pricing. The pricing model, your log volume and your retention period decide where you land. The people to run it often cost more than the software.
Why are SIEMs so expensive? Because many are priced by data volume, and security logging produces a lot of data that grows every year. Retention requirements multiply it, and premium features are often sold separately.
Is an open source SIEM really free? The license is. You still pay for servers, storage and the time to install, tune and maintain it. For a team with some Linux and security skills, that is often far less than a commercial license; for a team without them, a managed service or support plan may be cheaper overall.
What is the cheapest SIEM? The cheapest to start is a free open source SIEM on hardware you already own. The cheapest over three years is the one whose pricing model matches how your environment grows, with the features you need included rather than sold as add-ons.
What is per-device SIEM pricing? You pay for each log source (servers, endpoints, firewalls, cloud accounts) regardless of how many logs they send. It makes costs predictable and removes the incentive to log less.
How do I estimate my SIEM data volume? Count your log sources, estimate events per second for each and multiply by event size. Our SIEM sizing calculator does it for you.
