Google SecOps (Chronicle) pricing in 2026: the GB data-cap model, real cost

Google SecOps is billed on data volume. You commit to a data cap measured in GB, and the package you choose (Standard, Enterprise, Enterprise Plus) determines what is bundled on top of that ingestion allowance: 12 months of hot retention by default, and on Enterprise and above, curated detections, UEBA, SecOps SOAR, and Mandiant intelligence. Ingestion is metered against the data cap rather than charged per event or per SOAR action, and there is no separate per-event detection meter or per-action SOAR meter. The cap is a prepaid volume commitment: you buy the GB you expect to use, and usage above it bills as overage.

Contractually, the meter is a data cap measured in GB. When you buy SecOps your billing account receives a credit balance equal to the GB purchased (the Units on the order form), and ingestion draws that balance down under the Bytes of data ingested SKU. Consume more than the purchased Units and Google invoices the excess in arrears at the prorated list price less your negotiated discount. For contracts signed on or after 1 February 2026, Google's Data Benefit Program designates specific data sources that do not count toward the data cap, but only for Enterprise and Enterprise Plus subscriptions that meet Google's minimum annual contract value. The list price per GB per year is filed openly on the UK G-Cloud 15 framework by Google Cloud EMEA itself: $1.95 Standard, $2.40 Enterprise, $4.60 Enterprise Plus.

The real cost difference from Splunk and Sentinel is the unit rate and what is bundled at that rate, not the cap mechanism itself (a prepaid GB commitment is still volume pricing, and cost scales with ingest on both sides). At 50 GB per day Google's filed list puts Chronicle Enterprise at about $43,800 per year ($35,600 on Standard), where Splunk Cloud lists at about $63K base and about $124K with Enterprise Security. Chronicle lands below Splunk all-in at this volume because its per-GB rate is lower and SOAR, curated detections and (on Enterprise) UEBA and Mandiant intel are bundled rather than sold as separate lines.

Chronicle is less compelling where ingest volumes are low or highly variable. A per-GB competitor with a low entry floor can undercut a packaged data cap when a buyer ingests only a few GB per day, because the packaged commitment is sold as an annual volume (and Enterprise Plus carries a $400K minimum annual contract value in a reseller's G-Cloud 15 document). The buyer-fit math comes down to sustained ingest volume and how much of the bundled detection, SOAR, and intelligence stack the SOC will actually use.

Package selection materially affects the bill. Standard is genuine SIEM (data plane, detection engine, search) and includes SOAR with 300-plus integrations and a subset of curated detections; what it lacks is UEBA, the full curated-detection set, and Mandiant intelligence. For SOCs that have already invested in their own detection content and threat intelligence pipeline, Standard can be the right answer. For most buyers, Enterprise is the default because the expanded curated detections, UEBA, and Mandiant intel collectively replace stack components that on competitor platforms are separate line items adding 40-100 percent on top of base SIEM licence.

Negotiation discipline matters. The committed data cap (the GB you purchase) is the single largest lever, and multi-year commits at high ingest volume attract committed-volume discounts off list. Discount depth is not published and varies by deal, so treat any specific percentage as deal-dependent rather than a rate card. Google's cross-product commitment discount, where SecOps spend rolls into a broader Google Cloud committed-use agreement, is an additional lever for organisations already on GCP at scale.

Chronicle is the right pick wherever sustained ingest is high and the SOC will use the bundled detection and response stack. Cloud-native engineering organisations, SaaS companies, fintech with deep audit-log requirements, and organisations consolidating from Splunk after a per-GB bill explosion all fit the profile. The advantage is a lower published per-terabyte rate with the detection and response stack bundled in; the commitment is still sized to your volume, so model expected ingest honestly rather than assuming the cap absorbs unlimited growth.

Chronicle is the weaker pick where ingest is low or highly variable, and where a per-GB competitor with a low entry floor can come in under a packaged data-cap commitment. It is also the wrong pick where the buying decision is dominated by detection content depth or specific compliance content packs that Chronicle does not match (high-end financial services with bespoke content needs, defence contractors with specific government content libraries). Sentinel or Sumo Logic typically win cleanly in the low-ingest profile.

The 2026 product trajectory is favourable. Google's SecOps consolidation push has improved Mandiant intelligence integration meaningfully since the 2022 acquisition, and the Siemplify SOAR rebrand into SecOps SOAR has cleaned up the product UX that previously created complaints. For new Chronicle deployments evaluated in 2026, the product is materially more cohesive than it was 18 months earlier.