Vendor / Elastic Security

Elastic Security SIEM pricing in 2026: self-managed vs cloud, and the true cost

Elastic Security pricing reference. Open-source Basic tier vs paid subscriptions, Elastic Cloud Hosted resource-based pricing, Elastic Security Serverless per-GB ingest and retention rates, self-managed infrastructure and engineering costs, and where Elastic genuinely wins or loses against Splunk and Sentinel. Rates re-read from Elastic's price pages. Updated October 2026.

Page updated 13 October 2026/First published 7 April 2026

Pricing model

Resource or per-GB

Hosted: compute + storage; Serverless: per GB

Basic tier

Free

Open-source SIEM core

Platinum

From ~$131/mo

ML, cross-cluster search

Serverless ingest

From $0.09/GB

Security Analytics Essentials, plus retention

How much does Elastic Security SIEM cost in 2026?

Elastic Security has no single price because it sells three ways, none of them per user. The free, open-source Basic tier runs the core SIEM at $0 licence, self-managed, so you pay only for your own infrastructure and engineers. On Elastic Cloud Hosted the bill is resource-based (compute plus storage) with a subscription tier layered on top: Standard from ~$99/mo, Gold ~$114/mo, Platinum ~$131/mo (adds machine learning and cross-cluster search), and Enterprise ~$184/mo (adds Endpoint Security and SOAR). Those are starting rates for a small production cluster (roughly 120 GB storage across two zones) and scale with provisioned resources, not headcount. Elastic Security Serverless bills per GB instead: ingest from $0.09/GB (Security Analytics Essentials) or $0.11/GB (Complete), plus retention from $0.017 or $0.019 per GB per month, with no per-endpoint fees from 23 March 2026. By our estimate a 50 GB/day mid-market Hosted deployment lands near $240K-$320K all-in once infrastructure and the scarce Elastic engineering premium are counted; the licence line is the small part.

Hosted tier rates from the Elastic Cloud Hosted price list and Serverless rates from the Elastic Security Serverless price list, both read 13 October 2026. All-in totals are our estimates.

Subscription tier comparison

Basic

Free (self-managed)

Includes

Core SIEM rules, basic detections, ELK stack

Missing

Machine learning, advanced analytics, premium support

Standard

From ~$99/mo

Includes

Cloud entry tier: core Elastic Security on managed cloud, resource-based

Missing

Reporting, Watcher, third-party alerting actions (Gold+)

Gold

From ~$114/mo

Includes

Standard + reporting, Watcher, third-party alerting, multi-stack monitoring

Missing

ML, advanced security, cross-cluster

Platinum

From ~$131/mo

Includes

Gold + ML jobs, advanced security, cross-cluster

Missing

Endpoint integrations, advanced UEBA

Enterprise

From ~$184/mo

Includes

Platinum + Endpoint Security, SOAR, advanced UEBA

Missing

Bespoke MSSP features only

Elastic does not license by seat. The subscription tier is a feature gate applied on top of resource-based consumption (compute, memory, and storage), not a per-user charge. The figures above are Elastic Cloud Hosted starting rates for a small production configuration (roughly 120 GB storage across two zones); the bill scales with provisioned resources, not headcount. On self-managed, Elastic lists Gold as discontinued ("no longer available for new customers") and Platinum as existing customers only. Sources: elastic.co/pricing/cloud-hosted and elastic.co/subscriptions, read 13 October 2026.

Elastic Security Serverless: per-GB pricing

Elastic Security on Elastic Cloud Serverless is billed monthly on the GB you ingest and the GB you keep, at the rate of your feature tier, with no cluster to size. Elastic states the rates took effect 1 November 2025 and that from 23 March 2026 per-endpoint fees no longer apply (ingest and retention charges still do). Endpoint Protection is now included.

Feature tier	Ingest	Retention	Egress	50 GB/day, 1-year retention
Security Analytics Essentials	From $0.09 / GB ingested	From $0.017 / GB retained / month	50 GB free, then $0.05 / GB	From ~$5.4K/yr
Security Analytics Complete	From $0.11 / GB ingested	From $0.019 / GB retained / month	50 GB free, then $0.05 / GB	From ~$6.2K/yr

Rates from elastic.co/pricing/serverless-security, read 13 October 2026; Elastic labels them "as low as", so they are floors and the rate you pay depends on volume and region. The 50 GB/day column is our arithmetic at those floor rates: 18,250 GB a year ingested, plus a full year's data (18,250 GB) held in retention for 12 months, which is the steady state from the second year, assuming retained GB equals ingested GB. Excludes egress beyond 50 GB and optional add-ons (for example Cloud Protection CSPM from $0.65 per billable asset per month).

The "free software, expensive people" reality

The Elastic Basic tier is genuinely free, but operating an Elasticsearch cluster at security-grade reliability is a specialised skill. In our estimate, engineers who can tune shards, manage rollover policies, and debug cross-cluster replication command a 30-50 percent premium over generic SREs. The figures below are our estimates, not Elastic prices. Budget honestly.

Infrastructure

$15K-$50K per year for 50-200 GB/day clusters. Hot, warm, and cold tiers required for cost-effective retention.

Engineering FTE

$120K-$180K per year for an engineer who can run Elasticsearch competently. 20-30 percent of their time goes to cluster ops alone.

Detection content

Open-source rule sets exist but lag commercial vendors. Plan for a detection engineering function, not just a SIEM operator.

Real-world Elastic cost scenarios

Scenario	Profile	Licence	Total TCO	Notes
Startup	5 GB/day, Basic + self-hosted	$0 licence	$45K-$70K (est.)	Single engineer maintains, infra ~$8K-$15K (our estimate)
Mid-market cloud	50 GB/day, Elastic Cloud Hosted Platinum, hot-warm cluster	$85K-$110K/yr (est.)	$240K-$320K (est.)	Resource-based; provisioned compute and storage drive cost
Mid-market self-managed	50 GB/day, Platinum subscription (existing customers only), on-prem cluster	$70K-$95K/yr (est.)	$310K-$420K (est.)	Engineer salary premium dominates
Enterprise	200 GB/day, Elastic Cloud Enterprise, multi-tier	$280K-$400K/yr (est.)	$760K-$1.1M (est.)	Full Endpoint Security included
Open-source heavy	200 GB/day, Basic only, 2 dedicated engineers	$0 licence	$520K-$680K (est.)	Engineering, infra, opportunity cost

FAQ

Common questions

Is Elastic SIEM free?

Elastic Security ships in tiers. The Basic (open-source) tier is free and includes core SIEM detection rules, the Elastic Common Schema, basic Kibana, and the underlying Elasticsearch and Logstash. Gold, Platinum, and Enterprise are paid subscription tiers that unlock progressively more capability: Gold adds Kibana spaces and alerting, Platinum adds machine learning jobs and cross-cluster search, and Enterprise adds Endpoint Security and SOAR. These tiers are not licensed per user. On Elastic Cloud Hosted they are a feature gate applied on top of resource-based consumption (compute, memory, storage), with starting rates of roughly $114, $131, and $184 per month for a small production configuration that scales with provisioned resources. The free tier is genuinely usable for SIEM but lacks ML-driven detections and the integrated endpoint agent. Elastic Security Serverless is the exception to resource pricing: it bills per GB ingested (from $0.09 on Security Analytics Essentials, $0.11 on Complete) plus per GB retained per month (from $0.017 and $0.019), and from 23 March 2026 Elastic no longer charges per-endpoint fees on it.

How does Elastic Cloud pricing actually work?

Elastic sells two cloud models. Elastic Cloud Hosted uses resource-based pricing: you pay for compute (CPU and memory) and storage rather than ingest. Elastic Security Serverless instead bills per GB ingested and per GB retained per month, from $0.09 and $0.017 on Security Analytics Essentials and $0.11 and $0.019 on Complete, with 50 GB of egress free and $0.05 per GB after that. A typical mid-market security deployment provisions 4-8 hot data nodes plus warm and cold tiers. On Hosted, pricing is consumption-based and varies by region; our estimate (not an Elastic figure) is roughly $0.50 to $1.10 per GB ingested as an effective rate once compute and storage are amortised, with the subscription tier (Gold, Platinum, or Enterprise) applied as a feature-access uplift rather than a per-user charge. Resource-based pricing penalises spiky workloads less than per-GB models but rewards careful capacity planning.

What is the true cost of self-managed Elastic Security?

Self-managed Elastic appears cheap on the licence line and expensive everywhere else. Our estimates, which are not Elastic figures: $15,000 to $50,000 per year in infrastructure for a mid-market deployment, plus a dedicated Elastic engineer at $120,000 to $180,000 per year (Elastic experience commands a premium), with 20-30 percent of that engineer's time on cluster maintenance, version upgrades, and capacity planning. On those assumptions the total is typically $200,000 to $300,000 annually for a 50 GB-per-day deployment. Note that on self-managed, Elastic now lists Gold as discontinued and Platinum as available to existing customers only.

Elastic Cloud vs self-managed: which is cheaper?

For most organisations under 200 GB per day, Elastic Cloud wins on TCO because the infrastructure operations burden vanishes. Self-managed wins where you already have an Elasticsearch practice (data engineering, observability, search), where data residency requirements demand on-prem, or above 500 GB per day where amortised hardware beats consumption pricing. The break-even is rarely about the licence line; it is about whether you have or want to build operational capability around the cluster.

How does Elastic Security compare to Splunk on cost?

At 50 GB per day with equivalent capability (Elastic Platinum vs Splunk Cloud with Enterprise Security), we estimate Elastic typically lands 30-50 percent below Splunk on total cost. The trade-off is detection content and search ergonomics: Splunk's premium app ecosystem (ES, ITSI, premium content packs) is mature, while Elastic relies more heavily on community detection rules and your team's ability to write KQL or Lucene queries. For organisations that value Splunk's analyst experience, the premium is justified; for cost-conscious teams with engineering capacity, Elastic wins.