Exabeam pricing in 2026: New-Scale GB/day tiers explained
The Exabeam New-Scale pricing reference. Priced by gigabytes ingested per day; Exabeam publishes no prices today, so the anchors here come from its 2023 Americas list (effective 1 August 2023) for Exabeam SIEM, Security Analytics, Fusion and two 2023-era SKUs, with cost scenarios from small SOC to enterprise. Updated October 2026.
Page updated 13 October 2026/First published 15 May 2026
List anchors from the Exabeam Americas price list effective 1 August 2023 (hosted by the reseller Prescriptive Solutions), read 13 October 2026. Today exabeam.com/platform lists New-Scale Fusion, New-Scale SIEM and New-Scale Analytics (plus LogRhythm SIEM and LogRhythm Intelligence) and publishes no prices; Security Log Management and Security Investigation are 2023 SKU names not listed there. These are the most recent public anchors, three years old.
How Exabeam pricing actually works
Exabeam's New-Scale Security Operations Platform, launched in October 2022, is priced on one meter: gigabytes ingested per day. There is no per-monitored-user, per-entity, or per-source platform charge. You choose a product and a daily-ingest tier, and the annual subscription follows that tier. This is the single most important correction to make about Exabeam pricing: legacy write-ups describing per-user or per-source Exabeam licensing do not describe the New-Scale line.
The product family at 50 GB/day on the 2023 Americas list (effective 1 August 2023): Security Log Management at $31K (log management and search only), Exabeam SIEM at $36K (adds correlation, dashboards, and detection rules), Security Analytics at $31K (the behavioural-analytics engine, the historical Exabeam differentiator), Security Investigation at $39K (case management), and Fusion at $51K, the top bundle that combines Exabeam SIEM and Security Analytics in one experience. Security Log Management and Security Investigation are 2023 names; Exabeam's platform page today lists New-Scale Fusion, New-Scale SIEM and New-Scale Analytics. Each product was sold in daily-ingest tiers that scale with volume.
Volume is the cost driver. On the 2023 list, Fusion runs $51K at 50 GB/day, $88K at 100, $210K at 300, $325K at 500, $598K at 1,000, and $2.63M at 5,000 GB/day. The tier boundaries matter more than the linear rate: moving from 100 to 300 GB/day more than doubles the bill. GB/day add-on SKUs let you top up ingest without jumping to the next full base tier, so measuring true daily ingest before you buy is the highest-leverage step.
Two SKUs sit outside the GB/day model. Incident Responder, the SOAR add-on, was priced per analyst seat at $24,000 per seat per year on the 2023 list. The CrowdStrike Ingester is a data connector priced per user ($3.35 to $5.40 per user per year on the 2023 list, volume-tiered), not a platform charge. Neither is a per-user meter on the platform itself, and both are the exceptions that prove the GB/day rule.
Nova is not a pricing tier. Announced in April 2025, Exabeam Nova is an agentic-AI layer, a set of specialised AI agents (Investigation, Search, Threat Scoring, Analyst Assistant, Advisor, and Visualization) that sits on top of New-Scale to automate triage, case summaries, and investigation. It is a capability layer over the platform, not a separate SKU line you buy in tiers. Security Analytics remains where the behavioural-analytics value lives, and for buyers whose binding constraint is insider-threat or privileged-user detection, the Fusion bundle is the cleanest way to license SIEM plus that analytics depth on one meter.
The Exabeam-LogRhythm merger completed on 17 July 2024 under Thoma Bravo, and the combined company operates as Exabeam. LogRhythm's self-hosted line, priced per MPS (Messages Per Second) on its 2022 price book, is now sold under Exabeam's True Unlimited Data Platform model, while New-Scale stays on GB/day, so the two lines are not directly comparable on a single meter. Against Splunk, Exabeam is competitive on volume: at 50 GB/day, Fusion was $51K on the 2023 list versus Splunk Cloud's list of about $63K base and $124K with Enterprise Security. Cross-shopping the portfolio still produces leverage, and quarter-end is the right pressure point.
Exabeam New-Scale product reference
| SKU | Pricing | Notes |
|---|---|---|
| Security Log Management (2023 name) | $31K at 50 GB/day (2023 list) | Log management and search only. Not listed on exabeam.com/platform today. |
| Exabeam SIEM | $36K at 50 GB/day (2023 list) | Log management plus correlation, dashboards, and detection rules; New-Scale SIEM today |
| Security Analytics (UEBA) | $31K at 50 GB/day (2023 list) | Behavioural analytics engine; New-Scale Analytics today |
| Security Investigation (2023 name) | $39K at 50 GB/day (2023 list) | Case management and investigation workbench. Not listed on exabeam.com/platform today. |
| Fusion (full bundle) | $51K at 50 GB/day (2023 list) | Top bundle: Exabeam SIEM plus Security Analytics in one meter; New-Scale Fusion today |
| Incident Responder | $24,000 / seat / yr (2023 list) | SOAR add-on; the only per-seat SKU, priced per analyst |
| CrowdStrike Ingester | $3.35-$5.40 / user / yr (2023 list) | A data connector priced per user, volume-tiered; not the platform |
Real-world Exabeam cost scenarios
| Scenario | Profile | Annual licence | Notes |
|---|---|---|---|
| Small SOC | 50 GB/day, Exabeam SIEM standalone | $36K/yr (2023 list) | Entry SIEM at the 2023 list |
| Mid-market SOC | 100 GB/day, Fusion bundle (SIEM + Analytics) | $88K/yr (2023 list) | Full UEBA plus SIEM on a single GB/day meter |
| Mid-market with response | 300 GB/day Fusion + 5 Incident Responder seats | $330K/yr (2023 list) | $210K Fusion plus 5 x $24K IR seats |
| Enterprise | 1,000 GB/day, Fusion bundle | $598K/yr (2023 list) | Per-GB rate compresses at volume |
| Large enterprise | 5,000 GB/day, Fusion bundle | $2.63M/yr (2023 list) | 2023 list figure; negotiate hard at this scale |
Figures are 2023 list prices from the Exabeam Americas price list (effective 1 August 2023), combined at the stated GB/day tiers. Incident Responder is $24,000 per seat per year on that list. Exabeam publishes no current prices or discount schedule, so treat these as a three-year-old benchmark, not a quote.
Five Exabeam cost optimisations that genuinely work
Filter and route noisy sources before ingest
moves you down a GB/day tierNew-Scale bills on gigabytes ingested per day, so the fastest saving is cutting or routing high-volume, low-value sources (verbose firewall, DNS, netflow) before they reach Exabeam. Tier boundaries are where the money is: Fusion jumps from $88K at 100 GB/day to $210K at 300 GB/day, so staying inside a lower tier matters more than the linear rate.
Buy the right product, not the full bundle
up to $20K at 50 GB/dayFusion ($51K at 50 GB/day) bundles Exabeam SIEM and Security Analytics. If you only need log management and search, Security Log Management lists at $31K for the same volume, and Exabeam SIEM alone is $36K. Match the SKU to the capability you actually run rather than defaulting to the bundle.
Size Incident Responder seats to real responders
$24K per unused seatIncident Responder is priced per seat at $24,000 per seat per year, not per monitored user. Only analysts who actually run playbooks need a seat. Over-provisioning IR seats is one of the most common line-item overspends because buyers assume it scales with users.
Absorb growth through GB/day add-on SKUs
banded add-on pricingIngest growth is best handled with the GB/day add-on subscriptions (for example the Exabeam SIEM 50 GB/day add-on at $21K) layered on the base tier, rather than re-buying the next full base subscription at renewal.
Negotiate at quarter-end against the LogRhythm line
Deal-dependentSince the July 2024 merger, Exabeam and LogRhythm sit in one Thoma Bravo portfolio. The figures here are the 2023 Americas list; Exabeam publishes no discount schedule, so benchmark with a competing quote rather than an assumed percentage. Quarter-end is the pressure point, and cross-shopping the two lines still produces leverage.
When Exabeam is the right SIEM
Exabeam wins for insider-threat-focused SOCs, privileged-user-monitoring use cases, and any environment where behavioural analytics is the genuine binding constraint. The Security Analytics engine is the historical differentiator, and it is real capability rather than marketing. Buyers who want SIEM plus that analytics depth on one predictable meter get it cleanly through the Fusion bundle. Financial services compliance functions, defence contractor insider-threat teams, and high-end professional services firms with confidentiality-sensitive data fit the profile well.
Because New-Scale prices purely on GB ingested per day, Exabeam is most competitive where daily ingest is moderate and analytics value is high. It is least competitive where the estate ingests enormous raw log volume with little analytics need: a very high GB/day count drives the Fusion tier up quickly, and a log-management-first buyer may be better served by Security Log Management alone ($31K at 50 GB/day) or by a cheaper per-GB platform. At 50 GB/day, Fusion at $51K on the 2023 list sits below Splunk Cloud's list base (about $63K) and at roughly 40 percent of Splunk with Enterprise Security (about $124K), so Exabeam holds the headline-price edge at this volume and the decision turns on analytics depth.
Post-merger, the practical question for many buyers is which line in the combined Exabeam and LogRhythm portfolio fits. Self-hosted LogRhythm prices on MPS, which can favour quiet, high-fidelity sources; New-Scale prices on GB/day and favours cloud-native, analytics-led deployments. Confirm the long-term roadmap for whichever line you evaluate directly with the vendor before a multi-year commit.