How we source SIEM pricing figures

Every price on this site is either traceable to a document you can open yourself, or labelled as a model whose inputs are on the page. There is no third category. Each vendor page names the surface a rate came from and the date we last read it, so you can check the figure at source rather than take our word for it.

Page updated 13 October 2026/First published 2 May 2026

Sources we price from

• The vendor's own published pricing. The strongest source, and the first one we check. Microsoft, Cribl, Blumira, Graylog, CrowdStrike, Wazuh, ManageEngine, Edge Delta, Logmanager and Gravwell all publish rates or tier prices directly.
• AWS Marketplace listings. A real, public list price attached to a named SKU. It is where several vendors researched as quote-only turn out to publish after all (IBM QRadar, Rapid7, Devo, Panther, Splunk Enterprise), so we check it before writing that anyone keeps pricing private. We cite the listing, not the company: a marketplace list price is a published fact, a company's selling price is not something we know.
• The Azure retail price list. Microsoft's machine-readable rate feed, which is how Sentinel pay-as-you-go and commitment-tier rates are checked.
• Filed UK G-Cloud price lists. Suppliers on the Crown Commercial Service framework must file a price list to sell through it. For Splunk and Google SecOps that filing is the vendor's own end-customer list price, and for vendors with no public US list it is often the only published unit price in existence. We name the framework version (G-Cloud 15), the supplier who filed it and the document date.
• Vendor press releases, pricing announcements and end-of-life notices. For corporate facts: acquisitions, product retirements, pricing-model changes. Cited to the announcing company, with the date.
• The IBM Cost of a Data Breach Report. Free to download, and the input behind the breach-cost default in the ROI calculator. The edition and year are stated wherever the figure appears.

What we will not price from

Naming these matters more than naming the sources we do use, because each one is a way to make an unsourced number look sourced:

• Pricing aggregators and software directories. Self-reported buyer data and directory listings drift from the vendor's own page and cannot be checked. They are not a source here, even when the number looks plausible.
• Forum threads and community polls. Useful for understanding what buyers worry about. Not evidence of a price.
• Analyst reports we cannot open. A figure attributed to a paywalled report is an unsourced figure wearing a respectable label. If we have not read the document, we do not cite a number from it.
• Other cost sites, including our own. Search results echo published figures back, so a number is never corroborated by finding it repeated elsewhere.
• Old price lists presented as current. Where the only document is a dated reseller price book (LogRhythm 2022, Exabeam 2023), the page says so in the figure's label, not only in a footnote.

How ranges are constructed

Where a vendor publishes a rate, we report the rate and the surface it came from. Where a vendor publishes several dimensions separately, we report them separately and let you add them, rather than presenting our arithmetic as a published price. Where a vendor publishes nothing, the page says so and covers the quote drivers instead. Anything extrapolated beyond a published anchor (a volume band scaled from one marketplace SKU, a total-cost-of-ownership multiple, a storage or staffing line) is labelled as our estimate with its assumptions beside it. Calculator output is our arithmetic over inputs you can see and change.

What we deliberately do not publish

• Specific customer contract values. Where a specific organisation's SIEM contract value is known to us through public reporting, it is described in band terms only.
• Vendor-private list-vs-discount math. Bespoke discount levels are commercially confidential and change per-deal. Our calculator outputs a list-price figure; expect 25-40% movement on a real negotiation (our estimate; no vendor publishes a discount).
• Side-by-side feature grids. We publish positioning notes per vendor but not feature grids. SIEM feature parity changes quarterly; static grids are stale within months.

Editorial position

This site is operated by Digital Signet, an AI-development studio. We do not sell SIEM software, do not run a managed-SIEM service, and do not act as a SIEM reseller. The site carries one sponsor, Cribl, as a labelled strip and as a labelled unit below calculator results, which never changes the result above it. The sponsor has no say over content, no advance sight of it, and no advantage in any table, ranking, default or calculator result; its figures cite its published price page like every other vendor's. See how sponsorship works and /about for the operator and the wider network.

Vendor verification

Some vendor pages carry a "confirmed with vendor" stamp. The protocol behind it:

• We share the draft page with the vendor for factual review before publication.
• Corrections are accepted only against canonical public sources, which we then cite.
• Vendors have no influence on framing, methodology, or comparisons.
• Vendors cannot veto publication. The page publishes either way; only the stamp is theirs to give, withhold, or withdraw at any time.
• Verification never changes a sourced figure. It confirms and dates it.

The stamp is free and is never sold. It is not offered to a vendor while that vendor sponsors the site: verification only means something from a vendor with no stake in the page.

Contact

For methodology questions, corrections, or scenarios that don't fit cleanly: oliver@digitalsignet.com.