SIEM cost by organisation size: from startup to enterprise
Annual SIEM cost ranges, vendor recommendations, and staffing requirements for every organisation size band. From small business ($30K) to large enterprise ($5M+), with the trade-offs that drive each band's vendor decision. The band ranges are our model of all-in cost (licence, staffing, storage, integration), the same bands the homepage uses; vendor licence figures inside them are published list prices. Updated October 2026.
Page updated 13 October 2026/First published 7 April 2026
Under 100 employees, <10 GB/day
At this size, the SIEM decision is usually managed-vs-DIY rather than vendor-vs-vendor. Sentinel wins for Microsoft 365 environments because audit logs are free. Blumira targets this band with predictable monthly pricing and bundled detection content. Wazuh works if you have an in-house Linux engineer who enjoys it. Skip Splunk, QRadar, and Elastic Cloud at this size: they are overkill and overpriced.
- + Microsoft Sentinel (free M365 ingest)
- + Blumira flat-rate
- + Wazuh self-managed
1 part-time analyst or MSSP coverage
100-1,000 employees, 10-100 GB/day
The middle band is the most contested. Sentinel almost always wins for Microsoft shops. Sumo Logic Flex (free ingest, with storage and search burning credits) suits SaaS-first organisations that search selectively. Elastic Cloud suits engineering-strong teams. Splunk Cloud is viable but rarely the cheapest. QRadar appears only when compliance audit history demands it. Most organisations land here on a co-managed model: in-house tier 1 plus MSSP overnight coverage.
- + Microsoft Sentinel commitment tier
- + Sumo Logic Enterprise
- + Elastic Cloud Platinum
2-4 FTE analysts or co-managed MSSP
1,000-10,000 employees, 100-500 GB/day
At enterprise scale, all three legacy SIEM vendors are credible. Splunk wins on analytics depth and the premium app ecosystem. Sentinel wins on Microsoft integration and TCO when commitment tiers apply. QRadar wins on compliance audit history. Multi-year Enterprise Agreements with 25-40 percent list discounts are routine. In-house 24x7 SOC capability becomes economically viable above 5,000 employees.
- + Splunk Cloud / Enterprise
- + Microsoft Sentinel commitment
- + IBM QRadar
5-10 FTE 24x7 SOC + engineering
10,000+ employees, 500+ GB/day
Above 500 GB per day, the conversation shifts from licence cost to operations cost. Splunk on-prem starts to win on unit economics. QRadar's distributed architecture handles the volume. Sentinel scales technically but the bill scales linearly. Most large enterprises run multi-vendor stacks: SIEM for compliance and high-fidelity detection, XDR for endpoint, dedicated threat intel platform, and a custom detection engineering function.
- + Splunk Enterprise on-prem
- + Splunk Cloud + Enterprise hybrid
- + QRadar distributed
10-30 FTE SOC + threat intel + detection engineering
What does each budget tier actually buy?
| Annual budget | What it buys |
|---|---|
| $50K | Cloud SIEM with 30-50 GB/day, 90-day retention, business-hours coverage, basic detection rules from vendor pack |
| $100K | Cloud SIEM with 75-100 GB/day, 365-day retention, 1-2 analysts, vendor content packs plus light tuning |
| $250K | Cloud or hybrid SIEM with 150-200 GB/day, 365-day retention, 3 analysts, custom detection content, weekly threat hunts |
| $500K | Splunk at 200-300 GB/day on published rates (or a quoted QRadar equivalent, since IBM publishes none), full 24x7 SOC (5-6 FTE), threat intel feeds, monthly red team exercises |
| $1M+ | Multi-vendor stack at 500+ GB/day, dedicated detection engineering function, threat intel platform, custom integrations |
Five common cost traps as you grow
Per-GB pricing growing faster than budget
When log volume grows 30+ percent year over year, per-GB SIEM costs outpace budget. Switch to commitment tiers earlier than the break-even calculator suggests.
Tier ceiling cliffs in flat-rate models
On Sumo Logic Flex, searches beyond the upfront capacity you bought burn at the metered rate of 20 credits per GB scanned, double the 10-credit upfront rate. Panther flat tiers have ceilings; crossing them triggers overage rates 1.5-2x in-tier pricing. Monitor usage weekly and upgrade before crossing.
Splunk Cloud committed retention
Splunk Cloud commitments lock retention at the contract level. Reducing retention mid-term does not reduce cost. Right-size retention before signing.
Sentinel commitment tier mismatch
Sentinel commitment tiers are flexible but require monitoring. Volume staying below your tier costs you the difference; volume exceeding it incurs overage.
QRadar EPS peak bursts
QRadar measures peak EPS and reconciles. Bursts from non-security sources (web traffic spikes, batch jobs) trigger tier upgrades that don't reflect security value.