Quick answer: SIEM pricing in 2026 falls into three buckets. Cloud SIEM you run yourself costs roughly $2 to $7 per GB of logs ingested per day (Microsoft Sentinel is about $4.30 per GB pay as you go, with commitment tiers that bring it closer to $2). Managed SIEM, where a provider runs the platform and watches it, costs $1,500 to $10,000 per month for most SMBs and mid-market companies. Open source SIEM such as Wazuh or Elastic is license free, but you pay for infrastructure and the engineers who tune it. Above roughly 50 GB per day, a custom built open source SIEM is usually the cheapest path.
SIEM pricing models explained
| Pricing model | Typical 2026 price | Who it suits |
|---|---|---|
| Per GB ingested (cloud SIEM) | $2 to $7 per GB per day | Teams with their own analysts and predictable log volume |
| Per user or per device | $3 to $10 per device per month | Endpoint heavy environments that want predictable bills |
| Managed SIEM (platform plus people) | $1,500 to $10,000 per month | Companies without a 24/7 team to watch the alerts |
| Open source (Wazuh, Elastic) | License free, pay infrastructure and engineering | Above ~50 GB per day, or strong in-house Linux skills |
What cloud SIEM really costs at common log volumes
| Daily log volume | Self-run cloud SIEM (ingest only) | Managed SIEM with 24/7 eyes |
|---|---|---|
| 5 GB per day | $300 to $650 per month | $1,500 to $3,000 per month |
| 20 GB per day | $1,200 to $2,600 per month | $2,500 to $5,500 per month |
| 50 GB per day | $3,000 to $6,500 per month | $4,500 to $10,000 per month |
| Above 50 GB per day | Commitment tiers or custom open source build | Custom quote, open source backend usually wins |
Ingest is only the entry ticket. Retention beyond the included 90 days, rehydration for investigations, and premium connectors all land on the same invoice, which is why two companies with the same SIEM can pay wildly different bills.
Collection is not detection: the lesson of October 2026
Denmark’s Central Person Register case, disclosed in October 2026, is the clearest recent proof that owning a SIEM is not the same as being protected. Records on about 8.8 million people were extracted through an approved partner’s access over weeks, and administrators only became aware on October 2. Every request looked normal in the logs. The logs existed. Nobody had built the volume baseline and alert that would have flagged one partner suddenly pulling millions of records. That is the difference between paying for ingest and paying for detection engineering plus a human who reads the alert at 2am: the second half is what our SOC as a service pricing guide covers.
The hidden costs vendors do not put on the pricing page
- Retention: compliance frameworks like NIS2, CMMC and SOC 2 expect 12 months or more. Long term storage can add 20 to 40 percent to the bill.
- Tuning and detection engineering: an untuned SIEM is a noise machine. Budget analyst time or buy it managed.
- Staffing: three shifts of analysts to watch it 24/7 is $45,000+ per month in house, which is why most SMBs buy the managed version.
- Noisy sources: verbose firewalls and DNS logs can double ingest for marginal detection value. Filtering them is the single fastest cost cut.
How to pay less for SIEM in 2026
- Use commitment tiers instead of pay as you go once your volume is stable
- Filter and route logs: hot path for detections, cheap archive for compliance
- Go open source above roughly 50 GB per day: we design and run custom Wazuh and Elastic builds, see SIEM as a service
- Buy platform and monitoring together: a managed SIEM inside a shared SOC is typically cheaper than separate ingest, tooling and after-hours staffing
- Buy through a partner: ITSecOps partners with every industry standard vendor, and partner pricing is cheaper than buying direct
FAQ
How much does a SIEM cost per month?
Self-run cloud SIEM: roughly $300 to $650 per month at 5 GB per day of ingest, $3,000 to $6,500 at 50 GB per day. Managed SIEM with 24/7 monitoring: $1,500 to $10,000 per month for most SMBs and mid-market companies.
How is Microsoft Sentinel priced?
Pay as you go analytics ingest is about $4.30 per GB, and commitment tiers from 100 GB per day bring the effective rate down sharply. Microsoft 365 E5 includes a daily grant of Microsoft 365 log ingest, which can make Sentinel the cheapest option for E5 shops.
Is open source SIEM really free?
The license is free, the capability is not. A production Wazuh or Elastic SIEM needs servers, storage and an engineer who owns upgrades, parsing and detections. Below about 50 GB per day, managed cloud SIEM is usually cheaper once salaries count. Above it, open source usually wins.
What is the difference between SIEM pricing and SOC pricing?
SIEM pricing buys the platform that collects and correlates logs. SOC pricing buys the people who watch it 24/7 and respond. A SIEM without a SOC caught nothing in the Danish CPR case, which is why most buyers at SMB scale should price them together.
GET A SIEM QUOTE SIZED TO YOUR LOG VOLUME
Related: SIEM as a service, including custom open source builds · SOC as a service pricing 2026 · Shared SOC 24×7 · Live vendor price comparison · MDR pricing 2026