Exabeam pricing in 2026: New-Scale GB/day tiers explained
The independent Exabeam New-Scale pricing reference. Priced by gigabytes ingested per day across Security Log Management, Exabeam SIEM, Security Analytics, Security Investigation, and the Fusion bundle, with real 50 GB/day list anchors and cost scenarios from small SOC to enterprise. Updated July 2026.
List anchors from the Exabeam Americas reseller price list (effective 1 August 2023); product taxonomy verified against exabeam.com/platform. Real deals discount off these figures.
How Exabeam pricing actually works
Exabeam's New-Scale Security Operations Platform, launched in October 2022, is priced on one meter: gigabytes ingested per day. There is no per-monitored-user, per-entity, or per-source platform charge. You choose a product and a daily-ingest tier, and the annual subscription follows that tier. This is the single most important correction to make about Exabeam pricing: legacy write-ups describing per-user or per-source Exabeam licensing do not describe the New-Scale line.
The product family, from cheapest to most complete at 50 GB/day on the Americas reseller list: Security Log Management at $31K (log management and search only), Exabeam SIEM at $36K (adds correlation, dashboards, and detection rules), Security Analytics at $31K (the behavioural-analytics engine, the historical Exabeam differentiator), Security Investigation at $39K (Threat Center case management), and Fusion at $51K, the top bundle that combines Exabeam SIEM and Security Analytics in one experience. Each product is sold in daily-ingest tiers that scale with volume.
Volume is the cost driver. Fusion runs $51K at 50 GB/day, $88K at 100, $210K at 300, $325K at 500, $598K at 1,000, and $2.63M at 5,000 GB/day. The tier boundaries matter more than the linear rate: moving from 100 to 300 GB/day more than doubles the bill. GB/day add-on SKUs let you top up ingest without jumping to the next full base tier, so measuring true daily ingest before you buy is the highest-leverage step.
Two SKUs sit outside the GB/day model. Incident Responder, the SOAR add-on, is priced per analyst seat at $24,000 per seat per year. The CrowdStrike Ingester is a data connector priced per user (roughly $3.35 to $5.40 per user per year, volume-tiered), not a platform charge. Neither is a per-user meter on the platform itself, and both are the exceptions that prove the GB/day rule.
Nova is not a pricing tier. Announced in April 2025, Exabeam Nova is an agentic-AI layer, a set of specialised AI agents (Investigation, Search, Threat Scoring, Analyst Assistant, Advisor, and Visualization) that sits on top of New-Scale to automate triage, case summaries, and investigation. It is a capability layer over the platform, not a separate SKU line you buy in tiers. Security Analytics remains where the behavioural-analytics value lives, and for buyers whose binding constraint is insider-threat or privileged-user detection, the Fusion bundle is the cleanest way to license SIEM plus that analytics depth on one meter.
The Exabeam-LogRhythm merger completed on 17 July 2024 under Thoma Bravo, and the combined company operates as Exabeam. LogRhythm's self-hosted line keeps its MPS-based (Messages Per Second) licensing, while New-Scale stays on GB/day, so the two lines are not directly comparable on a single meter (Axon, the former LogRhythm cloud product, was retired post-merger). Against Splunk, Exabeam is competitive on volume: at 50 GB/day, Fusion lists around $51K versus roughly $50K base and about $100K all-in for Splunk. Cross-shopping the portfolio still produces leverage, and quarter-end is the right pressure point.
Exabeam New-Scale product reference
| SKU | Pricing | Notes |
|---|---|---|
| Security Log Management | $31K at 50 GB/day | Cloud-scale log management and search only; no analytics |
| Exabeam SIEM | $36K at 50 GB/day | Log management plus correlation, dashboards, and detection rules |
| Security Analytics (UEBA) | $31K at 50 GB/day | Behavioural analytics engine; the historical Exabeam differentiator |
| Security Investigation | $39K at 50 GB/day | Threat Center case management and investigation workbench |
| Fusion (full bundle) | $51K at 50 GB/day | Top New-Scale bundle: Exabeam SIEM plus Security Analytics in one meter |
| Incident Responder | $24,000 / seat / yr | SOAR add-on; the only per-seat SKU, priced per analyst |
| CrowdStrike Ingester | $3.35-$5.40 / user / yr | A data connector priced per user, volume-tiered; not the platform |
Real-world Exabeam cost scenarios
| Scenario | Profile | Annual licence | Notes |
|---|---|---|---|
| Small SOC | 50 GB/day, Exabeam SIEM standalone | $36K/yr | Entry New-Scale SIEM at list |
| Mid-market SOC | 100 GB/day, Fusion bundle (SIEM + Analytics) | $88K/yr | Full UEBA plus SIEM on a single GB/day meter |
| Mid-market with response | 300 GB/day Fusion + 5 Incident Responder seats | $330K/yr | $210K Fusion plus 5 x $24K IR seats |
| Enterprise | 1,000 GB/day, Fusion bundle | $598K/yr | Per-GB rate compresses at volume |
| Large enterprise | 5,000 GB/day, Fusion bundle | $2.63M/yr | List figure; heavy discounting typical at this scale |
Figures are list prices from the Exabeam Americas reseller price list (effective 1 August 2023), combined at the stated GB/day tiers. Incident Responder is $24,000 per seat per year. Discounts of 20-30 percent are routine on multi-year GB/day commits.
Five Exabeam cost optimisations that genuinely work
Filter and route noisy sources before ingest
moves you down a GB/day tierNew-Scale bills on gigabytes ingested per day, so the fastest saving is cutting or routing high-volume, low-value sources (verbose firewall, DNS, netflow) before they reach Exabeam. Tier boundaries are where the money is: Fusion jumps from $88K at 100 GB/day to $210K at 300 GB/day, so staying inside a lower tier matters more than the linear rate.
Buy the right product, not the full bundle
up to $20K at 50 GB/dayFusion ($51K at 50 GB/day) bundles Exabeam SIEM and Security Analytics. If you only need log management and search, Security Log Management lists at $31K for the same volume, and Exabeam SIEM alone is $36K. Match the SKU to the capability you actually run rather than defaulting to the bundle.
Size Incident Responder seats to real responders
$24K per unused seatIncident Responder is priced per seat at $24,000 per seat per year, not per monitored user. Only analysts who actually run playbooks need a seat. Over-provisioning IR seats is one of the most common line-item overspends because buyers assume it scales with users.
Absorb growth through GB/day add-on SKUs
banded add-on pricingIngest growth is best handled with the GB/day add-on subscriptions (for example the Exabeam SIEM 50 GB/day add-on at $21K) layered on the base tier, rather than re-buying the next full base subscription at renewal.
Negotiate at quarter-end against the LogRhythm line
20-30% off listSince the July 2024 merger, Exabeam and LogRhythm sit in one Thoma Bravo portfolio. The figures here are reseller list; multi-year GB/day commits routinely land 20-30 percent off, and quarter-end is the pressure point. Cross-shopping the two lines still produces leverage.
When Exabeam is the right SIEM
Exabeam wins for insider-threat-focused SOCs, privileged-user-monitoring use cases, and any environment where behavioural analytics is the genuine binding constraint. The Security Analytics engine is the historical differentiator, and it is real capability rather than marketing. Buyers who want SIEM plus that analytics depth on one predictable meter get it cleanly through the Fusion bundle. Financial services compliance functions, defence contractor insider-threat teams, and high-end professional services firms with confidentiality-sensitive data fit the profile well.
Because New-Scale prices purely on GB ingested per day, Exabeam is most competitive where daily ingest is moderate and analytics value is high. It is least competitive where the estate ingests enormous raw log volume with little analytics need: a very high GB/day count drives the Fusion tier up quickly, and a log-management-first buyer may be better served by Security Log Management alone ($31K at 50 GB/day) or by a cheaper per-GB platform. At 50 GB/day, Fusion at around $51K sits close to Splunk (roughly $50K base, about $100K all-in), so the decision turns on analytics depth rather than headline meter price.
Post-merger, the practical question for many buyers is which line in the combined Exabeam and LogRhythm portfolio fits. Self-hosted LogRhythm prices on MPS, which can favour quiet, high-fidelity sources; New-Scale prices on GB/day and favours cloud-native, analytics-led deployments (Axon is retired). Confirm the long-term roadmap for whichever line you evaluate directly with the vendor before a multi-year commit.