Panther pricing in 2026: the per-TB volume meter, real cost, and the Databricks acquisition

Panther prices on ingested volume, not on a base licence plus per-source line items. The one public anchor is Panther's AWS Marketplace listing: $50,000 per year per 1 TB of monthly ingestion, on a 12-month contract, with 1-year data retention and $1 per unit overage. Everything else is consumption-priced and custom, sitting alongside a Free-forever community tier. There is no published rate card beyond the Marketplace listing, so the real Enterprise number comes through a quote that scales with monthly terabytes, retention, and deployment topology.

To size a deployment, convert daily ingest to monthly terabytes: gigabytes per day times roughly 30, divided by 1,000. A 50 GB-per-day mid-market deployment is about 1.5 TB per month, which at the AWS list anchor is roughly $75K-$90K per year all-in, not the six-figure sum a per-source model would imply. 100 GB/day is about 3 TB/month (~$150K), 200 GB/day about 6 TB/month (~$300K), and 500 GB/day about 15 TB/month (~$750K). These larger bands are extrapolations from the single list anchor and should be confirmed against a quote.

The defining product feature is detections-as-code. Panther detections are Python files committed to a Git repository, deployed via CI/CD pipeline, peer-reviewed before merge, and tested against historical event samples before promotion. The discipline is genuine and produces materially better detection signal per dollar than UI-based ad-hoc rule editing, but only for organisations whose security engineers genuinely write code. For SOCs whose analysts do not write Python, the detection-as-code model is friction rather than feature, and Splunk, Sentinel, or Sumo Logic are structurally better fits.

Panther is built on a security data lake, and the public meter is simple: total monthly terabytes ingested. There is no published split between detection-path and retention-only data, so the cost-discipline levers are schema-level filtering before ingest and negotiating how retention-heavy volume is treated in your quote. Historically the architecture was the "Panther for Snowflake" story; the product keeps your data in your own Snowflake or Databricks instance, with warehouse infrastructure billed separately from the Panther licence.

Schema-on-write parsing is the second volume lever. Panther's parser framework supports field-level drop rules at parse time. Aggressive schema discipline (dropping debug fields, routine NetFlow noise, verbose Windows Service Control Manager spam, and similar low-fidelity data before it lands) typically removes 20-30 percent of metered volume. Since the meter is per terabyte ingested, that discipline maps straight to the bill.

The material 2026 development is ownership. On 16 June 2026, at the DATA and AI Summit, Databricks announced its intent to acquire Panther to anchor its "security lakehouse" category. The deal reframes the old Snowflake-only narrative: Panther already supported Databricks as a warehouse, and the acquisition makes that the strategic direction. Pricing has not been publicly restructured, so the AWS Marketplace volume meter remains the reference. Buyers evaluating Panther in late 2026 should ask directly how the acquisition affects contract terms, roadmap, and the Snowflake-versus-Databricks warehouse choice.

Panther wins decisively for engineering-led security teams at fast-growing technology companies, fintech, and cloud-native startups whose detection engineering practice already mirrors infrastructure engineering practice (Git workflow, CI/CD, peer review, automated testing). The detection-as-code discipline is genuine and compounds: customers who genuinely adopt the discipline materially out-perform UI-driven ad-hoc rule editing on detection signal-per-dollar over 24-36 month windows. The buyer-fit decision turns on whether the security team writes code; for teams that do, Panther is structurally the right shape.

Panther loses for traditional analyst-led SOCs whose analysts do not write Python. The detection-as-code model becomes friction rather than feature, and Splunk Enterprise Security, Microsoft Sentinel, or Sumo Logic Cloud SIEM are structurally better fits. Panther also loses where bundled SOAR is a binding requirement (Panther integrates with external SOAR rather than bundling), where compliance retention beyond 12 months is the binding economic constraint (Devo or Sumo Logic Infrequent tier win cleanly), and where the customer's preferred SIEM evaluation process is transactional list-price comparison (Panther's quote-based pricing makes this difficult).

The 2026 competitive trajectory is favourable for Panther in its target buyer segment. The detection-as-code positioning has cleanly differentiated against Sumo Logic and Datadog in engineering-led security team conversations, and the open-source detection library (panther-analysis on GitHub) has matured into a genuine community asset. For engineering-first SOCs evaluating cloud-native SIEM in 2026, Panther deserves the competitive shortlist alongside Sumo Logic and Datadog.