Editorially independent. Sponsors are disclosed and never influence our analysis.
Independent research, supported bycriblSponsor
Vendor / IBM QRadar

IBM QRadar pricing in 2026: EPS tiers, on-prem vs cloud, and enterprise costs

Independent QRadar pricing reference. IBM publishes no list price for QRadar, so this page covers the EPS and FPM licensing model, the one contract price filed on a public marketplace, Community Edition limits, hardware requirements, and how QRadar sits against Splunk and Sentinel. Pricing surfaces re-verified 7 September 2026.

Pricing model
Per EPS + FPM
Usage model; MVS for enterprise
IBM list price
Not published
Quoted through IBM sales only
Community Edition
Free, 100 EPS
5,000 flows/min cap
Only filed price
$12,074.40/yr
500 EPS + 10K FPM, AWS Marketplace

How much does IBM QRadar SIEM cost?

IBM does not publish QRadar list pricing. Its own pricing page defines the metrics and then routes you to sales, and the QRadar Suite Software License Guide gives resource-unit ratios with no rates attached. So this page will not show you a per-EPS tier table. What it shows instead is the licensing structure IBM does document, and the single QRadar price that exists on a public surface: the AWS Marketplace listing for IBM Security QRadar Suite Software, where a 12-month contract covering 500 events per second and 10,000 flows per minute is $12,074.40, with QRadar SOAR at $22,704.00 for two authorised users. Everything above that footprint is negotiated, and no public source can tell you what your quote will be.

Understanding EPS pricing

Events Per Second is QRadar's billing meter. An event is any single log entry crossing the QRadar Event Collector. EPS measures rate, not volume; a chatty source with small events drives higher EPS than a quiet source with large events, even at equal GB per day.

QRadar licences a sustained EPS rate (the long-running average) and a peak EPS rate (the burst ceiling). Sustained EPS at 110 percent of licensed for more than 24 hours triggers reconciliation. Peak bursts are smoothed across windows but persistent bursts force a tier upgrade. Right-sizing requires baseline data from a 30-day pilot. Most environments find their first licensing estimate understates real EPS by 30-50 percent.

EPS-to-GB conversion varies by source. Windows event logs average 60-80 EPS per GB per day. Firewalls and NetFlow data run 200-400 EPS per GB. SaaS audit logs run 30-50 EPS per GB. The dominant source mix in your environment defines the conversion ratio.

What IBM licenses, and what is actually priced in public

We used to publish a seven-tier QRadar price table here. It was compiled from reseller and market chatter, no row traced to a vendor source, and the one row we could finally check against a filed price turned out to be roughly double it. So it is gone. Below is what IBM documents, plus the only QRadar figures that exist on a public surface.

ProductLicensed byPublic priceSource
QRadar SIEM (usage model)Events per second (EPS) plus flows per minute (FPM)$12,074.40 / 12 monthsfor 500 EPS and 10,000 FPMAWS Marketplace, IBM Security QRadar Suite Software
QRadar SOARAuthorised users (minimum 2)$22,704.00 / 12 monthsfor 2 authorised usersAWS Marketplace, same listing
QRadar SIEM (enterprise model)Managed virtual servers (MVS), unlimited ingestionNot publishedquoted through IBM sales onlyIBM QRadar SIEM pricing page
QRadar NDRFlows per minute (FPM)Not publishedlicence guide gives ratios, no ratesIBM QRadar Suite Software License Guide
QRadar Community EditionCapped at 100 EPS and 5,000 FPMFree3-month renewable licence, as-is, unsupportedIBM QRadar 101, Community Edition

Verified 7 September 2026 against IBM and AWS Marketplace directly. IBM quotes QRadar through sales on every channel, so there is no list price to report for the enterprise model or for footprints larger than the marketplace contract above. The QRadar Suite Software License Guide does publish the resource-unit ratios behind the metrics (QRadar SIEM 100 EPS to 120 RU, or 1 MVS to 12 RU on the enterprise model; QRadar NDR 10,000 FPM to 300 RU; QRadar SOAR 1 authorised user to 1,000 RU), which lets you compare the relative weight of each product without a rate card. Maintenance, support and negotiated discount levels are set per contract and IBM publishes none of them, so we do not estimate them.

QRadar SaaS to Palo Alto Networks: what changed

Palo Alto Networks closed its acquisition of IBM's QRadar SaaS assets on 4 September 2024. Affected QRadar SaaS customers are being migrated, at no licence charge, to Palo Alto's Cortex XSIAM platform, with IBM Consulting acting as a preferred migration partner; existing QRadar SaaS deployments continue to run and stay supported until each customer is ready to move. The on-prem QRadar Suite products (including QRadar Log Insights) remain IBM-owned and are unaffected by the sale.

What it means for pricing comparisons: net-new buyers evaluating a cloud-native SIEM should price Cortex XSIAM as part of their shortlist alongside QRadar on Cloud renewals, because the QRadar SaaS roadmap is no longer an IBM-led product roadmap. On-prem QRadar pricing below is unaffected.

This is a fast-moving transition. Always verify the current migration path, renewal options, and product ownership status directly with IBM's and Palo Alto's most recent announcements before committing - the public mechanics may have moved on since this page was last updated.

On-prem hardware requirements

For self-managed QRadar deployments, expect IBM-spec or equivalent hardware with the following rough configurations. These are general server and storage cost estimates for the specs described, not IBM prices, and they are separate from whatever IBM quotes you for the licence.

DeploymentHardwareCost
All-in-one (under 1,000 EPS)Single appliance / VM, 32GB RAM, 2TB storage$38K-$60K
Distributed (1,000-5,000 EPS)Console + 2 collectors, 64-128GB RAM each, 10-20TB total$80K-$160K
Enterprise (5,000-15,000 EPS)HA console, 4+ collectors, 256GB RAM, 50TB+ tiered storage$200K-$400K
Large enterprise (25,000+ EPS)Multi-site, dedicated event processors, 100TB+$500K-$1.2M

What drives QRadar cost at each scale

Since IBM publishes no rates above the marketplace contract, the useful thing to know going into a quote is which lines will be on it. These are the cost drivers by deployment shape, not price predictions.

ScenarioProfileCost drivers on the quoteNotes
StartupCommunity Edition, 100 EPSNone (free licence)Free, capped at 100 EPS and 5,000 flows/min; renewable 3-month licence, unsupported, learning only
Small businessAround 500 EPS, single-nodeLicence units, appliance or VM, storage retentionThe one publicly filed QRadar SIEM price covers this footprint: 500 EPS and 10,000 FPM
Mid-marketLow thousands of EPS, cloud-deliveredLicence units, retention tier, add-on modulesSubscription folds infrastructure and updates into the licence line
EnterpriseFive figures of EPS, hybridLicence units, distributed collectors, HA, professional servicesDistributed deployment; deployment services are usually a separate contract
Large enterpriseMulti-site, dedicated event processorsLicence units, multi-site hardware, UBA and threat-intel add-onsNegotiated enterprise agreement; IBM publishes no rate card at this scale
FAQ

Common questions

How much does IBM QRadar cost?

IBM does not publish QRadar list pricing. Its own QRadar SIEM pricing page defines the licensing metrics (events per second and flows per minute for the usage model, managed virtual servers for the enterprise model) and then routes buyers to a sales conversation, and the QRadar Suite Software License Guide gives resource-unit ratios with no rates attached. The one QRadar price filed on a public surface is the AWS Marketplace listing for IBM Security QRadar Suite Software, where a 12-month contract covering 500 events per second and 10,000 flows per minute is listed at $12,074.40, and QRadar SOAR for 2 authorised users at $22,704.00. Anything beyond that footprint is quoted, so we do not publish a tier table. Treat any per-EPS figure you find elsewhere as a third-party estimate rather than an IBM rate.

What is the QRadar Community Edition?

QRadar Community Edition (QRadar CE) is a free, single-node version of QRadar capped at 100 EPS and 5,000 flows per minute, issued as a renewable three-month licence. IBM provides it as-is, without warranty or support. It includes the core SIEM features but excludes premium add-ons like User Behavior Analytics, X-Force Threat Intelligence feeds, and the QRadar Vulnerability Manager. Community Edition is intended for learning, testing, and very small environments. Production deployments need a paid licence.

How do I estimate EPS from log volume?

Rough conversions vary by log source type. Text-heavy sources (Windows event logs, syslog) average 60-80 EPS per GB per day. Compact sources (firewall logs, NetFlow) can reach 200-400 EPS per GB. As a rule of thumb, 1 GB per day of mixed enterprise log volume equates to roughly 70 EPS sustained, with bursts to 2-3x peak. QRadar measures both sustained and peak EPS; consistently exceeding the licensed peak triggers reconciliation.

QRadar on Cloud or on-premise?

QRadar on Cloud removes hardware management and is the right choice for organisations under roughly 5,000 EPS without strict data residency requirements. QRadar on-prem wins on unit cost above approximately 10,000 EPS and where compliance demands data stay in-house. Hybrid deployments split: QRadar Console and Event Collectors on-prem, longer-term storage in cloud. The hybrid model is common in healthcare, finance, and government.

QRadar vs Splunk vs Sentinel cost at equivalent volume?

This one cannot be answered on a like-for-like price line, and we will not pretend otherwise. At 50 GB per day, Splunk Cloud runs roughly $50K base ingest (about $100K all-in once Enterprise Security is added, which roughly doubles it) and Sentinel $59K-$78K (50 GB promotional commit vs PAYG), because both vendors publish rates. IBM publishes none for QRadar, so the only public QRadar reference point is the AWS Marketplace contract at 500 EPS and 10,000 FPM, a much smaller footprint than 50 GB per day, and it cannot be scaled up to a comparable number without inventing a discount curve. Get a quote from IBM and put it beside the published Splunk and Sentinel rates yourself. On non-price grounds, QRadar's appeal is compliance content packs and out-of-box detection rules for regulated industries, Splunk wins on raw analytics depth, and Sentinel wins on Microsoft-shop TCO.
Continue reading

Related cost references

Splunk pricing
Per-GB alternative
Microsoft Sentinel pricing
Cloud-native alternative
Pricing models explained
Per-EPS vs per-GB
Cloud vs on-premise SIEM
QRadar's strongest tradeoff
Implementation cost
QRadar deployment timeline
SIEM cost calculator
Compare side by side

Didn't find your answer?

Ask us. A real person reads every question and we answer the ones we can, with sources. If your question would help other readers, we may publish an anonymised version, with your permission. General reference only.

Ask a question

[email protected]

Updated 13 July 2026