Reference / Normalised

SIEM cost per EPS in 2026: every major vendor normalised

Independent normalised cost-per-EPS comparison across the twelve major SIEM vendors, with a published source per row. Per-GB and GB/day vendors converted to per-EPS equivalents at a stated ratio; vendors that publish no rate card are marked opaque rather than estimated. Updated July 2026.

Cheapest converted

$0.80-$1.20

Exabeam, Devo equiv

Native per-EPS

OPAQUE

QRadar, quote only

Converted range

$1.00-$2.40

Most per-GB vendors

Conversion ratio

~70-80 EPS/GB

Mixed enterprise typical

Why a cost-per-EPS comparison matters

Cost-per-EPS comparisons matter for two buyer profiles. First, organisations evaluating natively event-rate-priced vendors (IBM QRadar per-EPS, LogRhythm via per-MPS) where the meter aligns directly with the buying axis, though only LogRhythm publishes an anchor. Second, organisations whose log profile is event-rate-driven rather than volume-driven (network-heavy environments with extensive firewall, NetFlow, and DNS logs) where the per-EPS view of vendor pricing more accurately reflects actual cost dynamics than the per-GB view.

The table below shows the native rate for vendors that price per-EPS or per-MPS, and the converted per-EPS equivalent for vendors that price per GB or per GB per day. Conversions use a typical 75 EPS-per-GB ratio for mixed enterprise log mix, applied to the corrected per-GB figures, so they are shown as equivalents and estimates. For specific environments the conversion can vary by 30 to 50 percent in either direction depending on log source mix; see our EPS-to-GB conversion page for the full methodology and per-source ratio reference.

Several vendors do not price per EPS at all, or publish no rate at all, and are represented honestly rather than forced into a number. IBM QRadar does meter per EPS but publishes no list price on any channel, so it is marked OPAQUE here and carries no figure. Securonix EON prices per GB per day across tiers it does not publish, so it is marked OPAQUE too. Google Chronicle uses a GB data-cap and credit model at roughly £2,000 per TB per year, not a per-employee meter. Sumo Logic (Flex credits) and Datadog Cloud SIEM (multi-line) have no clean per-EPS headline. These entries are marked as not per-EPS so buyers do not read a converted figure as a native rate.

All twelve vendors, normalised to per-EPS equivalents where a rate exists

Vendor	Model	$/EPS/mo	All-in @ 5K EPS	Note	Source
Exabeam (GB/day equiv)	GB/day converted	$0.80-$1.15 equiv	$48K-$68K (converted)	GB/day pricing; SIEM ~$36K, Fusion ~$51K at 50 GB/day	Americas reseller price list
Devo (per-GB equiv)	Per-GB converted	$1.00-$1.20 equiv	$60K-$73K (converted)	Daily-ingest; 400-day retention bundled	AWS Marketplace list
Google Chronicle (data-cap)	GB data-cap / credit	Not per-EPS	~$62K (converted)	Data-cap / credit, ~£2,000/TB/yr; not per-employee, not per-EPS	UK G-Cloud listing
Microsoft Sentinel (per-GB equiv)	Per-GB converted	$1.30-$1.75 equiv	$79K-$104K (converted)	Commitment vs PAYG ($4.30/GB East US); free MS365 ingest tilts lower	Azure retail price list
Panther (per-TB equiv)	Per-TB converted	$1.65-$2.00 equiv	$100K-$120K (converted)	$50K per TB per month; detection-as-code	AWS Marketplace listing
Splunk Cloud (per-GB equiv)	Per-GB converted	$1.10-$2.20 equiv	$67K base / $133K ES (converted)	At ~75 EPS/GB; base ingest to ES all-in	Splunk published rates
CrowdStrike LogScale (per-GB equiv)	Per-GB converted	$2.40 equiv	~$145K (converted)	$5.95/GB PAYG; 7-day default retention; not the cheapest	AWS Marketplace listing
IBM QRadar	Per-EPS native, quote only	OPAQUE	OPAQUE	QRadar is genuinely metered per EPS, but IBM publishes no list price and quotes every channel through sales, so no verified rate exists to place here	No published rate card
LogRhythm	Per-MPS self-hosted	~$65/MPS/yr published	~$5.40/MPS/mo equiv (converted)	MPS is messages per second, not EPS; self-hosted; Axon retired	Filed ULP price book (Dec 2022)
Securonix EON	GB/day (not EPS)	OPAQUE	OPAQUE	Prices per GB/day, not EPS; tiers BASIC / STANDARD / ADVANCED / ALL-IN, none published	No published rate card
Sumo Logic (Flex)	Flex credits (not per-EPS)	Not per-EPS	Credit-metered	Flex model; free ingest, ~$1.50/credit on scan + storage; no clean per-EPS	Sumo Logic published rates
Datadog Cloud SIEM	Multi-line meter	Not per-EPS	Multi-line	Ingest $0.10/GB; indexing $1.70-$2.50 per 1M events; Cloud SIEM $5 per 1M analyzed events	Datadog published price list

Every figure here traces to the published anchor named in the Source column, and each of those vendor pages carries the source URL and the date it was last verified. Rows marked converted apply the stated 75 EPS-per-GB ratio to that published rate; they are arithmetic on a real number, not an estimate of an unpublished one. Where a vendor publishes no rate card at all (IBM QRadar, Securonix EON) the row reads OPAQUE and carries no figure. Vendors that do not price per EPS (Chronicle data-cap, Sumo Flex credits, Datadog multi-line) are shown as not per-EPS. All-in column at 5,000 EPS represents a typical mid-market deployment. Negotiated multi-year EA discounts of 25 to 40 percent are routine at meaningful scale.

Pricing by EPS band

EPS band	Profile	Typical annual range
1,500 EPS	SMB / lower mid-market	$20K-$55K (most vendors)
5,000 EPS	Mid-market	$60K-$150K (most vendors)
15,000 EPS	Lower enterprise	$180K-$450K
50,000 EPS	Enterprise	$550K-$1.4M
200,000+ EPS	Global enterprise	$1.4M-$3M

When per-EPS is the right comparison axis

Per-EPS comparison is the right axis for organisations whose log volume is event-rate-driven rather than gigabyte-driven. The classical fit is regulated mid-market with extensive network telemetry: financial services with deep firewall logging, retail with PCI-scope payment processing networks, healthcare with detailed access logs from clinical systems. These environments produce high event rates relative to byte volume and benefit from comparing vendors on the meter that genuinely tracks underlying cost.

Per-EPS comparison is the wrong axis for cloud-native environments whose log mix is dominated by verbose JSON audit logs (AWS CloudTrail, Azure Activity Log, Microsoft 365 audit). These environments produce low event rates relative to byte volume; per-EPS comparison overstates the relative cost of per-GB vendors and understates per-EPS vendors. Per-GB comparison is the cleaner axis for this profile.

Per-EPS comparison is also the wrong axis for vendors whose meter does not track event rate at all. Securonix EON (per GB per day), Google Chronicle (GB data-cap and credit), Sumo Logic (Flex credits), and Datadog Cloud SIEM (multi-line ingest, index, and analyzed-event metering) do not align with a per-EPS axis; comparing them on per-EPS forces a conversion that misrepresents how they actually bill. Use the SIEM cost-per-GB page or the calculator for those vendors instead.

Always combine cost-per-EPS analysis with detection content fit, compliance content pack value, SOC retraining capacity, and broader IT consolidation context before making vendor decisions. Per-EPS normalisation is a useful starting point for event-rate-driven environments, not a substitute for the broader buyer-fit analysis.

FAQ

Common questions

Which SIEM is cheapest per EPS in 2026?

Only two vendors genuinely price on an event-rate axis: IBM QRadar (per-EPS) and LogRhythm (per-MPS, self-hosted). Of those, only LogRhythm has a published anchor, roughly $65 per MPS per year from its filed ULP price book. IBM publishes no QRadar list price at all, so we mark it OPAQUE and give no per-EPS figure rather than estimating one. On converted per-EPS equivalents from vendors that price per GB or GB per day, the lowest are Exabeam (~$0.80 to $1.15 equivalent) and Devo (~$1.00 to $1.20 equivalent), both converted from published rates at 75 EPS per GB. CrowdStrike Falcon LogScale is no longer cheap: its $5.95 per GB rate converts to ~$2.40 equivalent per EPS per month. Securonix EON does not price per EPS at all and publishes no list, so it carries no figure here. Use the table above to compare against your own log mix.

Where does QRadar sit in the per-EPS comparison?

It carries no figure on this page, and that is the honest answer. QRadar is genuinely metered per EPS, which makes it the most natural fit here, but IBM publishes no list price on any channel and quotes every deal through sales. There is therefore no vendor-published rate to normalise, and this comparison shows the row as OPAQUE rather than placing an unverified number alongside vendors that do publish. Our QRadar pricing page used to carry reseller-compiled ranges as a budgeting starting point; they were removed on 7 September 2026 because no row traced to a vendor source and the one row we could check against a filed price was roughly double it. That page now carries the single QRadar price that does exist in public, an AWS Marketplace contract covering 500 EPS and 10,000 flows per minute at $12,074.40 a year. It is a bundled footprint rather than a per-EPS rate, which is why it does not appear as a figure in the table above. What can be said without a figure is structural: QRadar bundles compliance content packs (PCI, HIPAA, SOX, FedRAMP), enterprise support, and the broader IBM ecosystem into whatever rate you are quoted, so ask for that quote directly.

How do per-GB vendors convert to per-EPS equivalents?

The conversion uses an EPS-per-GB ratio that varies by source mix. Mixed enterprise environments average 70 to 80 EPS per GB; network-heavy environments run 200 to 400 EPS per GB; cloud-audit-heavy environments run 30 to 50 EPS per GB. The conversions in the table assume the typical mixed enterprise ratio (75 EPS per GB) applied to the corrected per-GB figures, so they are shown as equivalents and estimates. For specific environments, the conversion can vary by 30 to 50 percent in either direction; see our EPS-to-GB conversion page for the full methodology. Network-heavy environments will see per-GB vendors look cheaper in per-EPS equivalents (and natively per-EPS-priced vendors look worse); cloud-native environments will see the inverse.

Does Securonix price per EPS?

No. Securonix EON prices per GB per day, not per EPS, across BASIC, STANDARD, ADVANCED, and ALL-IN tiers, and it publishes no list price. Earlier comparisons that placed Securonix as a native per-EPS vendor with a specific per-EPS rate were incorrect. Because the meter is GB per day, a direct per-EPS comparison against QRadar is not valid; the two should be compared on all-in cost at a shared volume rather than on a per-EPS line item. We show Securonix on this page for completeness but mark it as not per-EPS rather than force a converted figure.

Why is Chronicle's per-EPS equivalent not meaningful?

Google Chronicle prices on a GB data-cap and credit model at roughly £2,000 per TB per year, not per EPS and not per employee. At 50 GB per day (about 3,500 EPS) that lands near ~$46K, and at 5,000 EPS (about 67 to 70 GB per day) near ~$62K. Because the meter is a data cap rather than an event rate, the per-EPS equivalent moves only with volume, not with event rate directly, so it is shown for reference rather than as a true per-EPS rate. Any comparison should use Chronicle's data-cap tier against actual ingest volume rather than a per-EPS line.