SIEM cost per EPS in 2026: every major vendor normalised
Independent normalised cost-per-EPS comparison across all twelve major SIEM vendors. Native per-EPS pricing for QRadar and LogRhythm (per-MPS); per-GB and GB/day vendors converted to per-EPS equivalents. Updated July 2026.
Why a cost-per-EPS comparison matters
Cost-per-EPS comparisons matter for two buyer profiles. First, organisations evaluating natively per-EPS-priced vendors (IBM QRadar per-EPS, LogRhythm via per-MPS) where the meter aligns directly with the buying axis. Second, organisations whose log profile is event-rate-driven rather than volume-driven (network-heavy environments with extensive firewall, NetFlow, and DNS logs) where the per-EPS view of vendor pricing more accurately reflects actual cost dynamics than the per-GB view.
The table below shows the native rate for vendors that price per-EPS or per-MPS, and the converted per-EPS equivalent for vendors that price per GB or per GB per day. Conversions use a typical 75 EPS-per-GB ratio for mixed enterprise log mix, applied to the corrected per-GB figures, so they are shown as equivalents and estimates. For specific environments the conversion can vary by 30 to 50 percent in either direction depending on log source mix; see our EPS-to-GB conversion page for the full methodology and per-source ratio reference.
Several vendors do not price per EPS at all and are represented honestly rather than forced into a rate. Securonix EON prices per GB per day across tiers with no published list. Google Chronicle uses a GB data-cap and credit model at roughly £2,000 per TB per year, not a per-employee meter. Sumo Logic (Flex credits) and Datadog Cloud SIEM (multi-line) have no clean per-EPS headline. These entries are marked as not per-EPS so buyers do not read a converted figure as a native rate.
All twelve vendors, normalised to per-EPS equivalents where a rate exists
| Vendor | Model | $/EPS/mo | All-in @ 5K EPS | Note |
|---|---|---|---|---|
| Exabeam (GB/day equiv) | GB/day converted | $0.80-$1.15 equiv | $48K-$68K (est.) | GB/day pricing; SIEM ~$36K, Fusion ~$51K at 50 GB/day |
| Devo (per-GB equiv) | Per-GB converted | $1.00-$1.20 equiv | $60K-$73K (est.) | Daily-ingest; 400-day retention bundled |
| Google Chronicle (data-cap) | GB data-cap / credit | Not per-EPS | ~$62K (est.) | Data-cap / credit, ~£2,000/TB/yr; not per-employee, not per-EPS |
| Microsoft Sentinel (per-GB equiv) | Per-GB converted | $1.30-$1.75 equiv | $79K-$104K (est.) | Commitment vs PAYG ($4.30/GB East US); free MS365 ingest tilts lower |
| Panther (per-TB equiv) | Per-TB converted | $1.65-$2.00 equiv | $100K-$120K (est.) | $50K per TB per month; detection-as-code |
| Splunk Cloud (per-GB equiv) | Per-GB converted | $1.10-$2.20 equiv | $67K base / $133K ES (est.) | At ~75 EPS/GB; base ingest to ES all-in |
| CrowdStrike LogScale (per-GB equiv) | Per-GB converted | $2.40 equiv | ~$145K (est.) | $5.95/GB PAYG; 7-day default retention; not the cheapest |
| IBM QRadar | Per-EPS native (est.) | $2.60-$3.30 (est.) | $155K-$200K (est.) | ~3,500 EPS = ~50 GB/day; IBM publishes no list price |
| LogRhythm | Per-MPS self-hosted | ~$5.40 equiv (est.) | ~$325K (est.) | ~$65/MPS/yr; MPS is messages per second; self-hosted; Axon retired |
| Securonix EON | GB/day (not EPS) | Not per-EPS | GB/day tiers | Prices per GB/day, not EPS; tiers BASIC / STANDARD / ADVANCED / ALL-IN; no published list |
| Sumo Logic (Flex) | Flex credits (not per-EPS) | Not per-EPS | Credit-metered | Flex model; free ingest, ~$1.50/credit on scan + storage; no clean per-EPS |
| Datadog Cloud SIEM | Multi-line meter | Not per-EPS | Multi-line | Ingest $0.10/GB; indexing $1.70-$2.50 per 1M events; Cloud SIEM $5 per 1M analyzed events |
Per-EPS rates for QRadar and LogRhythm are native-axis estimates; converted equivalents apply a 75 EPS-per-GB ratio to the corrected per-GB figures and are flagged as estimates. Vendors that do not price per EPS (Securonix per GB/day, Chronicle data-cap, Sumo Flex credits, Datadog multi-line) are shown as not per-EPS. All-in column at 5,000 EPS represents a typical mid-market deployment. Negotiated multi-year EA discounts of 25 to 40 percent are routine at meaningful scale.
Pricing by EPS band
| EPS band | Profile | Typical annual range |
|---|---|---|
| 1,500 EPS | SMB / lower mid-market | $20K-$55K (most vendors) |
| 5,000 EPS | Mid-market | $60K-$150K (most vendors) |
| 15,000 EPS | Lower enterprise | $180K-$450K |
| 50,000 EPS | Enterprise | $550K-$1.4M |
| 200,000+ EPS | Global enterprise | $1.4M-$3M |
When per-EPS is the right comparison axis
Per-EPS comparison is the right axis for organisations whose log volume is event-rate-driven rather than gigabyte-driven. The classical fit is regulated mid-market with extensive network telemetry: financial services with deep firewall logging, retail with PCI-scope payment processing networks, healthcare with detailed access logs from clinical systems. These environments produce high event rates relative to byte volume and benefit from comparing vendors on the meter that genuinely tracks underlying cost.
Per-EPS comparison is the wrong axis for cloud-native environments whose log mix is dominated by verbose JSON audit logs (AWS CloudTrail, Azure Activity Log, Microsoft 365 audit). These environments produce low event rates relative to byte volume; per-EPS comparison overstates the relative cost of per-GB vendors and understates per-EPS vendors. Per-GB comparison is the cleaner axis for this profile.
Per-EPS comparison is also the wrong axis for vendors whose meter does not track event rate at all. Securonix EON (per GB per day), Google Chronicle (GB data-cap and credit), Sumo Logic (Flex credits), and Datadog Cloud SIEM (multi-line ingest, index, and analyzed-event metering) do not align with a per-EPS axis; comparing them on per-EPS forces a conversion that misrepresents how they actually bill. Use the SIEM cost-per-GB page or the calculator for those vendors instead.
Always combine cost-per-EPS analysis with detection content fit, compliance content pack value, SOC retraining capacity, and broader IT consolidation context before making vendor decisions. Per-EPS normalisation is a useful starting point for event-rate-driven environments, not a substitute for the broader buyer-fit analysis.