SIEM cost per GB in 2026: every major vendor compared

Headline per-GB rates are the single most-cited number in SIEM evaluations and one of the most misleading. List rates from vendor pricing pages frequently bear little resemblance to actual paid prices, particularly at meaningful scale where multi-year EA discounts of 25 to 40 percent are routine. Per-GB rates also miss the structural cost dimensions that dominate real bills: separate licensing for SIEM analytics on top of base log retention (Splunk Enterprise Security, Datadog Cloud SIEM), bundled features that change effective per-GB economics (Microsoft 365 free ingest on Sentinel, included long retention on Devo), and meter-axis differences that require conversion (per-EPS QRadar, per-MPS LogRhythm, per-GB-day Securonix, data-cap Chronicle).

The honest comparison treats per-GB rate as a starting point and adjusts for the structural factors that materially change effective cost. Microsoft 365 share matters for Sentinel; existing Datadog spend matters for Datadog Cloud SIEM; existing Falcon platform spend matters for LogScale; the data-cap tier matters for Chronicle; retention requirement matters for Devo and Sumo Logic. The table below shows the headline per-GB list where one exists, the all-in math at 50 GB per day for a typical mid-market profile, and a brief note on what changes the effective rate for that vendor.

Two vendors price on an event-rate axis and are shown as estimates: IBM QRadar (per-EPS) and LogRhythm (per-MPS, self-hosted). IBM publishes no list price, so the QRadar figure is a typical-mix estimate at roughly 3,500 EPS, which maps to about 50 GB per day. Securonix EON prices per GB per day across tiers with no published list, and Google Chronicle uses a data-cap and credit model at roughly £2,000 per TB per year rather than a per-employee meter. Sumo Logic (Flex credits) and Datadog Cloud SIEM (multi-line) have no single per-GB headline and are shown as such rather than forced into a per-GB number.

Cost-per-GB is one buying axis among several. The cheapest vendor at the per-GB rate is rarely the cheapest vendor on total spend, and is often not the right vendor for buying decisions where detection content depth, SOC familiarity, compliance content packs, or broader IT consolidation strategy matters more than raw licence cost. CrowdStrike LogScale at ~$109K (its $5.95 per GB pay-as-you-go rate) is not the cheapest option, but it is the right shape for organisations already on Falcon EDR/XDR where the bundle math changes; note its 7-day default retention. For organisations not on Falcon, the broader agent rollout cost makes the comparison less favourable than the raw per-GB number suggests.

Microsoft Sentinel at the cheapest effective rate (factoring free MS365 ingest) is the right shape for Microsoft-heavy environments; for organisations whose log mix is dominated by non-Microsoft sources, the per-GB rate is closer to the headline list and the comparison flips. Google Chronicle on its data-cap and credit model (~£2,000 per TB per year, ~$46K at 50 GB per day) is competitive for steady-volume environments; because the meter is a data cap rather than a straight per-GB rate, effective cost depends on how fully the tier is used rather than on headcount.

Always combine cost-per-GB with detection content fit, compliance content pack value, SOC retraining capacity, and broader IT consolidation context before making vendor decisions. Per-GB normalisation is a useful starting point, not a substitute for the broader buyer-fit analysis.