SIEM Pricing: What Drives the Cost and How to Budget

SIEM pricing has no single market rate. The bill is set by how much log data you send to the platform, how long you keep it, and who is staffed to tune and watch it. A license quote covers only the first of those three. Public procurement records offer one reference point: an Oregon agency's sole source determination estimated a total one-year cost of $82,093.60 for SIEM platform services. That is a real budget, but it does not tell you what your environment will cost.

This guide explains the pricing models you will meet, the variables that move a quote, the costs that never appear on the quote, and how to build a defensible budget before you talk to any provider.

TL;DR

• SIEM cost follows data volume and retention far more than headcount. Decide which log sources earn their place before you ask for a quote.
• Licensing is one line item. Australian Signals Directorate guidance lists hiring and retaining skilled staff and sustained data costs alongside the platform itself.
• Public procurement figures reflect each buyer's own scope and term, so published averages are poor planning inputs.
• A managed SIEM moves detection engineering and monitoring onto a provider's team. Ask every provider to state price per unit and period, and to say who triages alerts.

Table of Contents

• Why SIEM pricing is hard to pin down
• The pricing models you will encounter
• What actually moves the number
• The costs that never appear on the quote
• Reading public procurement figures
• Building a budget before you request quotes
• Self-operated or managed: how the cost comparison works
• Who needs to pay for a SIEM, and who may not
• Controlling cost after you buy
• FAQ
• Sources

Why SIEM pricing is hard to pin down

A security information and event management platform collects logs, normalizes them, correlates events and raises alerts. Vendors meter that work in different ways: by gigabytes ingested, by events per second, by number of monitored devices, by user, or by a flat subscription. Two quotes that look comparable can describe very different volumes of data and very different levels of service.

CISA's practitioner guidance on SIEM and SOAR, developed with the Australian Cyber Security Centre and other international and U.S. partners, covers implementation, not only procurement. That is why cost estimates built from a price list alone fail. The platform is the visible part. The detection content, log onboarding, tuning, retention design and response workflow around it are what make it function, and each has a cost.

The pricing models you will encounter

There are five common structures. Each rewards a different environment and creates a different risk of surprise.

When a quote arrives, write the unit and period next to every number: per GB per day, per device per month, per year. A figure with no unit cannot be compared with anything. If a provider will not state the unit, treat that as information about how the contract will be administered.

Why per-user comparisons mislead

Many SIEM products are priced on the volume of data ingested, not on user count. A 40-person organization with a cloud-heavy estate, a firewall and a directory service can generate more log data than a 200-person organization with a few on-premises servers. Comparing price per user across providers hides this entirely.

What actually moves the number

Ingestion volume

The Australian Signals Directorate's practitioner guidance offers a starting point: medium organizations of 400 to 2,000 staff might plan for a minimum initial ingestion of roughly 250 GB per day. The same guidance stresses these are baselines to be tailored to the organization's own risk profile and critical log sources, not industry averages.

The arithmetic is worth doing once. At 250 GB per day, an organization ingests about 91,250 GB in a year. Multiply the daily volume by a quoted per-GB rate and by the days in the billing period, and you have the ingestion line before retention, support or staffing. Without a citable rate, this guide does not print one, because rates differ by vendor, region and contract and change frequently. Ask for the rate in writing, with its unit.

Log source selection

Ingesting everything is the most common way to overspend. The ASD and CISA guidance on priority logs for SIEM ingestion advises that a SIEM should centralize specific security logs according to the organization's needs rather than serve as the repository for every log. CISA's Logging Reference Architecture makes a similar point: logging should be designed around the security outcomes it must support rather than ingestion volume, and a threat- and risk-informed approach decides where additional logging is justified.

In practice, start with identity provider and directory authentication events, endpoint detection telemetry, remote access and VPN logs, email security events and cloud control-plane audit logs. Add network flow and DNS only where a detection use case justifies the volume.

Retention

The ASD guidance recommends a starting point of at least one year for security-related event logs and 90 days for contextual informational logs, balanced against cost. The Canadian Centre for Cyber Security's guidance on using SIEM tools ties retention to storage cost: because many compromises are discovered long after the breach, retention periods should reflect regulations and how long detection typically takes, and logs that exceed the retention policy can be discarded or moved to lower-cost storage.

CISA's Logging Reference Architecture describes the same idea as tiers: searchable operational data, retrievable retained data, and immutable evidentiary data. It also cautions that a SIEM-first pattern, where every log lands in the analytical platform first, becomes costly and less flexible as telemetry volume and retention expectations grow.

Deployment type

The Canadian Centre describes two forms of cloud SIEM: managed, closer to a SIEM-as-a-service model in which the vendor carries accountability for operating the platform, and unmanaged, where your team does. The difference changes who owns upgrades, parser maintenance and availability, and it changes the staffing you need regardless of the license price.

The costs that never appear on the quote

The ASD guidance states that implementing a SIEM or SOAR platform involves significant and ongoing costs, including upfront and sustained licensing or data use costs and the cost of hiring and retaining skilled staff. Budget for each of these separately.

1. 1.Detection engineering and tuning. Correlation rules need to be written, tested and revised as your environment changes. An untuned SIEM produces alert volume that no one can read.
2. 2.Analyst coverage. Attacks do not follow business hours. A platform that alerts at 2 a.m. to a mailbox is a logging system, not a detection capability. Round-the-clock triage requires a staffed rotation or a provider.
3. 3.Log onboarding and parser upkeep. Each source needs configuration, and each application update can break parsing.
4. 4.Storage and retention tiers. Unmanaged retention results in redundant charges for data with no operational or evidentiary value.
5. 5.Response workflow. Licensing a SIEM does not solve response throughput. Someone still has to decide on and carry out the response to each alert, by hand or through orchestration.
6. 6.Training and exercises. Analysts and administrators need current skills, and responders need rehearsed procedures.

An honest total cost of ownership estimate lists all six next to the license line. A SIEM purchased without the staffing to run it frequently ends up as expensive storage.

Reading public procurement figures

Government records are among the few citable price points.

• The Oregon agency sole source determination estimated a total one-year cost of $82,093.60 for SIEM platform services. That is a single agency, a single year, and a sole source justification, which means the buyer documented why one provider was selected.

That figure is not a quote for you. Use such records to learn what a procurement document should contain: scope, volume, term, support level and unit. Then write the same into your own request.

Building a budget before you request quotes

1. 1.Inventory your log sources. List identity, endpoint, network, cloud, email and application sources, and note which are mandatory under a framework or contract you are bound by.
2. 2.Estimate daily volume per source. Use your current logging tools, or, as a placeholder until you have measurements, the ASD minimum of roughly 250 GB per day for 400 to 2,000 staff.
3. 3.Rank sources by detection value. Keep the ones that support a specific threat scenario. Send the rest to cheaper storage or leave them out.
4. 4.Set retention by tier. One year for security events and 90 days for contextual logs is the ASD starting point. Adjust for regulatory duties and how long you expect detection to take.
5. 5.Decide who watches the console. Count the people and hours needed for 24/7 triage, tuning and response. If that is unrealistic, price a managed arrangement instead of a self-operated platform.
6. 6.Ask for quotes in a common format. Require unit and period for every rate, what is included in ingestion, what happens when volume exceeds the commitment, retention terms, and exit and data export terms.

For organizations in Ohio's public sector, add the reporting and logging expectations that apply to you. Ohio's public-sector cybersecurity obligations are worth reading with your counsel or compliance lead before you fix a retention period, since they can lengthen what you need to keep and what you need to report.

Self-operated or managed: how the cost comparison works

A self-operated SIEM places license, storage, engineering and analyst time on your books. A managed SIEM consolidates them into a service fee, and the fee reflects the provider's costs of staffing 24/7 triage and maintaining detection content. For a small or mid-sized organization, or a local government with a single IT lead, the staffing line often decides the comparison. One security engineer cannot cover nights, weekends, vacations and tuning.

When you compare a managed offer with a self-run one, put them on equal terms:

• Same log sources and same retention.
• Same hours of triage coverage, stated explicitly.
• Same response actions: alert only, or containment and investigation.
• Same reporting, including what evidence you can export for an auditor or an insurer.

The question to ask any provider is who triages an alert at night and whether that person is an employee of the provider or a subcontractor. Outsourced triage can change accountability, and you should know where it sits.

Simvay, a Cleveland-rooted cybersecurity firm headquartered in Westlake, Ohio, serving Ohio and clients nationwide, delivers managed SIEM with 24/7 detection and response through its MDR and managed SIEM service, staffed by an in-house, US-based team with no outsourced triage. Engagements are scoped to the client's environment, which is why the firm does not publish a price list. For a view of how detection and response is priced as a category, see its explainer on what MDR costs, and for more on the platform side, its SIEM topic hub.

Who needs to pay for a SIEM, and who may not

Not every organization needs its own SIEM. If your estate is small, centered on cloud identity and endpoint tools that already produce alerts, a managed detection service that ingests those sources can deliver the monitoring outcome without you buying a platform. If you carry compliance duties that require centralized log retention and review, a SIEM, owned or managed, is usually the control that satisfies them.

Public safety technology and critical infrastructure operators sit in a third group. Their operational technology and legacy systems often log poorly, and the cost problem is less volume than coverage: getting meaningful telemetry from sources that were not designed for it. Scope those sources deliberately and ask providers how they handle them.

If you are unsure which group you belong to, an advisory engagement, such as Simvay's fractional CISO service, which provides security leadership without a full-time executive hire, can set the logging requirements and the budget before you commit to a platform or a provider. Where a framework drives the requirement, the firm's compliance programs are structured to sector-specific frameworks.

Controlling cost after you buy

• Review log sources quarterly. Remove sources that produced no detections and no investigative value.
• Tier storage on a schedule. Move aging data to lower-cost storage as the Canadian Centre advises, and keep evidentiary data immutable.
• Automate after detection is tuned. Automate response only for well-understood alerts, once the SIEM and its detections are working.
• Track commitment terms. If a contract limits how often you can lower a committed volume, calendar the review dates before renewal.
• Test detections. A tabletop or detection test shows whether the data you pay for supports the alerts you expect.

If you are in the early stage of assessing options, the Simvay services overview shows how detection, response, assessment and advisory work fit together, and the page on who Simvay serves describes the small and mid-sized, public sector and critical infrastructure organizations the firm works with. To scope a managed SIEM against your own log sources, start with the MDR and managed SIEM page and request a conversation.

FAQ

How much does a SIEM cost?

There is no reliable single figure. Public records show an Oregon agency estimating $82,093.60 in total for one year of SIEM platform services. Your cost depends on daily data volume, retention, staffing and whether the service is managed.

Is SIEM priced per user or per gigabyte?

Most platforms meter data volume, though some use events per second, device counts or flat subscriptions. Data volume dominates because log sources such as firewall and DNS produce far more data than user count would suggest. Always ask for the unit and period behind every rate.

How much log data should a small organization plan for?

Measure your own critical log sources. For scale, the Australian Signals Directorate suggests a minimum initial ingestion of about 250 GB per day for medium organizations of 400 to 2,000 staff, and a smaller organization's volume depends on which sources it collects.

How long should SIEM logs be retained?

The ASD guidance recommends at least one year for security-related event logs and 90 days for contextual informational logs as a starting point. Regulatory requirements and how long it takes you to detect incidents may require more, and older data can move to lower-cost storage.

Does a SIEM replace the need for a security team?

No. A SIEM generates visibility through alerts, and someone must triage, investigate and respond to them. Running a SIEM is an ongoing operational effort, so budget for tuning and 24/7 coverage, or choose a managed service that includes them.

Sources

• Implementing SIEM and SOAR platforms: practitioner guidance (Australian Signals Directorate)
• Priority logs for SIEM ingestion: practitioner guidance
• Guidance for SIEM and SOAR Implementation (CISA)
• Logging Reference Architecture (CISA)
• Using SIEM tools to manage cyber security risks, ITSM.80.024 (Canadian Centre for Cyber Security)
• Sole Source Determination, SIEM platform services (Oregon)

Recommended

• MDR Pricing in 2026: What Managed Detection and Response Costs
• MDR & Managed SIEM