SIEM vendors 2026: a 20-vendor RFP dossier
A printable shortlister for the director of SecOps with 90 days on a Splunk renewal. Twenty vendors, sorted by ingestion-pricing transparency, with an inline TCO strip, an M&A consolidation map, and one row per vendor that resolves to a dossier sheet.
The 20 SIEM vendors a US/UK mid-market buyer should consider in 2026, ranked by deployment model and ingestion-pricing transparency. Splunk, Microsoft Sentinel, Google Chronicle and CrowdStrike Falcon Next-Gen SIEM are the four most-shortlisted; 7 vendors publish per-GB pricing, 13 are quote-only. Cisco closed the $28B Splunk deal in March 2024[27], IBM sold QRadar SaaS to Palo Alto Cortex XSIAM in September 2024[10], and Exabeam-LogRhythm closed in May 2024[28]. Those three deals reset every shortlist that pre-dates them.
Published per-GB equivalent ingest pricing
7 publishNormalised to a per-GB equivalent at a 500 GB/day, 1,000-employee, 1,500-endpoint shape so the bars are comparable. The published-price vendors land below or near the median band; Splunk and the other 12 quote-only vendors do not appear here because the site refuses to fabricate a unit rate for them.
- Google Chronicle Security Operations$0.04[5]
- Rapid7 InsightIDR$0.55[20]
- Elastic Security$0.85[16]
- Snowflake Cybersecurity Workload$1.20[23]
- Graylog Security$1.50[26]
- Sumo Logic Cloud SIEM$2.50[15]
- Microsoft Sentinel$4.30[3]
Quote only
13 vendorsSplunk Enterprise Security
Quote OnlyQuote-only. Channel reports list $2,000-3,500/GB/year on base platform; ES add-on $20-40/GB/day on top.
CrowdStrike Falcon Next-Gen SIEM
Quote OnlyQuote-only. Channel reports LogScale at ~$0.20-0.50/GB ingest with separate retention fee. Falcon Next-Gen SIEM bundled with Falcon platform consumption credits.
IBM QRadar SIEM
Quote OnlyQuote-only. Channel reports a ~$10K/yr smallest 100-EPS commercial tier on-prem.
Exabeam New-Scale Fusion
Quote OnlyQuote-only. Channel benchmarks Fusion at parity with Splunk ES on per-user pricing for 1,500-FTE shops.
LogRhythm Axon
Quote OnlyQuote-only. No public pricing. Axon and on-prem LogRhythm SIEM are co-sold for federal-grade buyers.
Securonix Unified Defense SIEM
Quote OnlyQuote-only. Per-identity model decouples cost from ingest volume.
Ingest TCO strip
| Vendor | Annual TCO | Basis |
|---|---|---|
| Splunk Enterprise Security | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Microsoft Sentinel | $785K | Analytics Logs PAYG $4.30/GB times annual ingest with retention adjustment. |
| Google Chronicle Security Operations | $8K | Standard tier $0.65 per employee per month times headcount. 12-month retention included. |
| CrowdStrike Falcon Next-Gen SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| IBM QRadar SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Exabeam New-Scale Fusion | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| LogRhythm Axon | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Securonix Unified Defense SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Sumo Logic Cloud SIEM | $456K | Cloud Flex effective $2.50/GB at Enterprise Suite times annual ingest with retention. |
| Elastic Security | $173K | Serverless ingest $0.85/GB plus a baseline VCU/storage allocation. |
| Panther Cloud-Native SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Palo Alto Cortex XSIAM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| SentinelOne Singularity AI SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Rapid7 InsightIDR | $101K | Per-asset $5.62 per month at the entry tier (500-asset minimum). |
| Stellar Cyber Open XDR + SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Devo Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Snowflake Cybersecurity Workload | $219K | Estimated $1.20 effective per ingested GB across credits and storage at standard tier (excludes detection layer). |
| Anvilogic | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Hunters SOC Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Graylog Security | $274K | Cloud Security tier list approximately $1.50/GB times annual ingest with retention. |
You enter GB/day. You get an annual number per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.
All 20 vendors
Each row carries owner, pricing-model unit, published rate (or quote-only flag), and MITRE ATT&CK coverage. Click a row for the full dossier sheet.
CrowdStrike Falcon Next-Gen SIEM
IBM QRadar SIEM
Exabeam New-Scale Fusion
Securonix Unified Defense SIEM
Panther Cloud-Native SIEM
SentinelOne Singularity AI SIEM
Hunters SOC Platform
Dossier topics the SERP does not answer
M&A consolidation map
Who currently owns each previously-independent SIEM brand, with deal dates.
AI-SOC capability matrix
Charlotte AI, Purple AI, Securonix EON, Copilot for Security, Gemini, Pathfinder, DeepTrace at a glance.
Lock-in & data portability
Which SIEMs let the buyer keep the data lake on exit, and which are walled gardens.
Pricing-model changelog 2024-2026
Which vendors changed model, when, and the dollar impact at 500 GB/day.