SIEM TCO calculator 2026
You enter GB/day, retention months, and endpoint count. You get an annual TCO per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated. The employee-count input has gone: no vendor left in the dossier prices on headcount.
Ingest TCO strip
| Vendor | Annual TCO | Basis |
|---|---|---|
| Splunk Enterprise Security | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Microsoft Sentinel | $785K | Analytics Logs PAYG $4.30/GB times annual ingest with retention adjustment. |
| Google Chronicle Security Operations | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| CrowdStrike Falcon Next-Gen SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| IBM QRadar SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Exabeam New-Scale Fusion | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| LogRhythm Axon | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Securonix Unified Defense SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Sumo Logic Cloud SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Elastic Security | $173K | Serverless ingest $0.85/GB plus a baseline VCU/storage allocation. |
| Panther Cloud-Native SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Palo Alto Cortex XSIAM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| SentinelOne Singularity AI SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Rapid7 InsightIDR | $101K | Per-asset $5.62 per month at the entry tier (500-asset minimum). |
| Stellar Cyber Open XDR + SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Devo Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Snowflake Cybersecurity Workload | $219K | Estimated $1.20 effective per ingested GB across credits and storage at standard tier (excludes detection layer). |
| Anvilogic | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Hunters SOC Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Graylog Security | $274K | Cloud Security tier list approximately $1.50/GB times annual ingest with retention. |
You enter GB/day. You get an annual number per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.
Worked example: 500 GB/day, 12-month retention, 1,500 endpoints
Microsoft Sentinel Analytics Logs at $4.30/GB times 182,500 GB/yr = $784,750 list (before Commitment Tier discount). Elastic Serverless Security ingest at $0.85/GB times 182,500 GB/yr = $155,125 plus baseline $18,000 = $173,125. The strip above runs the same arithmetic for every other vendor that publishes a unit price.
Two vendors that used to carry a worked line here no longer publish a rate to work with. Google Security Operations retired the per-employee Chronicle model: Google's own package documentation now states that pricing for all three packages is based on ingestion volume and points buyers at a sales representative, so there is no Chronicle column[5]. Sumo Logic moved to Flex, which charges nothing to ingest and index and bills credits against the data a query scans, so the $2.50/GB ingest line that used to sit here describes a product that no longer exists[15]. Both are now handled the same way as every other quote-only vendor on this site: blocked, not estimated.
Quote-only vendors (Splunk, Google Chronicle, CrowdStrike, IBM QRadar, Exabeam, LogRhythm, Securonix, Sumo Logic, Panther, Palo Alto Cortex XSIAM, SentinelOne, Stellar Cyber, Devo, Anvilogic, Hunters) do not appear in the dollar columns; request a quote and compare against the Sentinel/Elastic floor.
Which quote-only vendors to RFP
For an endpoint-led shop add CrowdStrike or SentinelOne to the RFP shortlist. For a Microsoft-aligned shop confirm Sentinel pricing then add Splunk to test the floor. For an MSSP add Stellar Cyber and Sumo Logic.