SIEM TCO calculator 2026
You enter GB/day, retention months, employee count, and endpoint count. You get an annual TCO per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.
Ingest TCO strip
| Vendor | Annual TCO | Basis |
|---|---|---|
| Splunk Enterprise Security | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Microsoft Sentinel | $785K | Analytics Logs PAYG $4.30/GB times annual ingest with retention adjustment. |
| Google Chronicle Security Operations | $8K | Standard tier $0.65 per employee per month times headcount. 12-month retention included. |
| CrowdStrike Falcon Next-Gen SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| IBM QRadar SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Exabeam New-Scale Fusion | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| LogRhythm Axon | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Securonix Unified Defense SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Sumo Logic Cloud SIEM | $456K | Cloud Flex effective $2.50/GB at Enterprise Suite times annual ingest with retention. |
| Elastic Security | $173K | Serverless ingest $0.85/GB plus a baseline VCU/storage allocation. |
| Panther Cloud-Native SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Palo Alto Cortex XSIAM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| SentinelOne Singularity AI SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Rapid7 InsightIDR | $101K | Per-asset $5.62 per month at the entry tier (500-asset minimum). |
| Stellar Cyber Open XDR + SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Devo Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Snowflake Cybersecurity Workload | $219K | Estimated $1.20 effective per ingested GB across credits and storage at standard tier (excludes detection layer). |
| Anvilogic | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Hunters SOC Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Graylog Security | $274K | Cloud Security tier list approximately $1.50/GB times annual ingest with retention. |
You enter GB/day. You get an annual number per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.
Worked example: 500 GB/day, 12-month retention, 1,000 employees, 1,500 endpoints
Microsoft Sentinel Analytics Logs at $4.30/GB times 182,500 GB/yr = $784,750 list (before Commitment Tier discount). Google Chronicle Standard at $0.65 per employee per month times 1,000 employees times 12 = $7,800. Elastic Serverless Security ingest at $0.85/GB times 182,500 GB/yr = $155,125 plus baseline $18,000 = $173,125. The Chronicle headline is structurally lower because retention is bundled and pricing scales with people, not bytes.
Quote-only vendors (Splunk, CrowdStrike, IBM QRadar, Exabeam, LogRhythm, Securonix, Panther, Palo Alto Cortex XSIAM, SentinelOne, Stellar Cyber, Devo, Anvilogic, Hunters) do not appear in the dollar columns; request a quote and compare against the Chronicle/Sentinel/Elastic floor.
Which quote-only vendors to RFP
For an endpoint-led shop add CrowdStrike or SentinelOne to the RFP shortlist. For a Microsoft-aligned shop confirm Sentinel pricing then add Splunk to test the floor. For an MSSP add Stellar Cyber and Sumo Logic.