What Does a SIEM Really Cost? Licensing, Hardware and TCO

The six items behind SIEM cost

1. Licensing. EPS-based, volume-based (GB/day), per-device or per-user models. What you pay in three years depends less on the price tag and more on the model itself.
2. Hardware and infrastructure. Servers, SSD/NVMe disks, networking. Architectures that rely on indexing also need extra disk and RAM for the index files.
3. Log storage. Grows linearly with retention. Keeping logs for two years doubles the disk requirement compared to one.
4. Installation and training. If rollout takes weeks, that time comes back to you as consulting and project cost.
5. Maintenance and upgrades. The annual maintenance fee, plus the downtime and effort of version upgrades.
6. The operations team. Rule writing, parser maintenance, capacity management: keeping the product alive takes real person-hours. With products that have a proprietary query language and need constant tuning, this becomes a full-time engineering role.

The licensing model matters more than the price tag

With volume-based pricing, adding a new log source directly grows the bill. That pushes security teams toward the question "which logs could we skip?", and that question is a security risk in itself. With EPS-based models, peak load planning is what matters. Before you sign anything, ask the vendor: if my log volume grows 30% a year, what do I pay over three years? The real difference between models shows up in that answer. Oriana's licensing does not punish volume growth; it is based on platform scope and retention period. You can get an estimate for your own environment with the license calculator.

Log storage: the fastest-growing item

Three things drive storage need: EPS, average event size and retention period. The math is simple:

Raw logs per day (GB) = EPS × average event size (bytes) × 86,400 / 10⁹

An example. At 5,000 EPS with 500-byte events you produce about 216 GB of raw logs a day. That is 79 TB a year. On indexing-based systems, the index files add their own overhead on top.

This is where architecture makes the difference. Elasticsearch-based stacks lean on RAM and index files for fast search; live data stays hot for a short window, and the rest is either deleted or pushed to a slow archive. In Oriana, data lives on disk from day one and stays there for years. What makes that possible is compression: the patented Minimize algorithm compresses archive data down to 1/40 in internal tests. Roughly speaking, 40 GB of logs takes up 1 GB on disk. Deduplication strips repeating records on top of that. You can see the numbers for your own EPS and retention in seconds with the log storage cost calculator.

How EPS, event size and retention change the bill

• EPS hits the cost twice: it sets both the license tier and the hardware size. A realistic EPS estimate, not inflated but covering peak load, is the single most effective cost decision you will make.
• Event size goes unnoticed: verbose audit policies can push the average event from 300 bytes to 800. Same EPS, 2.5 times the disk.
• Retention is set by regulation: GDPR, NIS2 and sector rules define the floor; in Türkiye, Law No. 5651 requires up to two years. In architectures without a hot/archive split, all of that data lives on expensive disk. The right setup keeps recent data on SSD and moves the archive to HDD or object storage.

Building the three-year TCO table

Fill in the same table for every product on your shortlist. Every cell you cannot fill is a question for the vendor:

• License: year 1, 2, 3 (with a 30% volume growth scenario)
• Server hardware plus growth headroom
• Hot disk (SSD/NVMe) and archive storage (HDD/object)
• Installation, integration, training (one-off)
• Annual maintenance and support
• Operations effort: person-hours/month × 36 months

While filling it in, ask under which conditions each vendor figure was measured. We publish the measurement conditions behind our own numbers on the performance test methodology page; ask every vendor for the same.

What actually cuts the cost: architecture

In SIEM cost, the win comes from architecture, not from license negotiation. An engine without an index database removes the index disks, the CPU and RAM spent on indexing, and the index maintenance effort from day one. On-disk compression delivers savings that compound as retention grows. A built-in rule set and rule authoring from the interface reduce the need for a full-time tuning engineer. Over three years, these three together are often worth more than the license fee itself.

Conclusion

Read SIEM cost from the three-year TCO table, not from the quote. How the licensing model behaves under growth, how retention multiplies storage, and how much operations effort the product demands are the real drivers. And the shortest way to verify the numbers is a PoC run on your own log data.

Try the log cost calculator with your own EPS, or request a demo and we will build your three-year TCO together.

Last updated: November 1, 2026. Performance and savings figures are internal test results and vary with environment and data set. See our performance test methodology page for measurement conditions.