SIEM Pricing Models Explained: Per-GB vs Per-EPS vs Per-User vs Flat Rate

Per-GB pricing is the most common SIEM pricing model in 2026, used by the two market leaders (Splunk and Microsoft Sentinel) and increasingly adopted by newer entrants like Datadog Security. The model charges based on the volume of raw log data ingested into the SIEM platform, typically measured as a daily average in gigabytes.

The economics of per-GB pricing favour organisations with large but infrequent events. Database audit logs averaging 2-4 KB per event, detailed endpoint telemetry, and packet capture summaries generate significant GB volume from relatively few events. Under per-EPS pricing, these same organisations would pay less because their event rate is low despite high data volume. Conversely, organisations with many small events (DNS queries at 100-200 bytes each, syslog messages, NetFlow records) get penalised by per-GB pricing because their GB volume is disproportionately high relative to event count.

The critical per-GB optimization is filtering before ingestion. Both Splunk (Ingest Actions) and Sentinel (Data Collection Rules) allow you to transform, filter, and route data before it counts against your licensed volume. Effective pre-ingestion filtering typically reduces billed volume by 20-40% without meaningful security coverage loss. This is the single highest-ROI cost optimization available to per-GB customers. See our Splunk and Sentinel pricing guides for vendor-specific techniques.

Events-per-second pricing, used primarily by IBM QRadar and LogRhythm, measures cost by the rate at which security events are processed rather than their raw data volume. This model originated in the era when SIEM platforms were primarily correlation engines that cared about event patterns, not data warehouses that cared about storage volume.

EPS pricing has a significant advantage in cost predictability. Your event rate changes only when you add or remove log sources, not when individual sources become more verbose. A firewall firmware update that triples the verbosity of connection logs would cause a major cost increase under per-GB pricing but have zero impact under per-EPS pricing (assuming the same number of connections per second).

The conversion between GB/day and EPS is not straightforward because average event size varies dramatically by source type. A general approximation is 1 GB/day equates to 8-12 EPS sustained average, but this can range from 3 EPS per GB (for large database audit events) to 50+ EPS per GB (for compact syslog messages). When comparing QRadar quotes against Splunk or Sentinel, always calculate the equivalent in both metrics for your specific log source inventory. Our QRadar pricing guide includes detailed EPS estimation guidance.

Per-user and per-endpoint pricing models decouple SIEM costs from data volume entirely. Instead, you pay based on the number of entities (users, endpoints, or assets) being monitored. Elastic Security's paid tiers use per-user pricing for the analysts accessing the platform, while some cloud-native SIEMs charge per-endpoint for the devices generating log data.

This model is most advantageous for organisations with many endpoints generating moderate log volumes per device. A 5,000-endpoint environment generating an average of 10 MB/day per endpoint (50 GB/day total) would pay based on 5,000 endpoints regardless of whether the per-endpoint volume increases to 20 MB/day. Under per-GB pricing, that doubling would double the bill.

The disadvantage surfaces in environments with few but very active assets. A data centre with 50 servers generating 200 GB/day total would pay a low per-endpoint price but might pay more under a per-GB or per-EPS model optimised for high-volume, low-asset-count environments. Per-user pricing for analyst access (as Elastic uses) adds a layer of cost on top of infrastructure, making it harder to calculate total spend. See our Elastic Security pricing guide for specific tier costs.

Flat-rate tier pricing offers the highest cost predictability: you pay a fixed monthly fee within a defined usage band. Blumira, for example, offers tiers at approximately $2,500/month (up to 10 GB/day), $5,000/month (up to 50 GB/day), and $10,000/month (up to 100 GB/day). Arctic Wolf bundles SIEM with managed detection and response at flat monthly rates typically ranging from $3,000-$15,000/month depending on organisation size.

The appeal is simplicity: procurement teams know exactly what the SIEM will cost each month, with no surprise bills from log volume spikes or new source integrations. The risk is inefficiency at tier boundaries. An organisation consistently ingesting 55 GB/day pays the same as one ingesting 99 GB/day on a 100 GB tier, effectively subsidising the higher-volume user. And exceeding the tier limit either triggers overage charges (often at punitive per-GB rates) or forces an upgrade to the next tier with significant unused capacity.

Flat-rate tiers are most cost-effective for SMBs with stable, well-understood environments where log volume is unlikely to change significantly. For growing organisations or those with seasonal traffic patterns, the risk of tier boundary issues makes consumption-based models (per-GB or per-EPS) more cost-efficient despite their lower predictability.