SIEM pricing-model changelog 2024-2026
Six vendors changed pricing structurally between January 2024 and September 2026. Two of them, Google and Sumo Logic, changed the meter itself and stopped publishing a rate, so a 500 GB/day buyer can no longer model them from public sources at all.
- 2024-2026
Splunk
Workload Pricing pushed as alternative to ingest-volume pricing for large customers. Post-Cisco, renewal posture firmer; channel reports 35-50% list-price uplift on upper-band multi-year renewals.[1]
- 2026
Microsoft Sentinel
Sentinel data lake launched at $0.05/GB ingest and $0.026/GB-month storage. Defender XDR data into Sentinel free; E5 5 MB/user/day benefit added.[3]
- 2024-2026
Google Chronicle
Per-employee pricing retired. Google now prices all three SecOps packages on ingestion volume and publishes no rate card, referring buyers to a sales representative. Mandiant Threat Intelligence bundled into Enterprise Plus.[5]
- 2024-2026
CrowdStrike
Falcon Flex commercial wrapper made bundled consumption the default purchase pattern; LogScale per-GB rate stays under a platform credit pool.[7]
- 2023-2026
Sumo Logic
Credits model unified observability and security spend, then Flex became the default plan for new customers: ingest and indexing carry no cost and credits are consumed by data scanned at query time plus storage. Tiers are sized by scans per GB ingested, so there is no ingest rate to quote. Cloud SIEM Enterprise add-on layered on the credit pool.[15]
- 2024-2026
Elastic
Serverless Security generally available with ingest, compute, and storage billed as three line items.[16]