Splunk Enterprise Security: pricing, ownership, MITRE coverage

Splunk Enterprise Security is the SIEM that the rest of the market still benchmarks against. Workload Pricing[1] is the model Splunk now leads with for new logos; legacy ingest-volume pricing remains in renewal paper. ES is sold as an add-on layered on Splunk Cloud or Splunk Enterprise, which means the procurement line item is rarely a single SKU.

Since Cisco closed the $28B acquisition in March 2024[27], renewal posture has firmed. Channel quotes a 35-50% list-price uplift on multi-year renewals at the upper enterprise band. The Cisco XDR and SecureX cross-sell is now standard inside larger Cisco enterprise agreements.

The SVA worksheet

Splunk Value Assessment is the spreadsheet the rep uses to model Workload Pricing for your environment. Ask for it before signing. The opacity is not accidental: it is the lever that allows the floor and ceiling to move per-quarter on the same nominal contract.

MITRE coverage

Splunk publishes detailed coverage maps against MITRE ATT&CK[2]. ES content remains the deepest pre-built library in the market, which is why net-new SOC engineering FTE requirement is materially lower than for Panther or Elastic.