Managed SIEM Pricing Guide
If you are pricing a managed SIEM, the line that moves the quote most is the data: how many events per second (EPS) or gigabytes a day you send, and how long the provider keeps them. This guide covers managed SIEM pricing in those terms, what four providers publish on their own sites, and when owning the SIEM costs less than buying it as a service.
Key takeaways:
- UnderDefense’s pricing guide puts a typical managed SIEM contract at $5,000 to $10,000 per month.
- Data volume drives the bill: events per second, gigabytes ingested per day and days of retention.
- LevelBlue (now including Trustwave), IBM and Rapid7 sell managed SIEM by quote; none publishes a list price.
- Owning the SIEM keeps data and license in-house; buying it as a service moves staffing to the provider.
What Is Managed SIEM?
Managed SIEM is a security information and event management (SIEM) platform that an outside provider operates for you. The provider ingests your logs, tunes detection rules, watches alerts around the clock and escalates incidents to your team, so one contract covers two costs: the platform (license, ingestion and storage) and the people who run it.
Providers sell it in two shapes. In the co-managed shape, the provider operates a SIEM you already license, such as Microsoft Sentinel, Splunk or Elastic; LevelBlue’s Co-Managed SOC page describes managed SIEM this way, with alert monitoring and light investigation on top. In the fully managed shape, often called SIEM-as-a-Service, the provider brings the platform and its license, and the platform cost sits inside its fee.
What you pay depends on the unit a provider counts: assets monitored, gigabytes ingested or events per second, with retention and the service tier priced on top. The models below show how each unit behaves as your environment grows, and the build-versus-buy section covers which shape fits a team that already owns a SIEM.
Managed SIEM Pricing Models: How Providers Count Usage
When you compare managed SIEM pricing, check the unit behind each quote first, because two quotes for the same environment can count different things. These are the five pricing models you will meet; who owns the SIEM is a separate decision, covered in the next section.
Subscription-based
In this model, clients pay a recurring subscription fee to access the managed SIEM service. Pricing tiers can vary based on the level of service and the number of features included. Clients receive invoices either monthly or quarterly, depending on their preference.
Pros:
The biggest advantage is flexibility. You’re not tied down by long-term contracts, which can be great if your needs or budget shifts over time. You can also scale up or down easily if your company grows or contracts.
Cons:
However, recurring fees can sometimes sneak up on you. If you’re not paying attention to usage and the features you need, you might end up paying for things you don’t use regularly. Over the long term, subscription costs can add up, and it may end up being more expensive than other models.
Prepayment 100% upfront
This approach often covers a specified contract duration, such as one year or more. By paying in advance, clients may benefit from discounts or other incentives the service provider offers. This model ensures that the service is fully funded from the outset, providing financial stability and predictability for both the client and the provider.
Pros:
Clients can save a decent chunk of money with upfront payments because providers usually offer attractive discounts. If you’ve got the budget, it’s a great way to lock in a lower rate, and there are no surprises with monthly bills.
Cons:
But, it requires a significant financial commitment from the start. If your business circumstances change and you no longer need the service or need to scale differently, you’re already locked into that agreement. Also, if the provider’s service doesn’t meet expectations, you’re stuck with them for the contract period.
Per-user or per-device
Some providers offer pricing based on the number of users or devices being monitored. This can be advantageous for organizations with a predictable user/device count and help tailor costs to actual usage.
Pros:
This model is predictable if you know how many devices or users you’ll have month to month. It makes budgeting a lot easier, and you pay for exactly what you use and nothing more.
Cons:
However, if your organization is scaling rapidly or has a lot of device fluctuation, this can get tricky. You might end up paying a lot more as you grow. Also, you’ll need to monitor usage carefully because costs can spike unexpectedly with even a small increase in users or devices.
Data volume: per-GB ingestion, EPS and retention
Pricing may be structured around the volume of data the SIEM platform processes: logs from servers, applications, network devices, identity and cloud services. Providers count that volume in one of two ways and price retention on top.
Per-GB ingestion bills the gigabytes of logs the SIEM takes in, usually per day. Committing to a daily volume lowers the rate: Microsoft Sentinel’s pricing page offers commitment tiers from 100 GB to 50,000 GB a day, at savings of up to 52% over pay-as-you-go. A provider either passes these platform costs through or folds them into its fee, so ask which.
EPS (events per second) bills the rate at which events arrive. EPS spikes during an incident or a noisy rollout, exactly when you need the SIEM most, so ask whether the price covers your peak rate or your average, and what happens above it.
Retention sets how long logs stay searchable. Rapid7’s Incident Command packages include 90 or 180 days of log retention, depending on the package, and sell more as an add-on. Check the same two numbers in every quote: the days included and the price of each extra month.
Before you sign, measure your daily volume and peak EPS during a trial, and decide which logs the SIEM needs. CISA and Australia’s ASD’s ACSC addressed that question in their May 2025 SIEM and SOAR guidance, which includes a practitioner document on priority logs for SIEM ingestion.
Pros:
This model works great for scalability. If you have a smaller company or fewer logs to process, you’re not overpaying. It’s a fair pricing system that reflects actual usage.
Cons:
The downside is if your data volume increases suddenly, after an incident or through regular business growth, your costs can balloon quickly. Plus, you need to have a good sense of your data flow to predict costs accurately, which not everyone is equipped to do from the get-go.
Custom pricing
Custom pricing may be negotiated for organizations with unique requirements or larger-scale deployments. This could include specialized integrations, additional features, or extended support options.
Pros:
Custom pricing can be a great fit if you’ve got specific needs that don’t fit the mold of traditional pricing models. You can often negotiate exactly what you need, and it’s tailored to your business. It’s highly flexible and ensures you’re only paying for what you truly need.
Cons:
But, it’s usually not the quickest option. Custom contracts often take more time to negotiate, and there can be some back-and-forth before everything is finalized. There’s also the potential for unforeseen costs if additional needs arise mid-contract.
Own the SIEM or Buy It as a Service: The Build-Versus-Buy Decision
Above every pricing model sits one decision: do you own the SIEM and pay someone to operate it, or buy the platform and its operation together from a provider, the model often called an MSSP-owned SIEM? The answer sets who holds your data, what you can change and what leaving costs, so settle it before you compare quotes.
| Question | You own the SIEM (client-owned) | The provider owns it (MSSP-owned) |
|---|---|---|
| Who holds the license | You, for example Splunk, Sentinel or Elastic | The provider, inside its fee |
| What you pay for | License, ingestion, storage and operations | One recurring fee for platform and service |
| Where your logs live | In your own tenant | In the provider’s platform |
| Customization | Full control of rules and integrations | Limited to the provider’s platform |
| Who runs it | Your team, or a co-managed provider | The provider’s analysts |
| Changing provider | Keep the SIEM, change the operator | Migrate logs and detections |
| Fits best | Teams that already license a SIEM | Teams with no SIEM and nobody to run it |
Owning the SIEM gives you full control over customization and, if your team can run it well, can cost less over time than ongoing provider fees. The trade-off is maintenance, updates and staffing. Buying it as a service gives you analysts without hiring them, with less control over the platform and slower changes when you need a specific integration.
A middle path keeps the SIEM you own and buys only its operation, from a co-managed SIEM provider or an AI SOC that works on top of it. It keeps your exit open and limits SIEM vendor lock-in.
Managed SIEM Pricing Comparison: LevelBlue, IBM, Rapid7 and UnderDefense
The table shows what each provider publishes on its own site, checked on October 19, 2026; where a provider publishes no price, the table says so. Two names from earlier versions of this comparison now sit under one brand: AT&T’s cybersecurity business became LevelBlue in May 2024, and LevelBlue completed its acquisition of Trustwave in August 2025, so trustwave.com now redirects to levelblue.com.
Disclosure: UnderDefense publishes this guide and appears in the table as one option.
| Provider | Managed SIEM offer | Pricing model | Published price |
|---|---|---|---|
| LevelBlue (includes Trustwave) | Co-Managed SOC (SIEM): 24/7 monitoring and tuning of your SIEM | Quote on request | Not published |
| IBM | Threat Detection and Response services (X-Force), including MDR | Quote; starts with a workshop | Not published |
| Rapid7 | Managed Threat Complete: MDR delivered on Rapid7's SIEM | Per asset, annual contract | Not published |
| UnderDefense | Agentic AI SOC on top of the SIEM you own | Per device or asset, subscription, custom | Quoted |
Of the three quote-only providers, Rapid7 documents its unit in the most detail: Managed Threat Complete is custom-quoted by asset, the price per asset falls as the count grows, and every subscription includes Rapid7's SIEM with 13 months of searchable logs. A fuller breakdown of Rapid7 pricing covers its SIEM packages sold without the managed service.
LevelBlue and IBM price each engagement by quote. Ask both for the unit behind the number, the log volume and retention the price assumes, and whether the SIEM license is included or billed separately.
What Is the Average Managed SIEM Pricing?
A typical managed SIEM contract costs $5,000 to $10,000 per month, according to UnderDefense’s managed SIEM pricing guide, depending on log volume and security features. Treat it as a starting range: the provider and the factors below move a quote above or below it.
- Business size: The scale and complexity of the organization influence the pricing structure. Larger enterprises with extensive networks may incur higher costs compared to small or medium-sized businesses.
- Data volume: The amount of data processed and monitored by the SIEM solution affects pricing. Higher data volumes often result in increased costs due to additional processing and storage requirements.
- Customization level: Organizations requiring extensive customization, tailored dashboards, correlation rules, or integrations with existing systems may face additional charges.
- Feature requirements: The breadth of features and functionalities desired by the organization impacts pricing. Advanced threat detection capabilities, compliance management tools, and real-time alerting systems may incur higher costs.
Managed SIEM pricing by organization size
None of the public sources checked for this guide publishes managed SIEM price bands for organizations above 500 employees, and none of the three quote-only providers in the table publishes a price at any size. Size reaches your quote through three numbers instead: assets monitored, daily log volume (or peak EPS) and months of retention.
Measure those three before you ask for quotes, and give every provider the same figures. Quotes built on the same inputs can be compared line by line, whatever your headcount.
High significance
AVERAGE SIGNIFICANCE
LOW SIGNIFICANCE
How to Choose the Right Managed SIEM Provider
Choosing the right managed SIEM provider is critical for any organization looking to enhance its cybersecurity posture. Here’s how you can do it:
- Define your requirements: Clearly define your organization’s security objectives, compliance requirements, and budget constraints. Determine the specific features, functionalities, and level of service you need from a managed SIEM provider.
- Conduct market research: Research and identify reputable managed SIEM providers. Consider industry reputation, customer reviews, analyst reports, and case studies to evaluate each provider’s track record and expertise.
- Assess capabilities and technology: Evaluate the capabilities and technology offered by each managed SIEM provider. Consider data ingestion and processing capabilities, real-time threat detection, incident response capabilities, scalability, and integration with existing security tools and systems.
- Evaluate security expertise: Assess the expertise and qualifications of the provider’s security team. Look for providers with certified security professionals, experienced threat hunters, and incident responders who can effectively monitor, analyze, and respond to security incidents.
- Review compliance support: Ensure that the managed SIEM provider has experience and expertise in supporting regulatory compliance requirements relevant to your industry, such as GDPR, HIPAA, PCI DSS, etc. Verify that the provider’s services align with your organization’s compliance obligations.
- Consider deployment options: Evaluate the deployment options offered by each managed SIEM provider, such as on-premises, cloud-based, or hybrid deployments. Choose a deployment model that aligns with your organization’s infrastructure, security policies, and budgetary constraints.
- Compare pricing and contract terms: Request pricing quotes from multiple managed SIEM providers and compare them based on subscription fees, data volume pricing, customization costs, and contract terms. Pay attention to hidden costs and ensure the pricing structure is transparent and scalable.
- Assess support and Service Level Agreements (SLAs): Evaluate each provider’s level of support, including response times, incident escalation procedures, and the availability of dedicated security analysts. Review the provider’s SLAs to ensure they meet your organization’s uptime and performance requirements.
- Request references and demos: Ask each managed SIEM provider for customer references and case studies to validate their track record and customer satisfaction levels. Request product demos or trials to assess the provider’s SIEM platform’s usability, functionality, and effectiveness.
- Consider long-term partnerships: Choose a managed SIEM provider willing to establish a long-term partnership and collaborate closely with your organization to address evolving security threats and business needs. Ensure that the provider is responsive to feedback and committed to continuous improvement.
Score each provider on the same ten points, and read the pricing terms below before you compare totals.
Managed SIEM Pricing Glossary: EPS, Per-GB Ingestion and Tenant Count
Quotes from different providers use different units. These are the terms that decide how a managed SIEM bill grows:
- EPS (events per second): the rate at which log events reach the SIEM, measured as an average and a peak.
- Per-GB ingestion: billing by the gigabytes of log data the SIEM takes in, usually per day; a commitment tier reserves a daily volume at a lower rate.
- Retention: how long logs stay searchable or archived. The base price covers a set number of days; longer periods add storage.
- Asset: a monitored host. Rapid7, for example, counts hosts running a workstation or server operating system that sent data in the last 30 days.
- Tenant count: the number of separate SIEM instances or workspaces a provider runs for you, for example one per subsidiary or region. Each can carry its own fee.
- Overage: the rate billed when you exceed the volume or asset count in your contract.
When two quotes use different units, convert both to your own numbers (assets, daily GB and retention days) before you compare totals.
How UnderDefense Works on Top of the SIEM You Own
Disclosure: UnderDefense publishes this guide. If you license a SIEM for compliance and nobody watches it at 2 a.m., the gap costs more than the license: IBM’s 2026 breach study puts the global average breach at $4.99 million. The UnderDefense Agentic AI SOC works on top of the SIEM you own, so the license, the logs and the detections stay with you, and the operation is what you buy.
| Your situation | What the Agentic AI SOC does | What changes for you |
|---|---|---|
| Every alert needs a first look | AI agents triage it with identity and cloud context | About 2 minutes from alert to triage |
| A critical alert fires at night | Analysts on shift 24/7 take the decision | 20-minute SLA response for critical alerts |
| An alert hinges on user intent | Analysts confirm with the user over Slack or Teams | Fewer escalations of legitimate activity |
| Splunk or Sentinel next to EDR and cloud tools | Investigation across 250+ integrations | No migration and no second SIEM |
Because the SIEM stays in your tenant, changing operators later does not mean moving your logs, which is the ownership side of the build-versus-buy decision above. The same AI SOC on existing SIEM approach covers mixed estates, for example Splunk in one business unit and Microsoft Sentinel in another.
Managed SIEM Pricing FAQ
How is managed SIEM priced?
Managed SIEM is priced per asset or device, per gigabyte ingested, per event per second, or as a flat subscription tier, with retention and the service level added on top. Some quotes combine two units, for example a per-asset fee with a data allowance, so ask which unit drives the total.
Is managed SIEM cheaper than running a SIEM in-house?
It is cheaper when the alternative is hiring a team to watch the SIEM around the clock. If you already license a SIEM and employ analysts, buying only the operation, or keeping it in-house, can cost less than a provider-owned platform. Compare license, ingestion, storage and people across the full contract term.
Do managed SIEM providers charge for data overages?
Volume-based contracts set a daily GB or EPS allowance and bill usage above it as overage. Rapid7 takes a different approach for its SIEM packages: a fair-use monthly data policy that scales with asset tiers, under which it says it does not throttle consumption. Get the overage rule in writing before you sign.
Who owns the logs in a managed SIEM contract?
You do when the SIEM runs in your own tenant, as in a co-managed setup. When the provider owns the platform, the logs sit in its environment, so check the contract for the export format, timing and cost of getting your data back at exit.
Can I reduce my data volume after signing?
It depends on the contract. Microsoft lets Sentinel commitment tiers be upgraded at any time and downgraded after 31 days; a provider’s own contract may be stricter. Ask each provider when you can lower the volume or asset count, and at what notice.
What should a managed SIEM quote include?
At minimum: the billing unit and quantity priced, the ingestion or EPS allowance, retention in days, the overage rate, onboarding fees, the response SLA for critical alerts, and the terms for exporting your data at exit. A quote missing any of these is hard to compare.
Does managed SIEM include incident response?
Not always. LevelBlue, for example, describes managed SIEM as operating your SIEM with alert monitoring and light investigation, and positions its Co-Managed SOC as the deeper service, with in-depth investigation and threat hunting. Ask where the provider’s work stops and your team’s begins.
Can I keep my current SIEM and still buy managed SIEM?
Yes. Co-managed SIEM providers operate a SIEM you already license, such as Splunk or Microsoft Sentinel, so you pay for the operation and keep your license, logs and detection history. Confirm the provider supports your SIEM and log sources before you sign.
Curious what Managed SIEM would cost for your environment?
See what operating the SIEM you own would cost, priced on your asset count and log volume.
Managed SIEM pricing calculator: Get your quote
Ready to see the UnderDefense Agentic AI SOC on your own SIEM?
Related Articles
How a Credit Union’s IT Team Achieved 24×7 Security Coverage and Discovered a Hidden Firewall Gap
CASE STUDYHow a Credit Union's IT Team Achieved 24×7 Security Coverage and Discovered a Hidden...
From 3-Day Breach Discovery to 10-Minute Detection on a 24/7 Betting Platform
CASE STUDYFrom 3-Day Breach Discovery to 10-Minute Detection on a 24/7 Betting...
7 Best Compliance Automation Software 2026: Audit-Ready All Year
9 Best CSPM Tools 2026: What Posture Scores Miss
10 Best Agentic AI SOC Platforms for 2026
Compare 8 best agentic SOC platforms for 2026. Pricing, integrations, compliance, and POC frameworks scored across 500+ MDR deployments. Evaluate now.