What does a SIEM really cost?
Mar 30th, 2023 by Jesper Kråkhede
When companies budget for a SIEM, they usually look at one number: the licence or the price per gigabyte. That is maybe a third of the real cost. Here is how I suggest calculating it.
Start with data. Estimate the volume per day for each log source and multiply with the price per gigabyte for the tier you need. Add the cost for keeping it as long as you need, which is often longer than the default.
Then add people. A SIEM nobody looks at is a very expensive archive. Someone has to handle alerts. If you want coverage around the clock, one seat needs five to six people once you count nights, weekends, vacations and sick leave. That is usually the largest cost by far.
Then add detection engineering. Built-in rules are a good start, but every environment needs its own detections and tuning to keep the noise down. That requires people who know both the attacks and your systems. They are hard to find and they don´t come cheap.
Finally add the integration work: connecting sources, keeping parsers working when products are updated, and building automation.
When you add it all up, many smaller organisations find they don´t have the resources to run it themselves. That is not a failure. A managed service, or a SIEM that comes with good built-in detections and automation, may be the better choice.
Budget for the people first. The data is the cheap part.