Skip to content
Logmetry
What we solve
SIEM and log costClean data for AI agentsCoverage, audit and PIIVendor independenceSIEM migrationObservability modernizationAll problems we solve
Who it’s for
For the CISOFor the CIO and CTOFor the CFOFor Architects
Platforms
SplunkMicrosoft SentinelCrowdStrikeElasticDatadogDynatraceSplunk ObservabilitySolarWindsCriblOpenTelemetryA Data LakeCompare the options
The Blueprint
The whole methodPhase 01 · FoundationPhase 02 · AI triagePhase 03 · RemediationPhase 04 · FootprintEverything as codeAI native
JournalAbout
About LogmetryYour teamTrust and securityStep one and the proofWhere we fit
Book the review

The journalEconomics

The MSP margin trap: why your SIEM bill grows faster than your revenue

MSP profit margins should be 30 to 35 percent. Most operate at 8 to 12 percent. The structural problem is usage-based SIEM pricing against flat-rate client billing. Here is how the math works and what pipeline architecture changes.

Zbigniew Gajuk2026-04-042 min readFor CFO and FinOps, CIO and CTO

A level row of even disc stacks beside a staircase of grey blocks climbing steeply, its top blocks red and pressing a gauge into the red. A dark teal pipeline stage set into the staircase diverts a stream of blocks down into a layered storage slab, and beyond it the blocks continue as a low level row with a teal check ring.Flat revenue, rising volume
Revenue per client stays flat while the volume the SIEM bills on keeps climbing. With a routing layer in front, the SIEM bills on less of that volume, so each new client erodes the margin less.

The structural problem

MSPs bill clients on flat-rate models, typically $150 to $250 per user per month with security included. Meanwhile, SIEM and observability vendors charge usage-based pricing: per-GB, per-EPS, or per-host. When client data volumes spike, the MSP absorbs the cost difference.

Average MSP profit margins sit at 8-12 percent. They should be 30-35 percent. Eighteen percent of MSPs operated at a loss in Q4 2024, up from 14 percent the prior quarter. Tool licensing costs inflate at roughly 23 percent annually while MSP billing rates stay flat.

Why data volume keeps growing

Log volumes grow approximately 50 percent year over year. That is a 5x increase over the past three years. Cloud platforms generate verbose logs by default. Compliance mandates force more data collection. Endpoint detection tools produce telemetry at scale. Every new client adds volume, and every renewal carries the accumulated growth.

The math is simple: if your SIEM cost scales with data volume and your revenue does not, your margins compress with every client you add. This is the margin trap.

The MSP margin trap, drawnA schematic, not to scale. Across new clients and renewals, flat-rate revenue per user stays level while usage-based SIEM cost climbs with data volume, and the margin between them narrows. With a pipeline in front, the SIEM sees less volume and the renewal uplift applies to a smaller base, so the cost line sits lower and climbs slower.PER CLIENT, OVER TIMEFlat-rate revenue per userSIEM cost, usage-based, grows with volumeThe margin narrows to a sliverWith a pipeline: less volume reaches the SIEM,and the renewal uplift applies to a smaller baseEach new client and each renewalA schematic, not to scale. Your own lines come from your billing and your license usage.
The MSP margin trap, drawnA schematic, not to scale. Across new clients and renewals, flat-rate revenue per user stays level while usage-based SIEM cost climbs with data volume, and the margin between them narrows. With a pipeline in front, the SIEM sees less volume and the renewal uplift applies to a smaller base, so the cost line sits lower and climbs slower.PER CLIENT, OVER TIMEEach new client and each renewalFlat-rate revenue per userSIEM cost, usage-basedWith a pipeline in frontA schematic, not to scale. The margin is the gap between the top lineand the cost line.
Flat-rate billing meets usage-based SIEM pricing, and the margin between them narrows with every client added. A pipeline lowers the volume the SIEM bills on, so the cost line stops chasing the revenue line.

What a pipeline architecture changes

A Cribl-based routing layer sits between your data sources and your SIEM. It inspects every event in flight and routes based on value. High-priority security events go to your SIEM at full fidelity. Routine noise, like firewall allow logs, often the largest single source, routes to S3 at a storage price per gigabyte.

The SIEM sees less volume. The renewal uplift applies to a smaller base. Your compliance archive stays complete in low-cost storage. And your margins stop eroding with every new client.

The numbers

A 100 GB per day SIEM deployment costs approximately $150,000 per year in platform licensing. Splunk compounds at 9 percent annually, turning a $100K contract into $140K in four years without adding a single data source. At 500 GB per day, Splunk TCO reaches $1.17M to $1.27M annually.

How much comes off depends on data composition, so it is measured on your own sources, not assumed. Cribl has published what named customers measured: TransUnion took DNS and Sysmon from about 1 TB a day to about 150 GB, about 85 percent (Cribl case study, 29 August 2023), and Nutanix brought firewall log volume down 50 percent (Cribl customers page, read September 2026). That is the difference between margin erosion and margin recovery.

See your architecture drawn, with the costs, before you spend anything.

Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.

Book the architecture reviewOr take the Blueprint as a PDF →

Free. No system access. No obligation. You keep the drawing.

What you get

  • Your architecture today, drawn
  • The waste map
  • Costs before and after, with estimates
  • Your target architecture
  • Options for your business problem

What it costsNothing