Read your SIEM contract like an insurance policy

The right to leave, kept

The clause nobody can use

You insure the data center against fire, flood and outage. Almost nobody insures the right to leave the SIEM.

That matters more than it sounds, because the most expensive clause in a SIEM contract is the one you can’t exercise: cancellation. If leaving would take a year-long migration project, you will not leave, and your vendor’s account team knows that as well as you do. Every other number in the contract is negotiated in the shadow of that fact.

Most SIEM order forms get read line by line for this year’s price. The parts that decide what the price will be in three years get skimmed. So here is a different way to read one, built on a document every executive already knows how to read: an insurance policy.

A policy has five words that matter. The premium you pay. The deductible you pay when something goes wrong. The exclusions, what the policy will not cover. The renewal clause. And the one nobody reads, cancellation. Put a SIEM contract through those five words and the cost problem and the control problem turn out to be the same problem.

The short version, the one worth taking into a renewal meeting: on an illustrative Splunk estate of 1,000 GB a day, at a negotiated price well below list, doing nothing costs $4.52M over three years, and year three costs nearly twice what year one does. The cheapest way to change that number is to make cancellation a real option again.

Five terms first, in plain words

Some readers live in this vocabulary. Others are about to forward this to someone who doesn’t, so here are the terms everything below depends on.

A SIEM (security information and event management) is the system that collects security logs from across a company, searches them, and raises alerts. Splunk, Microsoft Sentinel and CrowdStrike Falcon Next-Gen SIEM are examples. Most are priced by how much data you send them.

Ingest is that data arriving. It is usually counted in gigabytes a day (GB a day), and many SIEM contracts are priced per GB a day, per year.

A renewal uplift is the increase in price the vendor applies when the contract term ends and you sign again. It is often written into the standard terms and applies unless your order form says otherwise.

A pipeline is a layer that sits between the systems producing logs and the places logs go. It receives everything once, cleans it, enriches it, and decides where each piece goes. Cribl Stream is one example. A pipeline sits in front of the SIEM, never in place of it.

The Lake is a clean, deduplicated copy of your telemetry in storage you own, ready for search, replay and AI agents. Next to it sits the raw archive, a full copy of everything exactly as it arrived, kept cheaply for audit. Those two copies are what the rest of this piece calls your insurance.

The policy schedule

An insurance policy opens with a schedule: one page that says what you pay, what you’re covered for and what you aren’t. Here is the same schedule for a SIEM contract, today and with a pipeline in front of the SIEM.

The rest of this piece takes the five lines one at a time.

Premium: you pay by volume

The premium is the license, and for most SIEMs it moves with volume. Every new source, every noisy firewall, every debug log someone forgot to switch off raises it.

The published numbers vary by vendor, which is itself worth knowing:

• Splunk publishes no rate for its platform or for Enterprise Security. Every path on its pricing page ends at a quote request. Buyer data from Vendr, last updated February 2026, puts Splunk Enterprise list pricing at $1,800 to $2,700 per GB a day per year, and says buyers at 1,000 GB a day or more commonly pay 30 to 40% below list.
• Microsoft Sentinel lists pay-as-you-go analytics ingestion at $4.30 per GB in East US. Its commitment tiers bring that down: the 1,000 GB a day tier is $2,480 a day, about $2.48 per GB.
• Datadog Cloud SIEM charges $5 per million analyzed events a month, billed annually, on top of $0.10 per GB for log ingestion.
• CrowdStrike Falcon Next-Gen SIEM lists a pay-as-you-go price on AWS Marketplace: $0.00595 per MB of non-Falcon data ingested, about $5.95 per GB, with 13 months of retention included. Falcon Insight customers get the first 10 GB a day of third-party data free. Larger contracts are quoted.

Our SIEM pricing comparison carries more of these, each with its source and the date we checked it.

The problem with a volume premium is not the rate. It is what the rate is charged on. In our piece on detection coverage, CardinalOps’ five-year averages show teams already ingest enough data to support detections for 90% of MITRE ATT&CK techniques while working rules cover 21%. A lot of what pays the SIEM rate feeds no rule at all. In our piece on what an AI agent pays for every log line, the same noise gets paid for a second time, in tokens, the moment an agent starts reading it.

What a pipeline changes. Only what feeds detection pays the SIEM rate. The rest still lands somewhere you can search it, at storage prices, which is the next three sections’ business.

Deductible: what a bad month costs

A deductible is what you pay out of pocket when something goes wrong. In a SIEM contract it is the cost of a volume surprise: the incident that triples one source overnight, the new application that ships with verbose logging, the acquisition that adds two hundred servers.

The vendors handle this differently, and the details are in their own terms. Splunk states on its pricing page that it charges overage only when you consistently exceed the ingestion or storage capacity you bought, so a short spike during an incident is absorbed. Microsoft bills usage above a Sentinel commitment tier at the same discounted rate, and a tier can be raised at any time but lowered only after 31 days.

Those are reasonable terms. The deductible that hurts is the one that doesn’t appear in them: the emergency license bump negotiated in a hurry because volume grew and is not coming back down, signed at whatever price the quarter allows. A team under that pressure has one lever, which is to stop sending data. That leads straight to the exclusions.

What a pipeline changes. Spikes are absorbed or routed before they bill. A source that triples overnight can be summarized, sampled for the SIEM, and sent in full to the archive, while the team decides what it is worth. The decision moves from the invoice to the routing rules, which your team owns.

Exclusions: what the policy doesn’t cover

Every policy lists what it will not pay for. A SIEM contract has an exclusion too, though it is never written down: the data you stopped sending to save money.

It happens quietly. The DNS logs go first because they’re huge. Then the firewall allow logs. Then the verbose endpoint events. Each cut is defensible on its own and each one saves real money. And each one is an exclusion: the next time an incident needs that data, it isn’t there, and nothing in the SIEM can search what the SIEM never received.

In our view this is the worst trade in a security budget, because it swaps a predictable cost for an unpredictable one. A CISO is judged on whether the investigation can be done, and an auditor will ask for logs the team decided not to keep.

What a pipeline changes. Nothing is dropped. What the SIEM doesn’t need still lands in two places you own: the clean copy in your Lake and the full raw copy in your archive. When an incident needs it, it is replayed into the SIEM or searched where it sits. Our earlier piece on reduction as a replay strategy walks through how that replay works during a real incident. The point here is the policy language: reduction stops being an exclusion and becomes a cheaper tier of the same cover.

Renewal: the uplift you accept

Now the clause that turns a stable estate into a rising bill.

Until spring 2026, Splunk’s published pricing FAQ set a standard uplift of 9% on a one-year renewal, unless the customer’s order said otherwise. Other vendors write it differently, and many multi-year deals cap it. Ask what your own order form says, because that is the number that applies to you.

Put a renewal rise together with growth and the result compounds. Here is the arithmetic on an illustrative estate, the same one our cost of doing nothing model uses, built to understate rather than inflate, so a CFO can redo it by hand:

• 1,000 GB a day into Splunk today.
• $1,080 per GB a day per year: the low end of Vendr’s Splunk list range, $1,800, less 40%, the top of the discount Vendr reports for buyers at this volume.
• 29% growth in volume a year, an IDC forecast quoted by Cribl in July 2026.
• A 5% rise at each renewal from year 2, below the 9% Splunk used to publish. Year 1 is today’s price.

Year	GB/day	Price per GB/day	Cost
1	1,000	$1,080	$1.08M
2	1,290	$1,134	$1.46M
3	1,664	$1,191	$1.98M
Total			$4.52M

The arithmetic, line by line:

• Volume grows 29% a year: 1,000, then 1,000 × 1.29 = 1,290, then 1,290 × 1.29 = 1,664.
• Price starts at $1,800 × 0.6 = $1,080 and rises 5% at each renewal: $1,134, then $1,191.
• Cost of the year is volume times price: 1,000 × $1,080 = $1.08M, 1,290 × $1,134 = $1.46M, 1,664 × $1,191 = $1.98M.

Most of that climb is growth, not price. Year three costs nearly twice what year one does, and nothing about the estate changed except that it grew at the forecast rate.

The same estate on other SIEMs, each at its own price, with the same growth and renewal rise:

SIEM	Price per GB/day a year	Three years
Splunk, list less 40%	$1,080	$4.52M
Microsoft Sentinel, 1,000 GB a day commitment tier	$905	$3.79M
Datadog Cloud SIEM, list less 40%, at 1 KB an event	$1,117	$4.68M
CrowdStrike Falcon Next-Gen SIEM, AWS Marketplace rate less 40%	$1,303	$5.46M

The Sentinel line uses Microsoft’s published tier, which is already its volume discount. The Datadog line converts a per-event price to a per-GB one, so it moves with your average event size: smaller events cost more per GB, larger ones less. The 40% sits inside the 30 to 45% Vendr reports for large Datadog deployments. The CrowdStrike line starts from its published pay-as-you-go rate, which includes 13 months of retention, and takes the same 40%: Vendr reports CrowdStrike discounts as common at volume but gives no percentage. None of it is your contract. The model runs on your own volume, price, discount, growth and renewal rise, for any of these platforms, and shows every formula.

What a pipeline changes. Two things. The volume line grows more slowly, because only what feeds detection pays the SIEM rate. And, more important at the table, there is a real alternative, so the renewal becomes a negotiation. An account team prices differently when it knows the customer could route a source to a second SIEM next quarter. That last sentence is our view, not a published number, but anyone who has sat through a renewal will recognize it.

Cancellation: the clause nobody reads

Cancellation is where the policy metaphor stops being a metaphor.

Read the termination section of your SIEM agreement. Splunk’s is a fair example, because it is clear and published. Its General Terms, section 4.3, say you may retrieve your content at any time during the term, that Splunk “will make the Customer Content available for your retrieval for 30 days after termination of your subscription”, and that after those 30 days it “will delete all remaining Customer Content without undue delay, unless legally prohibited.” That is a reasonable term. It also means that if the only copy of your security history lives inside the SIEM, leaving puts a 30-day clock on getting it out.

The data is only half of it. The other half is everything wired to the SIEM: agents and forwarders on every host pointed at it, parsers written for its format, detection rules in its language, dashboards, retention policies, compliance evidence. Leaving means moving all of that at once, while the old contract and the new one both bill. That is why, in practice, most teams can’t cancel. The clause exists. Nobody can afford to use it.

What a pipeline changes. It makes cancellation a routing change. Sources send to the pipeline, not to the SIEM, so the hosts don’t move. The history is already in your Lake and your archive, so there is no 30-day scramble. A second SIEM can be fed the same routed stream in parallel, checked against the first, and switched over source by source. Our piece on pipeline insurance as a buying motive covers how teams have run migrations this way. For this piece, one line is enough: changing SIEM becomes a routing change. That is the insurance.

The same logic, one level up: concentration

There is a second reason executives buy insurance, and it isn’t price. It’s concentration: too much depending on one counterparty.

On 19 July 2024 a CrowdStrike update crashed Windows machines around the world. Microsoft’s own estimate, published the next day by David Weston, its Vice President of Enterprise and OS Security, was that the update “affected 8.5 million Windows devices, or less than one percent of all Windows machines.” That was an endpoint software incident, not a SIEM one. The lesson for this piece is narrower and fair to every vendor: when one supplier holds a critical function and the only copy of its data, any bad day at that supplier becomes your bad day too.

A copy of your security telemetry outside any single vendor is the cheapest hedge against that. It is the same Lake and the same archive as above, doing a second job.

Control: where the data lands, and who reads it

Cost is the line a CFO reads. Control is the line a CISO and a CIO read, and it comes from the same design.

• The data lands in storage you own. The Lake and the raw archive sit in your own cloud account, under your keys and your retention rules, whatever happens to any vendor contract.
• You choose where the pipeline runs. With Cribl, for example, it can run on workers in your own account (hybrid) or in Cribl.Cloud, managed by Cribl. Either way the Lake and the full raw copy land in your storage. We’d only promise that logs never leave your account in the hybrid case, and we say so.
• Any AI agent you choose reads the Lake. Your own agent in your own cloud account, or any vendor’s AI SOC or risk agent, reading the Lake, any SIEM and any APM, and swappable at any time. The agent is your choice, never ours, and with read-only access, people approving any change, and a record of what it read.

That is what we mean by freedom of choice, and it is the shape of the Logmetry Blueprint: raw telemetry into a pipeline in front of the SIEM, the SIEM receiving what detection needs, the clean copy in your Lake, the full raw copy in your archive.

The honest part: when this insurance isn’t worth buying

Insurance has a price, and this one does too. A pipeline is not free. It is one more system to design, run, patch and monitor, and someone on your team has to own it on day two. Saying otherwise would be selling you a policy without showing you the premium.

So, in our view, here is where it pays and where it doesn’t:

• Worth it when the estate is big. We work with estates of 1 TB a day or more into the SIEM. Below that, the hard saving usually doesn’t cover the cost of running another system, and the cost of doing nothing model will tell you so on your own numbers.
• Worth it when a renewal is 12 to 18 months away. That’s enough time to prove the routing on one source and arrive at the table with a real alternative. A renewal three weeks out is too late to change the negotiation.
• Worth it when the team already feels locked in. If people say “we could never move off it”, the cancellation clause is already worth nothing to you.
• Probably not worth it for a small, stable estate with a handful of sources, a fair contract, and no plans to change SIEM or add AI triage. Keep your money.

Five questions to bring to your next renewal

These are for the SIEM admin or architect who will be in the room, or who briefs the person who will.

1. What does our order form say about the uplift at renewal, and has anyone checked it against the standard terms?
2. If we gave notice tomorrow, how long would it take to get our security history out, and where would we put it?
3. Which sources did we stop sending to save money, and what would we do if an incident needed them?
4. What does our volume look like in three years at our real growth rate, and what does that cost at our real price?
5. If we wanted to send one source to a second SIEM for a month, how long would that take today?

If the answer to the last one is “a project”, your cancellation clause is decorative. Run your own numbers in the model, and if you’d like a second pair of eyes on the routing, that’s the work we do.

The sources, and how we read them

Every public number in this piece names its source where it appears: Splunk’s General Terms and pricing pages, Microsoft’s Sentinel pricing, Datadog’s price list, CrowdStrike’s Next-Gen SIEM page and its AWS Marketplace listing, Vendr’s buyer data for Splunk, Datadog and CrowdStrike, the IDC growth forecast as quoted by Cribl, and Microsoft’s own outage estimate.

The three-year estate is illustrative: 1,000 GB a day, the 40% discount, 29% growth and the 5% renewal rise are the inputs of our public model, not any client’s numbers. Replace each with yours. The views on renewals, exclusions and when a pipeline is worth it are ours, from building these systems, and are marked as such.

So, a question for whoever signs the renewal, or briefs the person who does: which clause in your SIEM contract would you most like to be able to use?