The Games SIEM Vendors Play: Pricing and Scalability

Welcome to the first in a three-part blog series about the games that SIEM vendors play. In this series, we will be diving into the different tactics and strategies that vendors use to entice customers into purchasing their products.

Security information and event management (SIEM) is an essential component of an organization’s cybersecurity strategy, providing real-time visibility into security-related data from various sources, such as network devices, servers, and applications. But when it comes to selecting a SIEM vendor, organizations often find themselves navigating a complex landscape of features, pricing models, and marketing claims.

In this blog post, we will explore two games that SIEM vendors play with words, and discuss how you can make informed decisions when choosing a SIEM solution.

Paid and free versions

One of the most obvious games that SIEM vendors play is with pricing. Some vendors offer free versions of their products with unexpectedly unlimited features, including how they charge for which logs at ingestion, while others charge exorbitant fees for full access and features. While free versions can be a great way to try out a product, you need to be aware of the limitations of the sample as well as the costs of upgrading to a paid version that has all your must-haves for production. 

Additionally, some vendors may offer a low initial price, but charge extra for add-ons, new (or non-proprietary, aka “outside”) log sources, storage duration, or support. It is important to understand the total cost of ownership as regards your intended log sources and use cases, and ensure that the SIEM solution you choose meets your needs and budget.

Performance without scalability

Another game that SIEM vendors play is promising high performance without scalability. While a SIEM solution may perform well in a small-scale deployment, scalability is an important consideration when selecting a vendor. A SIEM solution that can’t scale to meet your organization’s growing needs can quickly become a bottleneck and impede your security posture. 

This is an important step in your discovery phase, where you need to evaluate the log sizes with your retention needs as well as practical review durations. Some vendors offer “free” log storage, but only for a limited duration. This can be good enough if your security operations look only at the last few days. But with any kind of compliance or log storage needs, accurate calculation of actual log size and projections will start to matter. Further, read the fine print for any on-premises equipment or security log storage solutions to see maximum capacity up front. If you are allowed by local security policy, it’s best to look at vendors that can provide scalability through distributed architectures and cloud-based deployments.

It goes without saying that many policies on local vs. cloud may be decades old, and can or should be reviewed with an eye to modern cloud infrastructure. The shared responsibility model of cloud security has outpaced many internal older documents on risk review and management, depending on the age of your organization.

Conclusion

In conclusion, many SIEM vendors play games to entice customers into purchasing their products. It is important to be aware of these games and not fall for the traps. By understanding the limitations of free versions and the importance of scalability, you will be able to make an informed decision when purchasing a SIEM.

Stay tuned for the next post in our series, where we will discuss the games vendors play around security and the security considerations of public cloud, plus local and remote workers.

See what Forrester Consulting is saying about the ROI from Exabeam SIEM

The Exabeam Fusion Total Economic Impact™ (TEI) study by Forrester Consulting revealed how a group of Exabeam Fusion SIEM customers achieved a composite ROI of 245% over three years, with a payback period of less than six months.

Read the report to learn:

• Four measurable areas where customers achieved ROI using Exabeam Fusion SIEM
• Why customers choose Exabeam Fusion SIEM
• How the Exabeam Next-gen SIEM can transform security operations