A billing model that charges according to telemetry volume ingested or scanned. It rewards curated logging and makes heavy data sources expensive, which means cost can rise even when the extra data adds limited investigation value.
What Per-Data Pricing Means in Practice
Per-data pricing shifts cost from a flat subscription to measured usage, so the bill grows with telemetry volume, ingest rate, or scan volume. That makes the pricing model part of the security and observability design, not just procurement.
Why It Changes Logging Strategy
Because each extra byte can carry a direct cost, per-data pricing rewards selective collection, filtering, and normalization. Teams tend to preserve high-value telemetry, compress duplicate signals, and avoid low-signal sources that add noise without improving investigation quality.
That incentive can be healthy when it drives disciplined logging, but it can also create pressure to suppress data that would have helped during an incident. The core question is whether the data reduction is intentional and risk-based, or simply a reaction to bill shock.
Cost, Coverage, and Operational Trade-offs
Per-data pricing is most visible in security operations, cloud logging, and search-heavy monitoring systems, where ingest and scan costs can rise quickly as environments scale. It can also expose hidden cost centers such as verbose application logs, repeated event duplication, and broad retention policies.
For defenders, the trade-off is straightforward: more data can improve detection and investigation depth, but indiscriminate collection can make the platform expensive enough that teams start turning it down. Good program design keeps the telemetry set aligned with actual detection, forensics, and compliance needs.
How to Interpret the Pricing Model When Evaluating Tools
Per-data pricing should be evaluated as a control-adjacent design choice. A tool that looks inexpensive on licensing may become costly once high-volume streams, indexation, retention, or reprocessing are included.
Used well, the model encourages data curation and clearer ownership of what must be logged. Used poorly, it can incentivize under-collection, fragmented visibility, or inconsistent retention practices across teams and environments.
Risk and Threat Considerations
Per-data pricing can create a security exposure when cost pressure leads organizations to reduce telemetry, shorten retention, or exclude noisy but important sources. Attackers benefit when logging is thinned out, because persistence, lateral movement, and low-and-slow activity become harder to reconstruct.
Failure mechanism: A billing model tied to volume can push teams to silence sources, drop fields, or cap ingest in ways that weaken detection and incident response visibility.
Impact: Reduced telemetry can delay threat detection, weaken forensic reconstruction, and leave gaps that hide abuse until damage has spread.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.PO-01 — Policies, Processes, and Procedures | Per-data pricing shapes logging policy and telemetry governance decisions. |
| DE.CM-01 — Monitoring for Anomalies and Events | Telemetry volume and coverage directly affect continuous monitoring effectiveness. | |
| Recommendation — Define logging policy so telemetry collection stays aligned with security and business needs. Set monitoring coverage requirements before reducing or filtering event data. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Usage-based logging charges affect what events are selected and retained. |
| AU-12 — Audit Record Generation | The model influences how audit records are generated and how much data is captured. | |
| Recommendation — Specify the events that must be logged regardless of ingest cost. Generate audit records for security-relevant activity even when volume-based pricing applies. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Per-data pricing materially affects log collection, retention, and review. |
| Recommendation — Retain and review the logs that support detection and investigations. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | The term directly concerns how logging is costed and governed. |
| Recommendation — Establish logging requirements that balance visibility needs and usage-based cost. | ||
Practitioner Guidance
Common misunderstanding: Cheaper data collection is not automatically better logging. The practical goal is to pay for the telemetry that materially improves detection, response, and auditability, while avoiding high-volume sources that add cost without adding usable security value.
Practitioner takeaway: Treat per-data pricing as a visibility governance issue, not only a finance issue, and define in advance which data sources are non-negotiable for security operations.
Related resources from NHI Mgmt Group
- What do teams get wrong about per-data AI SOC pricing?
- How should retailers govern AI systems that handle customer data and pricing decisions?
- How should teams choose between AI models when per-token pricing looks misleading?
- How should retail teams govern AI agents that can change pricing or inventory data?