Topic starter
14/10/2026 3:49 pm
TL;DR: SOC cost can fall to about $0.20 per GB at 1 TB a day on Core support, according to LogSeam pricing analysis, but the bill still shifts with compute, retention, and cloud discounts. That makes consumption governance, not flat licence arithmetic, the real control variable for security operations.
Editorial analysis by NHI Mgmt Group, based on content published by LogSeam: “How we built LogSeam, part 3: what it costs to run”.
By the numbers:
- At 1 TB of raw JSON a day, LogSeam costs about $0.20 per GB all-in on Core support at on-demand prices.
- The 1 TB a day bill is $6,079 a month on demand and $5,106 on 1-year plans.
Key questions
Q: How should security teams budget for a usage-based SIEM model?
A: Treat it as an operational cloud workload, not a fixed software purchase.
Q: Why does log retention change security platform economics so much?
A: Because retained data accumulates while ingest is ongoing, so storage becomes a compounding cost rather than a one-time processing expense.
Q: What signals show that a security platform is becoming too expensive to scale?
A: Watch for storage growth outpacing ingest expectations, search activity driving a disproportionate compute bill, or monthly spend rising faster than log volume.
Practitioner guidance
- Define a security operations cost model Break SOC spend into ingest, storage, search, compute and support so finance and security can see which workload drives each line item.
- Tie retention to budget policy Set retention targets with explicit cost thresholds, then test how compressed storage changes total monthly spend before approving longer holding periods.
- Model cloud commitments against security demand Compare the platform’s compute mix with your existing savings plans or reserved capacity so the security workload benefits from the same discounts.
Bottom line: The article’s core message is that SOC economics are governed by workload shape, not just software purchase terms.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/10/2026 3:50 pm
Consumption governance is becoming a security operations discipline in its own right. When the platform cost moves with ingest, retention and query load, security teams cannot treat finance as a separate downstream concern. The operating model has to make cost visible at the same level as coverage and latency. Practitioners should treat elastic SOC spending as a governed control surface, not a surprise invoice.
A question worth separating out:
Q: Should security teams compare SIEM licences with cloud-native consumption models?
A: Yes, but only after normalising the comparison around retention, compute shape, cloud discounts and support coverage. A licence price alone does not capture the economic reality of a distributed SOC. The right comparison is total cost for the required workload, not vendor pricing labels.
👉 Read our full editorial: LogSeam’s cost model shows how SOC scale shifts with consumption