- 01SIEM data volumes have grown faster than budgets. Per-GB licensing models that worked in 2015 produce 2026 financial outcomes boards are no longer willing to fund. Architectural response is well-known but inconsistently implemented.
- 02Cost-control architecture: tiered storage (hot SIEM for recent, cheap object storage for the rest), selective ingestion (keep what is investigative, drop what is auditable-only), schema-on-read for cold data (keep the option, defer the cost), separation of detection (hot path) from compliance (cold path).
- 03Where vendor lock-in bites: cold-tier products from incumbent SIEM vendors are not the cheapest option and preserve lock-in by design. Open formats (Parquet on S3) and federated query engines (Snowflake, Databricks, BigQuery, security data lakes) provide cheaper, portable cold tier — only if your detection content can query both tiers without rewriting.
- 04Negotiation reality: most SIEM vendors discount 30-50% with multi-year commitments and committed volumes. Leverage is greater with a credible alternative architecture in flight. Walking into renewal without that credibility is walking in with no leverage.
SIEM data volumes have grown faster than budgets. Per-GB licensing models that worked in 2015 produce financial outcomes in 2026 that boards are no longer willing to fund. The architectural response is well-known but inconsistently implemented.
The cost-control architecture
- 01Tiered storage — hot SIEM for recent, cheap object storage for the rest
- 02Selective ingestion — keep what is investigative, drop what is auditable-only
- 03Schema-on-read for cold data — keep the option, defer the cost
- 04Separation of detection (hot path) from compliance (cold path)
Where vendor lock-in bites
Cold-tier products from incumbent SIEM vendors are not usually the cheapest option, and they preserve lock-in by design. Open formats (Parquet on S3) and federated query engines (Snowflake, Databricks, BigQuery, dedicated security data lakes) provide a cheaper, portable cold tier — but only if your detection content can query both tiers without rewriting.
Negotiation reality
Most SIEM vendors will discount 30-50% with multi-year commitments and committed volumes. The leverage is greater if you have a credible alternative architecture in flight. Walking into renewal without that credibility is walking in with no leverage.