An MSSP onboards a new client. Good news, right up until procurement pulls up the SIEM contract and realizes the client’s log volume just pushed them into the next pricing tier. The margin on that account evaporates before the first alert fires.
That scene is playing out across the managed security industry right now, and it’s the real reason so many MSSPs are quietly walking away from licensed SIEM platforms. Not because Splunk or QRadar stopped working. Because the pricing model was built for enterprises buying one license for themselves, not for providers reselling security to dozens of clients whose data volumes nobody can fully predict.
The Ingestion Trap: When Growth Becomes the Enemy
Most commercial SIEM platforms charge by how much data you feed them. Microsoft Sentinel runs roughly $4.30 to $5.59 per gigabyte ingested. Splunk deployments for mid-sized security operations commonly land between $80,000 and $300,000 a year, scaling with data volume and retention. IBM QRadar bills by events per second, which means a single noisy firewall or a misconfigured endpoint agent can quietly double a bill nobody budgeted for.
For an enterprise buying SIEM for itself, that’s an annoyance. For an MSSP, it’s structural. Every new client is a new pile of logs, and telemetry volume across a typical environment grows 20 to 30 percent a year on its own, before you add a single new customer. Sign three new clients this quarter and your SIEM bill grows on two axes at once: more tenants, more data per tenant. Try explaining that compounding curve to a client who signed a flat monthly retainer.
This is the same tension covered in why MSSPs need 360° cybersecurity platforms instead of stacking point tools. A single ingestion-billed SIEM sitting underneath a dozen other tools doesn’t consolidate cost. It multiplies it.
The Part of the Bill Nobody Shows You Upfront
Ask a vendor for a SIEM quote, and you’ll get a license number. That number is roughly 40 percent of what the platform actually costs you over its lifetime. The other 60 percent shows up later: storage retention fees and tuning hours nobody bills back to a client, plus professional services engagements and the quiet expense of paying a Level 3 analyst to write detection rules instead of servicing accounts.
Out-of-the-box rulesets generate a wall of false positives on day one. Someone has to tune them, and that someone is billable staff time you’re not charging back to anyone. Add storage overage charges once retention windows fill up, plus data egress fees if you ever want to move telemetry somewhere else, and hidden costs alone can add 30 to 50 percent on top of the sticker price. There’s a detailed SIEM Cost Breakdown that walks through exactly where that 60 percent goes, tier by tier, if you want to see the math against your own ingestion numbers.
None of this is a scandal. It’s just how per-GB licensing works. But it’s a bad fit for a business model where your revenue per client is fixed, and your cost per client isn’t.
Why This Hits MSSPs Harder Than Enterprises
An enterprise security team answers to one budget owner. An MSSP answers to every client’s budget, simultaneously, while a single vendor’s pricing model sits underneath all of them. That’s the core of what’s often called the “SIEM tax”: the gap between what you’re billed and what you’re actually using the platform for.
A chunk of most clients’ logs are cold data, kept around because an auditor might ask for them someday, not because anyone’s actively hunting through them. Licensed SIEM charges the same ingestion rate whether that data is driving active detection or sitting untouched for compliance. And compliance frameworks, for what it’s worth, don’t actually require a named SIEM product. They require log retention and review capability. Those are different problems, and bundling them into one ingestion-priced platform is where a lot of MSSP margin quietly disappears.
Multi-tenancy makes it worse. Some vendor licensing models charge per tenant on top of per-GB, which turns “add a client” into a two-part cost increase before that client has generated a single alert. It’s the same math Tata Communications ran into rebuilding its SOC for AI-enhanced defense: at a certain scale, the platform architecture itself becomes the bottleneck, not the detection logic running on top of it.
What MSSPs Are Building Instead
The alternative isn’t abandoning SIEM functionality. It’s abandoning the per-GB licensing wrapper around it. A growing number of MSSPs are moving telemetry into open-source stacks or custom-built data lakes (Elastic, or a homegrown ClickHouse-based pipeline), where the ongoing cost is infrastructure, not ingestion volume. You pay for compute and storage at cloud rates instead of a vendor’s markup on both.
This isn’t free. Building your own platform means owning uptime, schema design, and detection engineering that used to be someone else’s product roadmap. It’s the same trade-off covered in choosing between managed security services and building your own security team: you’re not eliminating cost, you’re converting a variable operating expense into a fixed engineering investment, and that only pays off if you actually have the engineering capacity to maintain it.
The MSSPs making this move successfully aren’t doing it in isolation, either. Detection engineering, response playbooks, and platform ownership increasingly sit together which is part of why managed detection and response is being treated as more than monitoring inside these rebuilt stacks, not a separate line item bolted on afterward.
Where the Break-Even Actually Sits
Here’s the honest answer, not the vendor pitch version: building your own platform makes financial sense above roughly 100 GB of daily ingestion, with a dedicated engineer or two to run it. At that volume, MSSPs report 40 to 70 percent cost reduction within the first year and break even on the engineering investment in 12 to 18 months.
Below 50 GB a day, the math flips. You don’t have enough scale to justify the engineering overhead, and a licensed SIEM, annoying pricing model and all, is still cheaper than paying someone to babysit infrastructure that barely gets used. The mistake is assuming build-your-own is always the right answer. It’s a scale decision, not an ideology.
There’s also a staffing reality that gets glossed over: an unmaintained custom platform is worse than an expensive licensed one. If you build and then can’t sustain the engineering commitment, you’ve traded a predictable (if painful) vendor bill for infrastructure debt that fails quietly, usually right when you need it most.
Where This Leaves MSSPs Choosing a Platform Today
None of this means licensed SIEM is dying. It means the market has split. Smaller MSSPs and providers under that ingestion threshold are staying put, and rightly so. Larger providers with the client base and engineering bench to support it are moving core telemetry off per-GB licensing and treating platform ownership as a competitive advantage rather than a burden.
That split also shows up in how MSSPs structure delivery internally, echoed in how co-managed IT teams are dividing security responsibilities between internal and external staff. The platform decision and the staffing decision aren’t separate conversations anymore. They’re the same one.
If you’re an MSSP staring down a renewal quote right now, the question isn’t “is licensed SIEM bad.” It’s “what’s my actual daily ingestion, and do I have the engineering hours to own this instead of renting it.” Run that number honestly before you sign anything.
