The list price of a SIEM tells you almost nothing about what it will actually cost you. Cloud and on-premise SIEMs have fundamentally different cost structures, and the model that looks cheaper at the pilot stage is often far more expensive in production. This guide breaks down the real total cost of ownership (TCO) of each approach.
Cloud SIEM is an operating expense priced primarily on data volume — you pay per GB ingested and stored, monthly, forever. On-premise SIEM is a mix: a licence (often flat or capacity-based) plus your own hardware and operational effort. The crucial difference is how cost scales: cloud cost scales with your data volume, while on-premise cost scales with infrastructure you control and largely own.
The defining cost of a cloud SIEM is per-GB ingestion pricing, and its effect is more pernicious than the headline rate suggests. As your environment grows — more endpoints, more cloud workloads, more verbose logging — your bill grows with it. Worse, this pricing model actively discourages good security practice: teams reduce what they log to control costs, deliberately creating the visibility gaps that attackers exploit.
The crossover point
At low data volumes, cloud SIEM is genuinely cheaper — no hardware, no ops. But there is a crossover point, often reached surprisingly early in production, beyond which the cumulative ingestion-and-storage bill exceeds the all-in cost of a self-hosted deployment. The higher your log volume and the longer your retention, the more decisively on-premise wins.
To be fair, on-premise is not free of cost — it is just structured differently:
The operational concern in particular is far smaller than it used to be. nPro deploys in five minutes via an automated installer and runs on ClickHouse, which requires far less tuning than a traditional ELK stack — addressed in our Ubuntu deployment guide.
Consider an organisation ingesting 50GB of security logs per day with a 12-month retention requirement. On a cloud SIEM priced per GB, ingestion alone runs into hundreds of thousands of dollars annually, and storage of a year's data adds substantially more — and both figures rise every year as data grows. On a self-hosted deployment, the same workload needs a server with fast SSD storage (a one-time hardware cost in the low tens of thousands) plus a flat annual licence, with no penalty for data growth. Over a three-year horizon, the cumulative difference is typically very large in favour of on-premise.
The exact numbers depend on your volumes and vendor, but the shape of the curve is consistent: cloud is cheaper to start, on-premise is cheaper to scale.
TCO is rarely the only consideration, and several factors push strongly toward on-premise regardless of the pure cost maths:
Choose cloud SIEM if your data volume is low and stable, you have no data residency constraints, and you have no in-house ops capacity at all. Choose on-premise SIEM if your data volume is significant or growing, you have compliance or sovereignty requirements, you need long retention, or you want predictable costs that do not punish you for logging more. For most growing organisations in Southeast Asia, the combination of data-residency pressure and rising log volumes makes on-premise the stronger long-term economic and strategic choice.
nPro is self-hosted with flat licensing — log everything without watching the meter.
Related: nPro vs Splunk · Log Retention Best Practices · What is a SIEM? · nPro SIEM