Splunk Enterprise Security runs on your own infrastructure and has the deepest app ecosystem in the category. The question is rarely capability. It is what ingest-based licensing does to your logging policy once data volumes grow.
Splunk licenses on the volume of data you ingest. That model is predictable only if your data volume is predictable, and it rarely stays that way. New log sources, cloud workloads and longer retention windows all push the bill upwards without anyone making a deliberate decision to spend more.
The second-order effect is the one that matters for security. Once ingest costs money, teams start choosing which logs to keep. DNS, proxy and endpoint telemetry tend to go first, because they are high volume and low drama. They are also exactly the sources an attacker benefits from you not recording.
nPro licenses per agent, at $4.50 per agent per month. The number of endpoints you protect sets the bill. Log volume does not enter into it, so there is no cost argument for reducing coverage, shortening retention or sampling events.
Model three years rather than one. Take your current ingest volume, apply the growth rate you have actually seen, and add the sources you have been postponing because of cost. Then price both models against that figure. A comparison run against today's volume flatters whichever platform you are already paying for.
No platform wins on every axis, and a comparison page that pretends otherwise is not much help when you are the one signing the contract. There are situations where Splunk is the better answer.
Splunk's app and integration library is substantially larger than anything else in this category, nPro included. If your detections and workflows are built on specific Splunk apps, replacing them is real work and should be scoped honestly.
SPL is exceptionally expressive for investigation and threat hunting. A team fluent in it moves faster than the same team on an unfamiliar query language, and that speed has a value you should weigh against licensing.
nPro's behavioural analytics are still in development. They are not comparable to a dedicated UEBA platform, or to Splunk Enterprise Security, at present. If user and entity behaviour analytics is a requirement rather than a preference, this is not yet the platform for it.
nPro has no SaaS option. That is deliberate, and it is also a commitment on your side. You need a Linux server that somebody patches, monitors and backs up. If your organisation has no appetite for running infrastructure, a hosted SIEM is the better fit whatever its licensing model looks like.
What you get in exchange is residency that does not depend on a vendor's regional policy, air-gapped operation where the network demands it, and a ClickHouse storage engine that takes materially less tuning to run than an Elasticsearch cluster. For regulated organisations that were going to self-host regardless, that trade is usually the easy part.
You need data sovereignty, and your logs cannot leave your network under any circumstances.
Your Splunk licence costs are growing faster than your security budget.
You operate in Southeast Asia, the Middle East, or any region with strict data localisation laws.
You want SIEM + network monitoring + XDR in a single platform.
You need an air-gapped deployment for classified or highly regulated networks.
You are an MSSP looking for a resellable SIEM with predictable unit economics.
No per-GB fees. No credit card. SIEM, XDR and network monitoring, deployed in about five minutes.