Per-endpoint pricing
We don't bill by GB ingested. Your budget stops depending on how much you log.
Log ingestion, event correlation, KQL-like search and a clear alert → evidence → response path. None of the operational overhead of enterprise SIEMs.
A SIEM collects the logs from your endpoints, servers, identity provider and cloud apps, correlates them into events and raises the alerts worth a human look. A small business needs one for the same reason a large one does: without it, a breach is only discovered when something breaks. The difference is who will operate it. For a 10-300 person company that is usually the IT admin who also owns security, so the SIEM has to be runnable by that person.
Enterprise SIEM checklists assume a SOC with headcount to spare. Ignore most of them. Here's what actually determines whether a SIEM works for a 10–300 person IT team.
We don't bill by GB ingested. Your budget stops depending on how much you log.
Maintained by our team and aligned with MITRE ATT&CK.
KQL-like queries over the central store, with results in seconds rather than scheduled reports.
Same platform unifies SIEM with endpoint and email detection. No silos.
Hosted in EU regions by default. Self-hosted available when policy requires it.
We help prioritize which log sources to connect first, so you see value before you've finished onboarding everything.
Neutral criteria. Pick the column that matches the people you actually have, not the one with the longest feature list.
| Option | Who operates it | Typical cost driver | Fits when |
|---|---|---|---|
| Open-source SIEM you run (Wazuh, ELK-based) | Your own engineer: backend, rules, upgrades. | Hardware and engineering hours; licence is free. | Someone wants to own it and the scope is logs and compliance. |
| Enterprise SIEM (Splunk, Sentinel, QRadar) | A detection engineer or a SOC. | GB ingested per day; logging more costs more. | You already have a security team and a budget line for it. |
| MDR / outsourced SOC | The provider's analysts. | Per endpoint or per user, plus the SIEM underneath. | You want someone else to watch alerts 24/7 and accept less visibility. |
| Protoxol | Your IT admin or your MSP, in one console. | Per protected endpoint, by plan. | You want to keep operating security yourself without running the plumbing. |
Before you compare vendor quotes, compare what makes each quote grow. Four models cover almost every SIEM a small business will be offered. None of the rows below carries a price; the point is to know which number on your side drives the bill.
| Model | What grows your bill | Who it suits |
|---|---|---|
| Per GB ingested | Log volume per day. Enabling verbose audit logging, adding a firewall or onboarding a chatty cloud app raises the invoice. Retention beyond the base window is usually billed on top. | Teams with an engineer who will filter sources before they land, and a budget owner who accepts that the bill moves month to month. |
| Per endpoint or per user | Headcount and device count. Logging more from the same machines costs nothing extra. Adding a server or a laptop adds one unit. | Small companies that want a fixed number for the year and whose growth is easy to forecast. This is the model Protoxol uses, priced by plan. |
| Per analyst seat | How many people log in to investigate. Ingestion is often bundled or capped. Common in MDR offers and some search-first tools. | Teams where exactly one or two people will ever open the console. Watch for ingestion caps hidden under the seat price. |
| Open source plus hardware | Disk, RAM and the hours of the person who maintains it. The licence is free; storage growth and upgrades are not. | Companies with an engineer who wants to own the stack and already runs servers. Fine for log retention and compliance, harder for daily detection work. |
A useful exercise: take your current daily log volume, your endpoint count and the number of people who would actually open the console, and run each model against those three numbers. The cheapest option on paper often changes once you include the hours someone spends keeping it alive. The Wazuh alternative page works through that trade-off for the open-source case.
Six options that come up in almost every evaluation at this size. Protoxol is our product, so read that row as the vendor's view and check the rest against a trial. Pricing columns describe the model, not the amount.
| Option | Operating model | Pricing model | Strengths | Watch-outs |
|---|---|---|---|---|
| Wazuh (open source) | Self-hosted. Your engineer installs, tunes and upgrades it. | Free licence; you pay for hardware and time. Optional paid cloud and support. | No licence cost, large community, agent covers endpoint telemetry and file integrity, good fit for compliance evidence. | Rule tuning and index maintenance land on your team. Response actions need scripting. Nobody is on the hook if it stops ingesting on a Friday. |
| Microsoft Sentinel | Cloud SIEM in Azure. Operated by your team or a partner. | Per GB ingested, with commitment tiers and separate retention charges. | Native connectors for Microsoft 365, Entra and Defender. Strong if your estate is already Microsoft. | Cost tracks log volume, so verbose sources need filtering. Query language (KQL) has a learning curve. Non-Microsoft sources take more work to connect. |
| Splunk | Cloud or self-hosted. Usually operated by a dedicated engineer or SOC. | Per GB ingested per day, with workload-based options for larger deployments. | Mature search, very large app ecosystem, well understood by security hires. | Built and priced for enterprise volumes. At 10-300 people you pay for headroom you will not use and need someone who knows SPL. |
| Elastic Security | Elastic Cloud or self-managed. Your team operates the cluster and the rules. | Resource-based tiers (compute and storage), not per GB ingested. | Fast search, open detection rules, EDR agent included in the same stack. | Cluster sizing and index lifecycle are your problem. Feature tiers decide which detections and integrations you get. |
| MDR service (generic) | The provider's analysts watch alerts, usually 24/7, on their own SIEM or yours. | Per endpoint or per user, often with a minimum contract and the SIEM licence underneath. | Someone watches at 3 a.m. Faster to stand up than any self-run option. | You see what the provider chooses to show. Changing provider means re-onboarding every source. Scope creep on what counts as "in service". |
| Protoxol (our product) | SaaS hosted in the EU or self-hosted. Operated by your IT admin or your MSP from one console. | Per protected endpoint, by plan (Starter, Team, Enterprise). No public price list; quoted on your endpoint count. | SIEM, EDR, NDR, email and credential exposure on one data model. Curated rules maintained by us. Ingests Wazuh, Splunk, Elastic, Suricata, Microsoft 365 and Okta. Support included. | Younger product with a smaller ecosystem than the names above. If you want to write your own detection stack from scratch, open source gives you more rope. |
If two rows look equally good, run the same week of logs through both and count how many alerts a person actually had to read. That number, more than any feature list, tells you which one your team will still be using next year. The SIEM module page lists the connectors and the search syntax if you want to check fit before a demo.
Whichever option you pick, the first month decides whether the SIEM becomes a tool or a tab nobody opens. Four weeks, one job each.
After day 30, add sources one at a time and repeat week 3 for each. The order matters less than the habit. If you want to see how the modules fit together before you start, the platform overview shows how SIEM, EDR and the rest share one timeline.
Most SIEM products assume a dedicated analyst team: heavy query languages, complex licensing and dashboards nobody reads. Small IT teams end up paying for capability they cannot operate.
Protoxol focuses on the workflows a small team actually runs: collect the logs that matter, correlate events automatically and surface the alerts worth acting on — with search fast enough to answer questions in minutes, not afternoons. Book a demo and see it against your own data.
No. Protoxol is designed so an IT team with security responsibility can operate it day to day. Alert triage, investigation context and response steps are built into the console rather than left to expert tooling.
Common infrastructure, endpoint and cloud log sources are supported through connectors and standard formats. We help you prioritize the sources that give real detection value first, so you do not pay to store noise.
Open-source SIEM gets you the engine, not the operation — you still own rule maintenance, scaling and support. Protoxol ships curated, maintained detection rules and a support team behind them, at a predictable per-endpoint cost instead of engineering time. See the full Wazuh comparison.
Yes. Modules activate independently on the same data model, so adding EDR or email protection later means flipping a module on — not a second implementation project.
Connecting your first log sources and getting curated detection rules running typically takes days, not the quarter-long rollouts enterprise SIEM tools require. Exact timing depends on how many sources you're connecting.
The one your team will still be operating in six months. For most small companies that means: per-endpoint pricing rather than per-GB, a console the IT admin can use without a query-language course, and detection rules that are maintained for you. If you have an engineer who wants to own it, an open-source SIEM is a valid answer too.
It depends on the pricing model more than on the vendor. Per-GB SIEMs grow with your logging; MDR adds analyst time; open source costs engineering hours. Protoxol bills per protected endpoint, by plan, so the budget is known in advance. We quote against your real endpoint count; there is no public price list.
If you have neither, start with EDR: it protects the laptops and servers where incidents start and it is faster to deploy. Add SIEM when you need to see identity, email and cloud events in the same timeline. In Protoxol both are modules on the same console, so the order is a choice, not a migration.
30 minutes, your own data, no slideware. We'll show you exactly what alerts look like on day one.