Parts 1 and 2 covered the lake and the compute that reads it. This part covers what it costs: what you pay for, the build most customers start with and the full bill at 1 TB a day.
Building your LogSeam environment
There are times when one size fits all is fine, and credit to anyone who gets that right for 95% of their customers at a price they're willing to pay. We have yet to find the size that fits every team running security operations. One small decision three layers away from the security team can compound the cost of the SOC. Requirements change on a dime, and a contract signed two years ago doesn't stop your usage from changing.
We're also fed up with the cost. Something has to change to make room for the patterns we're already seeing in a post-AI world. Agents are not humans: they don't ask the same questions, they don't work one query at a time, they don't see the data the way we do, and most of the time cost isn't a factor for them.
All of this comes down to one idea: you build whatever scale you need on the platform.
You pay for consumption, the cloud bill, and pay LogSeam support and maintenance for each node in your build. That's it. Core is 8x5 general software support and Critical is 24x7; both include ongoing licensing and updates. We recommend Critical for environments that need 24x7 response.
Here's where most customers start: a baseline of 250 GB of log data a day. That's about 91 TB of raw logs a year, or about 9 TB in the lake at 90% compression. The starting build is five nodes:
With a typical rule set and normal AI usage, that build handles 250 GB a day comfortably, for about $3,200 a month all-in on Core support at on-demand prices, or about $2,600 on a 1-year plan.
Each configuration is billed monthly with no lock-in, so you can go up or come down as your usage does. We're working on going smaller still, but we didn't want to compromise on security, on scale, or on what a platform like this can do for small and mid-sized companies.
Where the savings come from
At 1 TB of raw JSON a day, kept for a year, LogSeam costs about $0.20 per GB all-in on Core support at on-demand prices, or $0.17 on a 1-year plan; on Critical, it's $0.28 or $0.25. That's AWS infrastructure at cost, with dynamic nodes on spot, plus our node fees. Ingest-priced SIEMs cost far more: Microsoft Sentinel, one of the few with public per-GB pricing, lists $4.30 per GB pay-as-you-go and $2.22 to $2.74 per GB on commitment tiers from 200 GB to 10 TB a day (source). At the 1 TB tier, that's about 12 times LogSeam's on-demand price.
In monthly terms, 1 TB a day costs $75,433 on Sentinel's 1 TB commitment tier, about $905,000 a year, and that includes only 90 days of retention:
The bill at 1 TB a day
Compute6 always-on and 5 spot dynamic nodes, which run about 4 hours a day. Ingest runs on general-purpose instances, search and aggregation on compute-optimized ones, all with local NVMe; the master and application database run on standard instances$2,782$1,809
Lake storageA year of data at 90% compression, about 37 TB in S3 Standard, once a full year is kept$840$840
Landing and requestsOne day of raw JSON in the landing bucket, S3 requests and queue messages$82$82
About 61% of the bill is AWS infrastructure at cost; our node fees are the rest. On Critical support the node fees double to $4,750, and the total is $8,454 a month, about $0.28 per GB.
How it moves with volume
Above 1 TB the always-on floor spreads over more data, so per-GB cost keeps falling. Larger builds depend on each customer's sources, retention and query load, so we size them with you.
What's not in the number
- AI. Model usage passes through at cost, or you bring your own keys.
- Colder storage. The whole year is priced at S3 Standard. Moving older data to cheaper storage classes lowers it further.
- Better compression. At 97% instead of 90%, the 1 TB example drops to $0.18 per GB.
Your cloud discount is your discount
This is the part a per-GB SIEM can't answer. Run LogSeam in your own AWS, Azure or Google Cloud account, and the compute and storage are billed to you at your rates. Whatever you've negotiated, whether an enterprise discount, savings plans or reserved capacity, applies to every node and every byte, and the spend counts toward the commitment you already have to burn down.
If your agreement takes 20% off, the 1 TB example drops from $0.20 to $0.18 per GB before we've discounted anything. A per-GB SIEM bills you for its infrastructure plus its margin, and your discount never reaches it.
Pricing basis
As with anything in the cloud, these prices are estimates. There are too many variables for one number to fit everyone, so we've shown every cost line by line; expect yours to move with instance shapes, data and egress. That openness is the point. The alternative is a flat "compute unit" or per-GB price that guarantees the vendor its margin on compute and storage. Open pricing gives you complete control, including the ability to shoot yourself in the foot, and we'll help every customer tune their environment for the right price and performance.
We priced this on AWS. LogSeam runs anywhere with Arm CPUs, object storage and a fast network.
Volume and retention1 TB of raw JSON a day, 90% compression, a year kept
ComputeAWS us-east-1 list prices, dynamic nodes on spot, October 2026
Storage and requestsS3 Standard, a landing bucket, requests and queue messages
LogSeam node fees$250 per always-on node and $175 per dynamic node a month, Core
1-year plansEC2 Instance Savings Plans, one-year term, no upfront
Microsoft SentinelAzure list prices, analytics tier, 90 days of retention included
What's next
These three posts covered the foundation: how logs get in, where they live, how they're searched and what it all costs. Every layer of LogSeam sits on it. Next come the two layers above the lake. The AI covers how one Assistant directs a fleet of specialists across the whole system, under policy. The Work covers how rules, triage, cases, hunts, intel and response run on that data. After those, we'll take on the problems that make security operations different from any other data work, and how we approach managing risk and threats.
Sources: AWS rates for m9gd.2xlarge, c9gd.2xlarge, c9gd.8xlarge, m9g.2xlarge, m9g.xlarge and c9gd.4xlarge; S3 pricing; Microsoft Sentinel pricing.