The traditional SIEM has a business model, and the business model has a consequence: because the vendor charges by the gigabyte ingested, every new log source your environment produces arrives with a price tag attached. Security telemetry grows with your business — every new SaaS application, every new cloud account, every new endpoint fleet emits more of it. Risk does not grow at the same rate. Your SIEM bill tracks the telemetry, not the risk. That divergence is not a pricing quirk. It quietly reshapes what your security team is allowed to see.
The ingestion tax
Ingestion pricing turns every visibility decision into a procurement decision. Want the DNS logs? That is a line item. Full cloud audit trails across all accounts? A bigger line item. Verbose endpoint telemetry instead of summarized events? Bigger still. The perverse structure is that the data most useful in an investigation — high-volume, low-signal telemetry like DNS queries, flow logs, and process events — is exactly the data the meter punishes most. Teams respond rationally: they onboard the cheap sources, sample or summarize the expensive ones, and shorten retention on everything.
The result is a SIEM that contains a curated subset of the evidence, curated by budget rather than by investigative value. When an incident lands, the first discovery is often what was never collected.
Visibility becomes a budget decision
Say it plainly: under ingestion pricing, the CFO co-authors your detection coverage. Not deliberately — no finance team sets out to blind the SOC — but structurally, because every log source must justify its recurring cost before it is connected. Coverage gaps stop being oversights and become approved outcomes of a budgeting cycle. This is the same dynamic we document across cloud operations generally, where governance lags the estate it governs; Flexera's 2026 State of the Cloud Report puts wasted enterprise cloud spend at 29%, and duplicated telemetry pipelines are a quiet contributor to that figure.
When visibility is metered, coverage gaps are no longer accidents. They are line items that lost a budget argument.
The second-copy problem
Ingestion has a second cost that rarely appears in the vendor's pricing calculator: it creates a full duplicate of your security-relevant data inside someone else's platform. That second copy is expensive in three distinct ways:
- Egress and transport. Moving high-volume telemetry out of cloud platforms incurs transfer costs and demands pipeline engineering — collectors, forwarders, parsers — that must itself be built, monitored, and maintained.
- Security surface. A concentrated copy of your logs — authentication events, email metadata, endpoint activity — is one of the most attractive targets an attacker could ask for. You now defend the original and the replica.
- Retention duplication. The source platforms already retain this data — Sentinel, Splunk, Elastic, and cloud-native stores each have their own retention. Ingesting it into a SIEM means paying twice to store the same events, and reconciling two retention policies per source forever.
Compliance regimes compound the problem. Data residency, privacy law, and sector rules all attach to that second copy. In regulated environments, the replica is not just costly — it may be the hardest artifact in the architecture to justify.
Zero-ingestion federation
The alternative is architectural, not promotional: stop centralizing the data and centralize the investigation instead. Zero-ingestion federation, the model Trace8 is built on, queries your existing platforms — Sentinel, Splunk, Elastic, and the rest — in place, through read-only connections, at the moment an investigation needs the evidence. Nothing is replicated. No raw log ever persists in the platform. What Trace8 stores is the output of investigation: AI-generated case files — the queries run, the evidence found, the reasoning, the verdict — which are smaller than the raw telemetry by orders of magnitude.
Three properties follow directly. The data stays where its residency, retention, and access controls already live. The connection is read-only, so the investigative layer cannot alter the evidence it examines. And the marginal cost of covering a new log source falls to approximately zero — a credential and a connector, not a recurring gigabyte commitment.
The cost model, side by side
| Cost dimension | Ingestion-based SIEM | Zero-ingestion federation |
|---|---|---|
| Pricing driver | Volume of data ingested per day | Investigations performed |
| Cost of a new log source | Recurring, proportional to its volume | Marginal; a read-only connection |
| Storage | Full second copy of raw telemetry | Case files only; raw data stays at source |
| Egress and pipelines | Continuous transport, parsing, maintenance | Query-time reads; no standing pipeline |
| Retention | Paid twice — source and SIEM | Paid once, at the source, under existing policy |
| Security surface | Original plus a concentrated replica | Original only |
| Scaling behavior | Bill grows with telemetry volume | Bill grows with investigative work |
What this changes about coverage decisions
Once the ingestion meter is gone, the question "should we connect this log source?" loses its budget dimension and regains its security dimension. The answer becomes: does this source hold evidence an investigation might need? For almost every source, the answer is yes — which is why, under zero-ingestion economics, the rational coverage posture flips from minimal to maximal. The high-volume telemetry that ingestion pricing priced out — DNS, flows, verbose endpoint events — comes back into scope precisely because nobody is paying to move and re-store it.
This matters most for the standard we argue for in Every Alert Investigated: investigating everything requires being able to see everything, and seeing everything must not cost everything. It is also one of the ten structural questions we recommend putting to any vendor in The AI SOC Buyer's Guide — because a platform's pricing model is the most honest description of its architecture you will ever get.
CAELION builds Trace8, the AI-native SIEM replacement built on zero-ingestion federation: eight Frame Agents investigate every alert against your data where it lives, read-only, persisting only the case file. Run the cost model against your own telemetry footprint in a private briefing.