Security teams picking a SIEM in 2026 are choosing between three very different bets. Splunk is the incumbent that Cisco paid roughly $28 billion to own. Wazuh is the free, open-source XDR-and-SIEM project that keeps showing up in cost-cutting conversations. Elastic Security is the search-native option for teams that already run the Elastic Stack for something else. All three show up on the same shortlists, and all three get compared constantly on Gartner Peer Insights, G2, and CB Insights. Few of those comparisons show real pricing, real licensing terms, and real detection-coverage data side by side. This one does.
The short version: Splunk vs Wazuh vs Elastic Security isn’t a contest with one winner. It’s a budget-versus-engineering-time tradeoff, and the right answer depends on how much data you’re ingesting, how many people you have to tune detections, and whether you’re already locked into an ecosystem. Below is the full breakdown, built from vendor pricing pages, Splunk’s and Elastic’s own case studies, Cisco’s acquisition announcement, and CardinalOps’ 2025 detection-coverage research.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Splunk, Wazuh, and Elastic Security Actually Are
Before the numbers, it helps to be precise about what each product actually is, because they aren’t three versions of the same thing. They’re three different architectures that happen to compete for the same security budget.
Splunk: The Commercial SIEM Standard
Splunk is a commercial data platform with Splunk Enterprise Security layered on top as its SIEM product. It has been named a Leader in Gartner’s Magic Quadrant for Security Information and Event Management for ten consecutive years as of the 2024 report, and Splunk says it was positioned highest of all vendors in Ability to Execute in that report. Splunk is now a Cisco business unit following Cisco’s acquisition, which closed in March 2024, and it remains the reference point every other SIEM gets measured against, for better or worse.
Wazuh: Open Source XDR and SIEM
Wazuh is a free, open-source security platform that combines host-based intrusion detection, log analysis, file integrity monitoring, vulnerability detection, and SIEM-style correlation in one agent-based system. It’s licensed primarily under GPLv2, with some components under the Apache License 2.0. The project ships on a fast cadence: 4.14.5 went stable on April 23, 2026, 4.14.6 followed July 1, 2026, and 4.14.7 landed July 29, 2026, while a 5.0.0 Beta 2 announced May 21, 2026 signals a bigger architecture revamp on the way. Wazuh doesn’t build its own search engine from scratch. It stores and indexes data using the Elastic Stack or OpenSearch underneath, which is a detail that surprises people the first time they read the architecture docs. The Wazuh GitHub repository is the project’s development home, and it has become the default answer whenever a security engineer asks “is there a free Splunk alternative that isn’t a toy.”
Elastic Security: Search-Native Detection
Elastic Security is Elastic’s security layer on top of the Elastic Stack (Elasticsearch, Kibana, and the various Beats/Elastic Agent shippers). It’s built by Elastic N.V., which trades on NASDAQ under the ticker ESTC. Elastic Security’s pitch is that if you’re already running Elastic for observability, logging, or search, adding security detection is an incremental step rather than a whole new platform purchase. Core SIEM and detection features are available in Elastic’s free/Basic self-managed tier, while Platinum and Enterprise tiers add machine learning-based analytics and cross-cluster search.
Splunk vs Wazuh vs Elastic Security: Full Specs Comparison
Here’s the side-by-side breakdown across the specs that actually change a buying decision, pulled from each vendor’s own documentation and pricing pages.
| Spec | Splunk | Wazuh | Elastic Security |
|---|---|---|---|
| License model | Commercial, proprietary | Open source (GPLv2, some components Apache 2.0) | Free/Basic self-managed tier, paid Gold/Platinum/Enterprise tiers |
| Parent company | Cisco (acquired March 2024) | Wazuh Inc. | Elastic N.V. (NASDAQ: ESTC) |
| Core pricing model | Ingest-based (per GB/day) or workload-based (SVCs) | Free to self-host; no confirmed official cloud price card | Consumption/resource-based (compute + storage, or VCUs for serverless) |
| Entry cost | Quote-based; no public list price for the core platform | $0 to self-host | $0 for self-managed Basic tier |
| Deployment options | Splunk Cloud (SaaS), Splunk Enterprise (self-managed), hybrid | Self-hosted on any infrastructure you choose; Wazuh-hosted options exist | Elastic Cloud Hosted, Elastic Cloud Serverless, self-managed |
| Query / detection language | SPL (Search Processing Language) | Custom rule and decoder syntax (XML-based) | KQL for search/filtering, EQL for sequence-based detections |
| Search/storage backend | Proprietary Splunk indexers | Elastic Stack or OpenSearch (Wazuh doesn’t build its own) | Elasticsearch (native) |
| Pre-built integrations | 2,400+ apps on Splunkbase | No official marketplace count published | 400+ integrations in Elastic’s catalog |
| Latest Gartner SIEM MQ standing | Named Leader, 10th consecutive year (2024 report) | Reviewed on Gartner Peer Insights; not named a formal MQ Leader in available research | Reviewed on Gartner Peer Insights; not named a formal MQ Leader in available research |
| Compliance/reporting modules | Built into Enterprise Security add-on | Built-in compliance mapping (PCI DSS, HIPAA, GDPR, NIST) | Available via detection rules and dashboards, less turnkey out of the box |
| Typical buyer profile | Large enterprises, regulated industries, existing SOC teams | Cost-conscious teams, MSSPs, compliance-driven mid-market, home labs | Teams already using Elastic for observability or search |
| Named public case study | Airbus | No verified named enterprise case study found in research | Comcast |
A few of those rows deserve context. The “entry cost” row looks lopsided, but that’s accurate: Splunk genuinely does not publish a list price for its core SIEM product, Wazuh genuinely costs nothing to run yourself, and Elastic genuinely gives away real detection functionality in its free tier. That asymmetry drives almost every other decision in this comparison.
Pricing Breakdown: What Splunk, Wazuh, and Elastic Security Actually Cost
Pricing is where this comparison gets genuinely messy, and it’s worth being upfront about that instead of pretending there’s a clean price sheet. Splunk in particular does not publish simple per-GB numbers. What exists publicly is a set of planning guides and reseller estimates that vary depending on contract size, commitment length, and which product line you’re pricing — Expanso’s 2026 pricing guide, drawing on September 2025 data, pegs base Splunk ingest at roughly $150/GB/day before Enterprise Security is layered on top.
| Platform | Tier / Product | Reported Price | Billing Basis |
|---|---|---|---|
| Splunk | Cloud / Enterprise ingest pricing | Roughly $100-$225/GB/day at list, per multiple 2026 planning guides | Per GB ingested per day, annual contract |
| Splunk | Workload pricing (SVCs) | Roughly $55,000-$75,000 per Splunk Virtual Compute unit per year | Compute-based, not ingest-based |
| Splunk | Enterprise Security add-on | Adds roughly $20-$45/GB/day on top of base platform cost | Add-on to ingest pricing |
| Splunk | Enterprise agreement discounts | 25%-70% off list, reported at multi-year and high-volume (1TB+/day) commitments | Negotiated |
| Splunk | Observability Cloud (separate product) | $15/host/month (Infrastructure), $60/host/month (App & Infrastructure), $75/host/month (End-to-End) | Per host, billed annually; free up to 15 hosts |
| Wazuh | Self-hosted core platform | $0 – open source, no license fee | You cover your own infrastructure and staff time |
| Wazuh | Wazuh Cloud (third-party estimate, not an official Wazuh price card) | Approximately $0.16/agent/day per one third-party source | Per agent, per day (unverified against an official Wazuh source) |
| Elastic Security | Free/Basic self-managed | $0 – core SIEM and detection features included | Self-hosted, no license cost |
| Elastic Security | Gold / Platinum / Enterprise self-managed | Quote-based; Platinum adds ML analytics and cross-cluster search | Subscription tier |
| Elastic Security | Elastic Cloud Hosted / Serverless | Consumption-based: compute + storage, or ingest/search/ML VCUs plus storage | Usage-based, no fixed monthly minimum on Serverless |
One useful directional data point on real-world Splunk cost: a vendor benchmark cited in 2026 planning guides puts a 100 GB/day Splunk Enterprise Security deployment at roughly $220,000-$310,000 per year at list price, before any enterprise discount is applied. Shattered.io’s June 2026 estimates land in the same range, pricing base Splunk Enterprise at roughly $150/GB/day against Wazuh’s $0/year software license, with Enterprise Security adding about $30/GB/day more to push the fully loaded Splunk ES rate to around $180/GB/day. That’s not a Splunk price card, it’s an estimate, but it lines up with the ingest-plus-ES-addon math above, and it’s the number that tends to shock security leaders comparing Splunk against a $0 Wazuh deployment for the first time. The gap closes somewhat once you account for the engineering hours Wazuh and self-managed Elastic require, which we get into in the use-case section below.
Total Cost of Ownership: What the Sticker Price Doesn’t Show
Every pricing table above understates the real cost of running any of these three platforms, because license fees and ingest charges are only part of the bill. The rest shows up in headcount, retention policy, and how much of your data actually needs to sit in hot storage.
For Splunk, the visible cost is the ingest or workload fee, but the less visible cost is retention. Splunk Cloud’s commonly cited hot/warm retention window in 2026 planning guides is around 90 days, and extending that window for compliance purposes costs extra on top of the base contract. Add specialized SPL expertise, which commands a premium in the job market precisely because Splunk is proprietary, and the fully loaded cost of a Splunk deployment routinely runs well above whatever number appears on the ingest pricing line alone.
For Wazuh, the license line is $0, but that number hides the labor of standing up and maintaining the Elastic Stack or OpenSearch backend underneath it, writing custom decoders for anything outside Wazuh’s native integrations, and handling your own uptime and scaling without a vendor SLA unless you separately contract support. There’s no published, vendor-neutral benchmark for how many engineer-hours a typical Wazuh deployment consumes per month, and we won’t invent one here, but every security leader who has run Wazuh in production will tell you the number isn’t zero.
For Elastic Security, the risk is the opposite of Splunk’s: consumption-based pricing means costs can creep upward quietly if index lifecycle management policies aren’t tuned to age data out of expensive hot storage tiers on schedule. Teams that treat Elastic Cloud’s free tier as a permanent home for growing production log volume are usually the ones surprised by their first real invoice once they cross into paid Gold or Platinum territory for the machine learning features they actually wanted.
Licensing Models Compared
Licensing is the root cause of almost every other difference on this list. Splunk is closed-source and commercial from top to bottom: you’re renting the platform, and Cisco (as of the March 2024 acquisition close) controls the roadmap. There is no free tier of Splunk Enterprise Security that’s viable at production scale, though a free version of Splunk Enterprise does exist for very small ingest volumes.
Wazuh sits at the opposite end. It’s released under GPLv2, meaning you can self-host, modify, and redistribute it under the terms of that license, with certain components carrying Apache License 2.0 terms. There’s no vendor lock-in in the licensing sense, though you do inherit an operational dependency on the Elastic Stack or OpenSearch underneath, since Wazuh uses one of those as its storage and search layer rather than building its own.
Elastic Security is the hybrid case. Parts of the Elastic Stack carry the Server Side Public License and the Elastic License rather than a pure open-source license, but Elastic’s own tier structure still makes core SIEM and detection functionality available for free in self-managed Basic deployments. You don’t pay a license fee to get real detection rules running on Elastic. You pay when you want managed hosting, machine learning-driven analytics, or enterprise support.
Architecture and Deployment: Cloud, On-Prem, and Hybrid
All three platforms now support cloud, on-prem, and hybrid deployment, but the path to each looks different. Splunk Cloud is Splunk’s fully managed SaaS offering, while Splunk Enterprise is the self-managed version you run on your own infrastructure. Large customers frequently run both in a hybrid split, keeping sensitive data on-prem and less sensitive telemetry in Splunk Cloud.
Wazuh is self-hosted by default. You deploy the Wazuh manager, indexer, and dashboard on infrastructure you control, whether that’s bare metal, a VM, or containers. Wazuh Inc. does offer hosted options, but the overwhelming majority of Wazuh deployments referenced across community forums, comparison sites, and vendor case studies are self-managed, which is consistent with why it shows up so often in home-lab and small-SOC contexts.
Elastic gives you the most explicit menu: Elastic Cloud Hosted for traditional managed clusters, Elastic Cloud Serverless for a fully consumption-based model with no cluster management at all, or self-managed for teams that want to run Elasticsearch and Kibana themselves, typically alongside an existing on-prem Elastic footprint used for logging or observability.
Detection Engineering: SPL vs KQL/EQL vs Wazuh Rules
This is the part of the Splunk vs Wazuh vs Elastic Security decision that doesn’t show up on a pricing page but ends up mattering just as much day to day: how your analysts actually write detections.
Three Different Detection Languages
Splunk analysts write SPL (Search Processing Language) searches, correlation searches, and saved searches. It’s a mature, pipe-based query language with a large body of existing community content and Splunk’s own detection library to draw from. Elastic Security analysts split their work between KQL (Kibana Query Language) for filtering and search, and EQL (Event Query Language) for sequence-based detections, like catching a specific chain of process-creation events. Wazuh uses its own rule-and-decoder model: detections are XML-based rules tied to specific log fields and decoders rather than a general-purpose query language.
There’s no published, apples-to-apples benchmark comparing the expressiveness or analyst efficiency of SPL versus KQL/EQL versus Wazuh’s rule syntax, and it would be dishonest to invent one. What is true from the underlying architecture is that Wazuh’s rule model is more constrained and less exploratory than SPL or EQL, which is exactly why Wazuh leans on the Elastic Stack or OpenSearch underneath for the ad hoc search and visualization Splunk and Elastic both offer natively.
MITRE ATT&CK Coverage: The Reality Check
MITRE doesn’t run ATT&CK Evaluations for SIEM platforms the way it does for endpoint detection and response tools like CrowdStrike, Microsoft Defender, or SentinelOne. There’s no annual MITRE bake-off that scores Splunk against Wazuh against Elastic Security head to head. Instead, the industry standard is ATT&CK coverage mapping: analysts map a SIEM’s actual detection rules to specific ATT&CK techniques and sub-techniques, then measure how much of the framework is genuinely covered by working detections.
The most useful data point here comes from CardinalOps’ fifth annual State of SIEM Detection Risk report, covered by Help Net Security in June 2025. Averaged across enterprise SIEM deployments, the report found detection coverage for only 21% of MITRE ATT&CK techniques, up just 2 percentage points year over year. The paradox in that report is worth repeating: those same SIEMs process an average of 259 log types and nearly 24,000 unique log sources, enough telemetry to detect more than 90% of ATT&CK techniques, but manual, error-prone detection engineering leaves most of that potential coverage unrealized. The same report found that roughly 13% of existing detection rules across surveyed SIEMs don’t fire at all, due to misconfigured data sources or missing log fields.
That finding matters more than any vendor-vs-vendor benchmark for one reason: it applies regardless of which of these three platforms you buy. A well-tuned Wazuh deployment can outperform a poorly-tuned Splunk instance on real ATT&CK coverage, and vice versa. The platform is not the bottleneck. Detection engineering discipline is.
Benchmarks and Analyst Positioning
Pulling together the analyst and third-party data points that actually carry weight in a 2026 buying decision:
| Benchmark | Data Point | Source |
|---|---|---|
| Gartner Magic Quadrant for SIEM (2024) | Splunk named a Leader for the 10th consecutive time; positioned highest in Ability to Execute | Splunk press release, May 2024 |
| Average ATT&CK technique coverage | 21% of MITRE ATT&CK techniques covered by working detections, up 2 points year over year | CardinalOps via Help Net Security, June 2025 |
| Non-functional detection rules | Roughly 13% of existing SIEM detection rules never fire due to misconfiguration | CardinalOps via Help Net Security, June 2025 |
| Integration ecosystem size | Splunkbase: 2,400+ apps. Elastic: 400+ integrations. Roughly a 6x gap. | Splunkbase / Elastic integrations catalog |
| Acquisition valuation | Cisco acquired Splunk for approximately $28 billion in equity value ($157/share cash) | Cisco newsroom, March 2024 |
Notice what’s missing from that table: a standardized, published benchmark for time-to-deploy across the three platforms, a headcount/staffing requirement study, and a 2025-2026 buyer-priority survey ranking cost against ease-of-use against detection accuracy. None of those exist as citable, vendor-neutral research as of this writing. Any article that hands you exact numbers for those categories is making them up, and we’d rather tell you the gap exists than invent a stat to fill it.
Integrations and Ecosystem Size
Splunk’s ecosystem advantage is real and quantifiable: Splunkbase lists more than 2,400 apps and add-ons, covering everything from niche firewall parsers to full compliance dashboards, most of them built by the community or technology partners over the platform’s 20-plus year history. Elastic’s integrations catalog lists more than 400 integrations, a meaningfully smaller number, but one that covers the common data sources most security teams actually need (cloud provider logs, common EDR agents, network telemetry) rather than the long tail of niche Splunk apps.
Wazuh doesn’t publish a marketplace-style integration count the way Splunk and Elastic do. Its integration model works differently: Wazuh ships with native support for common log sources and cloud APIs (AWS, Azure, GCP, Office 365, and standard syslog/Windows Event Log sources are the common ones referenced across Wazuh’s documentation and community deployments), and anything beyond that typically means writing a custom decoder rather than installing a pre-built app. That’s a real trade-off: fewer one-click integrations, more flexibility for teams willing to write their own parsing rules.
The practical effect of that 2,400-versus-400 gap shows up earliest in time-to-first-value, not in long-term capability. A team standing up Splunk against a common data source is more likely to find a pre-built Splunkbase app that does 80% of the parsing work out of the box. A team standing up Wazuh or Elastic Security against an unusual internal application log format is more likely to be writing that parsing logic itself, regardless of which of the two open platforms it picks. Neither approach is wrong. It’s a question of whether your team would rather pay for someone else’s integration work or build institutional knowledge of your own log formats in-house.
Real-World Deployments: Where Each Platform Actually Shows Up
Vendor-published case studies and common deployment patterns tell you more about fit than any spec sheet. Here’s where each platform actually gets used in practice.
- Airbus runs Splunk as a named customer in Splunk’s own case study library, a useful data point for how the platform performs at large, engineering-heavy, highly regulated organizations with the budget to match.
- Comcast uses Elastic for security and observability use cases, according to Elastic’s own published customer stories, illustrating the common pattern of a large enterprise adopting Elastic Security as an extension of an existing observability investment rather than a standalone purchase.
- Small security teams and home-lab practitioners lean on Wazuh almost by default, because it’s the only one of the three that gets you real host-based intrusion detection, file integrity monitoring, and SIEM correlation running on a single VM for zero license cost.
- Compliance-driven mid-market companies (think healthcare providers needing HIPAA logging, or e-commerce companies needing PCI DSS evidence) frequently choose Wazuh specifically for its built-in compliance rule mapping, trading engineering time for licensing savings.
- Managed security service providers (MSSPs) gravitate toward Elastic Security or Wazuh in multi-tenant setups, since per-GB commercial SIEM pricing gets punishing fast when you’re aggregating log volume across dozens of client environments.
- Large regulated enterprises with existing SOC investment tend to stay on Splunk even after evaluating cheaper alternatives, because the migration cost of rewriting years of SPL-based detections, dashboards, and compliance reports usually outweighs the licensing savings on paper.
That last point comes up constantly in Splunk vs Wazuh vs Elastic Security discussions on Gartner Peer Insights and G2: the platform switching cost is frequently bigger than the platform’s sticker price.
Cisco’s Acquisition of Splunk: What Changed for Buyers
Cisco announced its acquisition of Splunk on September 21, 2023, agreeing to pay $157 per share in cash, a deal the two companies valued at approximately $28 billion in equity value. The deal officially closed on March 18, 2024, according to Cisco’s own newsroom announcement, making it one of the largest security-software acquisitions in recent history and folding one of the two biggest commercial SIEM vendors into a networking giant’s security portfolio.
For buyers, the practical questions since the close have centered on roadmap continuity and cross-selling pressure: will Cisco push Splunk customers toward Cisco’s own security stack (Cisco XDR, Secure Firewall, and related products), and will pricing shift as Splunk integrates into Cisco’s sales motion. Splunk’s SIEM product continued to earn Gartner Leader recognition in the 2024 Magic Quadrant published after the deal’s announcement, which suggests continuity in the core product’s market position, at least through that report cycle. Beyond that, Cisco has not published detailed 2025-2026 product roadmap changes specific to Splunk’s SIEM line in sources available for this article, so any claim about post-acquisition pricing or roadmap shifts beyond what’s cited here should be treated as unconfirmed.
Migration Guide: Moving Between Splunk, Wazuh, and Elastic Security
Migrating a production SIEM is never a weekend project, regardless of direction. The core work is the same whether you’re moving off Splunk to cut cost, or moving onto Splunk because you outgrew a self-managed platform: you have to re-platform data ingestion, rebuild or translate detection rules, and preserve enough historical data to satisfy your compliance retention window. Here’s the sequence that keeps this from turning into an outage.
- Inventory your current detections before touching anything. Export every SPL correlation search, EQL rule, or Wazuh decoder you actively rely on, and tag each one with the ATT&CK technique it’s supposed to cover.
- Stand up the new platform in parallel, not in place of the old one. Run both SIEMs side by side against live data for at least one full compliance reporting cycle before decommissioning anything.
- Re-route log sources one category at a time. Start with your highest-volume, lowest-risk sources (like DNS or firewall logs) rather than your most sensitive telemetry, so early mistakes are cheap.
- Translate detections manually, don’t trust automated converters for anything security-critical. SPL, EQL, and Wazuh’s rule syntax don’t map one-to-one. A detection that catches a specific technique in SPL may need a fundamentally different approach in Wazuh’s decoder model.
- Migrate historical data last, and only what your retention policy actually requires. Most compliance frameworks care about retention windows (often 90 days to a year), not permanent archives, so don’t over-engineer this step.
- Run a detection parity test before cutover. Replay a known set of test events (or use a breach-and-attack-simulation tool) against both platforms and confirm the new one catches everything the old one did.
- Decommission the old platform in stages, starting with ingestion, not storage. Stop sending new data first, keep the old platform queryable in read-only mode for your final audit cycle, then retire it.
The example below illustrates, at a simplified level, how the same detection logic (catching repeated failed logins followed by a success, a classic brute-force pattern) tends to look conceptually different across the three rule models. This is illustrative pseudo-syntax for comparison purposes, not a copy-paste production rule for any of the three platforms.
-- Splunk (SPL) — conceptual example
index=auth (action=failure)
| stats count as fails by user, src_ip
| where fails > 5
| join user [ search index=auth action=success ]
// Elastic Security (EQL) — conceptual example
sequence by user.name with maxspan=5m
[authentication where event.outcome == "failure"] with runs=5
[authentication where event.outcome == "success"]
<!-- Wazuh — conceptual rule/decoder structure -->
<rule id="100210" level="10" frequency="5" timeframe="300">
<if_matched_sid>5716</if_matched_sid>
<description>Multiple failed logins followed by success</description>
</rule>The point of that comparison isn’t syntax trivia. It’s that every detection you’ve written has to be reconceived, not just reformatted, when you migrate between these three platforms. Budget real analyst time for that step. It’s consistently the most underestimated part of any SIEM migration.
Use Cases: Which SIEM Fits Which Team
Rather than a single verdict, here’s how the decision tends to shake out by team profile, based on the pricing, licensing, and deployment realities covered above.
- Cash-strapped startup or solo security engineer: Wazuh. Zero license cost, real detection capability, and a large enough community that most common problems already have a documented fix.
- Large regulated enterprise with an existing SOC and Splunk investment: Stay on Splunk. The Gartner Leader track record and 2,400+ app ecosystem reduce risk, and the migration cost of leaving usually exceeds the licensing premium.
- Mid-market company needing PCI DSS, HIPAA, or GDPR evidence on a tight budget: Wazuh, specifically for its built-in compliance rule mapping, assuming you have (or can hire) the engineering time to tune it.
- Organization already running the Elastic Stack for logging or observability: Elastic Security. Adding detection to infrastructure you already operate is cheaper than standing up a second platform from scratch.
- MSSP running multi-tenant detection across many client environments: Elastic Security or Wazuh. Commercial per-GB SIEM pricing compounds quickly across aggregated client log volume in a way that makes open-source or consumption-based pricing much more defensible.
- Enterprise that wants both cost control and commercial support: A hybrid approach, running Wazuh or self-managed Elastic for high-volume, low-sensitivity log sources, and Splunk for the smaller set of high-value data that justifies premium ingest pricing.
Pros and Cons of Each Platform
Splunk
Pros: Ten consecutive years as a Gartner SIEM Leader, the largest integration ecosystem of the three (2,400+ Splunkbase apps), mature SPL tooling with a huge body of existing community detections, and enterprise-grade support backed by Cisco. Cons: No public list pricing for the core SIEM product, ingest-based costs that can run into the hundreds of thousands of dollars annually at moderate data volumes, and a steep price jump once Enterprise Security is added on top of base ingest costs.
Wazuh
Pros: Completely free to self-host under GPLv2, strong built-in compliance rule mapping, active open-source community, and no per-GB ingest penalty for scaling log volume. Cons: No official public cloud price card (only third-party estimates), no marketplace-style integration count to point to, a rule syntax that’s less flexible than SPL or EQL for ad hoc hunting, and a real engineering-time cost that “free” pricing doesn’t capture on a spec sheet.
Elastic Security
Pros: Real detection functionality in a genuinely free self-managed tier, consumption-based cloud pricing with no monthly minimum on Serverless, and a natural fit for teams already using the Elastic Stack elsewhere. Cons: Smaller integration catalog than Splunk (400+ versus 2,400+), pricing tier naming that’s inconsistent across Elastic’s own documentation (Basic/Gold/Platinum/Enterprise versus Standard/Gold/Platinum/Enterprise), and less turnkey compliance reporting out of the box compared to Wazuh or Splunk’s Enterprise Security add-on.
The Verdict: Which SIEM Wins in 2026
There’s no single winner in Splunk vs Wazuh vs Elastic Security, and any comparison article that hands you one is oversimplifying a genuinely multi-variable decision. But the data does point to clear defaults by scenario.
If budget is not the constraint and you need the broadest integration ecosystem, the deepest bench of existing detections, and a decade-plus track record of Gartner Leader recognition, Splunk remains the safest institutional choice, and its 2,400+ Splunkbase apps versus Elastic’s 400+ integrations (a roughly 6x gap) is the clearest quantifiable edge it holds. If your constraint is budget rather than engineering time, and you’re willing to invest in tuning, Wazuh delivers real SIEM and XDR capability for zero license cost, with the caveat that “free” doesn’t mean “free to operate well.” If you’re already running the Elastic Stack for logs or observability, Elastic Security is the lowest-friction add, particularly given its consumption-based pricing and genuinely functional free tier. That rough hierarchy tracks third-party scoring too: InsideCyber’s March 2026 SIEM roundup rated Splunk 9.3/10, Elastic Security 9.0/10, and Wazuh 8.5/10, a tight spread that says more about how close these three platforms are on raw capability than it does about which one is “best.”
The one number that should anchor every version of this decision is the CardinalOps finding that enterprise SIEMs, on average, cover only 21% of MITRE ATT&CK techniques, regardless of vendor. Buying Splunk instead of Wazuh, or Elastic instead of Splunk, will not fix that gap by itself. Detection engineering discipline closes it. Platform choice just determines what that discipline costs you in dollars versus headcount.
Frequently Asked Questions
Is Wazuh really free, or are there hidden costs?
The software itself is free under GPLv2, with no license fee for self-hosting. The hidden cost is engineering time: someone on your team has to deploy, tune, and maintain it, which is a real cost even though it doesn’t show up on an invoice.
Can Wazuh replace Splunk entirely?
For many mid-market and compliance-driven use cases, yes. For large enterprises relying on Splunk’s 2,400+ app ecosystem, years of accumulated SPL detections, and Enterprise Security’s turnkey compliance reporting, a full replacement is a significant re-engineering project, not a drop-in swap.
Does Elastic Security require the paid Platinum tier to be useful?
No. Core SIEM and detection features are available in Elastic’s free/Basic self-managed tier. Platinum and Enterprise tiers add machine learning-based analytics and cross-cluster search rather than gatekeeping basic detection capability.
How much does Splunk actually cost for a mid-sized company?
There’s no single answer because Splunk doesn’t publish list pricing for its core SIEM product. Planning guides commonly cited in 2026 put ingest pricing in the $100-$225/GB/day range before discounts — Expanso’s 2026 guide anchors a representative rate around $150/GB/day as of September 2025 — with Enterprise Security adding another $20-$45/GB/day on top (Shattered.io’s June 2026 estimate puts that add-on closer to $30/GB/day, for an all-in ES rate near $180/GB/day). A 100 GB/day deployment with Enterprise Security has been estimated at roughly $220,000-$310,000 per year at list price, though real contracts frequently land well below list after enterprise discounts.
Did Cisco change Splunk’s pricing after the acquisition?
There’s no confirmed, sourced evidence of a specific post-acquisition pricing overhaul as of this writing. Splunk’s SIEM product retained its Gartner Leader status in the 2024 Magic Quadrant, published after the deal closed, which suggests continuity in the product’s market position through that reporting cycle.
Does MITRE score Splunk, Wazuh, and Elastic Security against each other?
No. MITRE runs ATT&CK Evaluations for endpoint detection tools like CrowdStrike, Microsoft Defender, and SentinelOne, not for SIEM platforms. SIEM detection quality is instead assessed through ATT&CK coverage mapping, like the CardinalOps methodology cited throughout this article.
What’s the biggest mistake teams make when migrating SIEM platforms?
Assuming detections can be automatically converted between platforms. SPL, EQL, and Wazuh’s rule syntax don’t map one-to-one, and treating migration as a translation exercise rather than a re-engineering one is the most common cause of coverage gaps after cutover.
Which platform has the most third-party integrations?
Splunk, by a wide margin. Splunkbase lists more than 2,400 apps and add-ons, compared to Elastic’s 400+ integrations. Wazuh does not publish a comparable marketplace count, relying instead on native connectors and custom decoders.
Can I run Wazuh and Elastic Security together instead of choosing one?
Yes, and many deployments already do, whether intentionally or not. Wazuh uses the Elastic Stack or OpenSearch as its own storage and search layer, so a Wazuh deployment already depends on one of those two engines underneath. Some teams extend that relationship deliberately, using Wazuh for host-based detection and compliance rules while relying on a separate, more fully featured Elastic Security or Kibana setup for broader log search and dashboards.
Is Splunk, Wazuh, or Elastic Security best for a small business with one IT person?
Wazuh is the most common recommendation in this scenario, mainly because it removes licensing cost from the equation entirely and has a large enough community that a solo IT generalist can usually find a documented answer to common configuration problems. Splunk’s ingest-based pricing and Elastic’s consumption-based pricing both carry more financial risk for a team without a dedicated security engineer to monitor usage and tune retention settings.
For broader coverage of ransomware, zero-days, and enterprise security tooling, see tech-insider.org’s full cybersecurity section.
