More MSSPs Are Ditching Licensed SIEMs to Build Their Own Security Platforms

Managed security service providers (MSSPs) are increasingly moving away from commercial SIEM platforms like Splunk, Microsoft Sentinel, and IBM QRadar due to unsustainable per-gigabyte pricing models that scale with client data volume rather than provider revenue. Commercial SIEMs typically charge €1–€4 per GB per day, and costs compound further because true multi-tenant support is often absent, forcing MSSPs to run separate instances and licenses per client. Regulatory frameworks such as NIS2 and DORA are also extending data retention requirements for EU clients, adding to storage costs that do not appear on vendor pricing pages until renewal time. As an alternative, a growing number of MSSPs are partnering with engineering firms to build custom SIEM and SOAR stacks they fully own, shifting from variable per-GB costs to largely fixed infrastructure expenses. While building takes months versus weeks for licensed deployment, the economics favor ownership once an MSSP scales past a critical number of tenants or data volume thresholds.