# Security Analytics Market

> Security analytics market: USD 18.0 billion in 2025, rising 10.21% a year to USD 47.6 billion by 2035 as breach costs, platform consolidation and cheaper data lakes add buyers.

Publisher: Douglas Insights  
Author: Douglas Insights Research Desk  
Report code: DI-IT-10867  
Published: 2026-11-06  
Last updated: 2026-11-06  
Next review: May 2027  
Page: https://www.douglasinsights.com/security-analytics-market/

## Key figures

| Measure | Value | How it is built |
| --- | --- | --- |
| Market size · 2025 | $18.0 Bn | About 120,000 organisations x USD 150,000 = USD 18.0 billion. |
| Forecast · 2035 | $47.6 Bn | Base case: 7.0% organisations and 3.0% spend a year. |
| Revenue CAGR · 2026–2035 | 10.21% | (1.070 x 1.030) minus 1. |
| Volume · 2035 | About 236,000 organisations | Breach costs, platform consolidation, cheaper data lakes and mid-market adoption, less legacy churn, alert overload and data bills. |
| Leading segment | SIEM, 44.0% | USD 7.92 billion to USD 16.0 billion. |
| Fastest segment | Security data pipelines and lakes, 15.0% | USD 1.98 billion to USD 8.01 billion. |
| Leading region | North America, 44.0% | US breach average USD 10.22 million in 2025, IBM. |
| Market leader | Cisco (Splunk), about 17% (estimate) | Douglas Insights estimate; Cisco (Splunk) about 17%, Microsoft 14%, Palo Alto Networks 9%. |
| Event | Breach cost USD 4.99 million | IBM 2026 study: average breach cost USD 4.99 million, one in four malicious breaches AI-enabled. |

## Key takeaways

- The security analytics market is worth USD 18.0 billion in 2025 and USD 47.6 billion in 2035, a 10.21% CAGR.
- About 120,000 paying organisations at an average USD 150,000 a year form the 2025 base; organisations grow 7.0% a year and spend 3.0%.
- SIEM holds 44.0% of value; security data pipelines and lakes grow fastest at 15.0%.
- North America spends 44.0% of value; Asia Pacific grows fastest at 11.8%.
- Cisco (Splunk), Microsoft and Palo Alto Networks hold about 40% of value, a Douglas Insights estimate.

The average data breach cost USD 4.99 million in IBM's 2026 study, against USD 4.44 million a year earlier, and one in four malicious breaches was AI-enabled at about USD 6 million each, its [release of 29 July 2026](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average) states. The security analytics market covers the software and cloud services that collect security telemetry and turn it into detections: security information and event management (SIEM), extended detection and response (XDR) analytics, network detection and response (NDR), user and entity behaviour analytics (UEBA) and security data pipelines and lakes, valued at what organisations pay in subscriptions, licences and ingest charges. Managed detection services sold as labour, endpoint agents sold without analytics and firewalls are excluded. Douglas Insights sizes the market at USD 18.0 billion in 2025, about 120,000 paying organisations at an average USD 150,000 a year, and at USD 47.6 billion in 2035, a 10.21% compound annual growth rate (CAGR). The study sits beside our [Cyber Security Market](https://www.douglasinsights.com/cyber-security-market/), [Cybersecurity Mesh Market](https://www.douglasinsights.com/cybersecurity-mesh-market/) and [Cloud Computing Market](https://www.douglasinsights.com/cloud-computing-market/) reports; every figure follows the Douglas Insights [research methodology](https://www.douglasinsights.com/research-methodology/).

## Which security analytics products earn the most: SIEM, XDR analytics, NDR, data pipelines or UEBA?

SIEM earns the most, 44.0% of 2025 value or USD 7.92 billion, Douglas Insights estimates. XDR and threat analytics take 24.0%, NDR 12.0%, security data pipelines and lakes 11.0% and UEBA 9.0%.

| Product type | Share 2025 | Value 2025 | CAGR 2026-2035 | Value 2035 |
| --- | --- | --- | --- | --- |
| SIEM | 44.0% | USD 7.92 billion | 7.3% | USD 16.0 billion |
| XDR and threat analytics | 24.0% | USD 4.32 billion | 13.0% | USD 14.7 billion |
| Network detection and response | 12.0% | USD 2.16 billion | 9.5% | USD 5.35 billion |
| Security data pipelines and lakes | 11.0% | USD 1.98 billion | 15.0% | USD 8.01 billion |
| UEBA | 9.0% | USD 1.62 billion | 8.0% | USD 3.50 billion |

SIEM leads because it remains the system of record for almost every security operations centre (SOC): about 60,000 of the 120,000 paying organisations run a SIEM as their primary console, Douglas Insights estimates, at an average of about USD 132,000 a year. The product is being rebuilt rather than replaced. CrowdStrike names Falcon Next-Gen SIEM as a growth driver in its [third quarter fiscal 2026 results of 2 December 2025](https://www.sec.gov/Archives/edgar/data/1535527/000153552725000030/crwd-20251202xex991.htm), and Microsoft made its Sentinel data lake generally available on 30 September 2025, its [security blog](https://techcommunity.microsoft.com/blog/microsoft-security-blog/-/4456342) states. SIEM value still grows only 7.3% a year to USD 16.0 billion by 2035, a Douglas Insights estimate, because buyers move detection logic into XDR consoles and cheaper storage tiers.

XDR and threat analytics, USD 4.32 billion, grow 13.0% to USD 14.7 billion as endpoint, identity and cloud signals merge in one console. Palo Alto Networks says Cortex XSIAM has about 1,000 active customers, more than double a year earlier, and that XSIAM deals above USD 10 million rose 45%, its [fourth quarter fiscal 2026 earnings deck of 1 September 2026](https://investors.paloaltonetworks.com/static-files/8864c425-7c5d-4471-85c9-cdbf9072cfe5) shows. Security data pipelines and lakes, USD 1.98 billion, grow fastest at 15.0% to USD 8.01 billion, a Douglas Insights estimate, as filtering and routing tools cut what reaches the expensive analytics tier. NDR, USD 2.16 billion, grows 9.5% and UEBA, USD 1.62 billion, 8.0%, as behaviour models increasingly ship inside SIEM and XDR licences. Product values for 2035 sum to USD 47.5 billion, 0.08% below the headline.

## Who buys security analytics: large enterprises, the mid-market or service providers, and in which deployment?

Large enterprises with more than 5,000 staff pay about 58% of 2025 value, Douglas Insights estimates, mid-sized organisations about 30% and managed security service providers about 12%. Cloud-delivered analytics take about 62% of value and self-managed software 38%.

Large enterprises spend most because log volume scales with headcount, devices and cloud workloads. Douglas Insights estimates about 14,000 large organisations spending an average USD 745,000 a year, against about 106,000 smaller buyers and provider clients at an average USD 71,000. Elastic, whose search platform underpins many self-built SOCs, counts more than 1,800 customers with annual contract value above USD 100,000, its [first quarter fiscal 2027 results of 27 August 2026](https://ir.elastic.co/News--Events/news/news-details/2026/Elastic-Reports-First-Quarter-Fiscal-2027-Financial-Results/) show, while its Elastic Cloud revenue rose 20% to USD 235.2 million in the quarter.

The mid-market is where the customer count grows. Smaller buyers rarely run a 24-hour SOC, so they take analytics bundled with endpoint protection or through a provider. CrowdStrike's Falcon Flex licensing, which lets customers draw on SIEM, identity and cloud modules from one commitment, reached ending annual recurring revenue (ARR) above USD 2.29 billion, its [second quarter fiscal 2027 results of 26 August 2026](https://ir.crowdstrike.com/node/17386/html) state. Cloud delivery passes self-managed deployment because data lakes priced per gigabyte remove the hardware and storage planning that once tied SIEM to the data centre; Douglas Insights estimates the cloud share reaches about 80% of value by 2035.

## What drives security analytics demand: breach costs, platform consolidation, cheaper data lakes or the mid-market?

Paying organisations rise 7.00% a year in our base case, from about 120,000 in 2025 to 236,000 in 2035. Four drivers add 8.60 gross points; restraints remove 1.60.

### Breach costs and AI-enabled attacks: 2.60 points

Breach economics are the largest driver, worth 2.60 points. The global average breach cost rose to USD 4.99 million in 2026 from USD 4.44 million in 2025, and security AI cut breach costs by almost USD 2 million, the [IBM release of 29 July 2026](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average) states. In the 2025 study the mean time to identify and contain a breach was 241 days, extensive use of AI and automation saved USD 1.9 million and shortened the lifecycle by 80 days, and the US average reached a record USD 10.22 million, the [IBM release of 30 July 2025](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls) shows. An 80-day cut worth USD 1.9 million pays for about 13 years of the average USD 150,000 analytics subscription, Douglas Insights estimates, which is why boards fund detection even when other IT budgets are flat.

### Platform consolidation: 2.40 points

Consolidation onto large platforms adds 2.40 points. Palo Alto Networks' Next-Generation Security ARR rose 63% to USD 9.10 billion and fourth quarter revenue 34% to USD 3.41 billion, its [results of 1 September 2026](https://www.sec.gov/Archives/edgar/data/0001327567/000132756726000019/ex991q426earningsrelease.htm) show, helped by the CyberArk purchase it completed on 11 February 2026, its [release](https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era) states. CrowdStrike's Falcon Flex ARR climbed from USD 1.69 billion, up more than 120%, at the end of January 2026, its [fourth quarter fiscal 2026 results of 3 March 2026](https://www.sec.gov/Archives/edgar/data/1535527/000153552726000007/crwd-20260303xex991.htm) show, to above USD 2.29 billion seven months later. Douglas Insights estimates that each consolidated platform deal adds analytics to 1.3 organisations that previously bought endpoint tools only.

### Cheaper security data lakes: 2.00 points

Lower storage cost adds 2.00 points. Microsoft charges USD 0.10 per gigabyte ingested for Sentinel data lake processing from 1 October 2025 and bills storage after 6:1 compression, across more than 350 connectors, its [blog of 30 September 2025](https://techcommunity.microsoft.com/blog/microsoft-security-blog/-/4456342) states. Palo Alto Networks paid USD 3.35 billion for Chronosphere, a telemetry platform with ARR above USD 160 million at the end of September 2025, its [announcement of 19 November 2025](https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-to-acquire-chronosphere--next-gen-observability-leader--for-the-ai-era) shows, and completed the deal on 29 January 2026. Cheaper retention lets organisations that once kept 30 days of logs keep a year, Douglas Insights estimates, bringing new buyers into analytics.

### Mid-market and provider-led adoption: 1.60 points

The mid-market adds the last 1.60 points. SentinelOne's ARR rose 22% to USD 1,218 million and quarterly revenue 21% to USD 292 million, its [second quarter fiscal 2027 results of 27 August 2026](https://investors.sentinelone.com/press-releases/news-details/2026/SentinelOne-Announces-Second-Quarter-Fiscal-Year-2027-Financial-Results/default.aspx) show, much of it from customers with fewer than 5,000 staff. Summed, 2.60 + 2.40 + 2.00 + 1.60 = 8.60 points; after 1.60 points of restraints the 7.00% customer leg combined with the 3.00% spend leg gives the 10.21% revenue rate.

## What holds back security analytics: legacy churn, alert overload or runaway data bills?

Three restraints remove 1.60 points a year from customer growth: churn among legacy and mid-tier vendors takes 0.70 points, alert overload and staff shortages 0.50 points and unpredictable data bills 0.40 points.

Legacy churn is the largest brake. Rapid7's ARR fell 2.2% to USD 819.7 million and its third quarter revenue fell 2.5% to USD 212.4 million, its [results of 4 November 2026](https://www.sec.gov/Archives/edgar/data/0001560327/000156032726000049/q32026rapid78-kex991.htm) show. Douglas Insights estimates that about 6% of organisations stop paying for a standalone analytics tool each year when they fold it into a platform, so part of the platform vendors' growth is migration rather than new demand.

Alert overload is the second brake. A mid-sized SOC can face thousands of alerts a day, Douglas Insights estimates, and organisations without analysts to triage them delay purchases or buy a managed service that we count as labour, not analytics. The third brake is cost uncertainty: ingest-priced tools grow bills as fast as log volumes, and Microsoft's own pricing shows that commitment tiers from 100 to 50,000 GB a day save "up to 52%" against pay-as-you-go, its [Sentinel pricing page](https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel) states, a gap that pushes buyers to cap data rather than expand coverage.

## Which region spends the most on security analytics, and where does demand grow fastest?

North America spends the most, about USD 7.92 billion or 44.0% of 2025 value, led by the United States. Asia Pacific grows fastest at 11.8% a year, reaching USD 11.5 billion by 2035.

| Region | Value 2025 | Share 2025 | Value 2026 | CAGR 2026-2035 | Value 2035 |
| --- | --- | --- | --- | --- | --- |
| North America | USD 7.92 billion | 44.0% | USD 8.66 billion | 9.4% | USD 19.5 billion |
| Europe | USD 4.68 billion | 26.0% | USD 5.15 billion | 10.0% | USD 12.1 billion |
| Asia Pacific | USD 3.78 billion | 21.0% | USD 4.23 billion | 11.8% | USD 11.5 billion |
| Latin America | USD 810 million | 4.5% | USD 895 million | 10.5% | USD 2.20 billion |
| Middle East and Africa | USD 810 million | 4.5% | USD 903 million | 11.5% | USD 2.41 billion |

North America leads because it hosts most of the vendors and the costliest incidents: the US breach average of USD 10.22 million in 2025 was more than twice the global figure, the [IBM 2025 release](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls) shows. Douglas Insights estimates about 48,000 paying US and Canadian organisations at an average USD 165,000. Growth slows to 9.4% as the large-enterprise base saturates.

Europe, USD 4.68 billion, grows 10.0% as banks, energy operators and public bodies extend logging to meet new resilience obligations. Asia Pacific, USD 3.78 billion, grows 11.8%, with India, Japan, Australia and Southeast Asia adding cloud-first buyers; in India, every service provider and data centre must keep 180 days of system logs under the [CERT-In directions of 28 April 2022](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf), which builds a large retention base. Latin America and the Middle East and Africa, USD 810 million each, grow from low adoption, with Gulf banks and Brazilian financial institutions the main buyers. Regional values sum to USD 19.8 billion in 2026, 0.01% below the headline, and USD 47.7 billion in 2035, 0.29% above it.

## Which companies lead security analytics, and how are acquisitions reshaping the field?

Cisco, through Splunk, leads with about 17% of 2025 value, a Douglas Insights estimate, ahead of Microsoft at about 14%, Palo Alto Networks at about 9%, CrowdStrike at about 7% and Google at about 6%. The top five hold about 53%.

| Company | Base and position | Latest filed figure | Estimated share 2025 |
| --- | --- | --- | --- |
| Cisco (Splunk) | San Jose; Splunk Enterprise Security SIEM | Security product revenue USD 8.23 billion, FY2026 | 17% |
| Microsoft | Redmond; Sentinel SIEM and data lake | Sentinel data lake GA, 30 September 2025 | 14% |
| Palo Alto Networks | Santa Clara; Cortex XSIAM, XDR | NGS ARR USD 9.10 billion, Q4 FY2026 | 9% |
| CrowdStrike | Austin; Falcon Next-Gen SIEM | Ending ARR USD 5.84 billion, Q2 FY2027 | 7% |
| Google | Mountain View; Google Security Operations | Wiz acquisition completed 11 March 2026 | 6% |
| SentinelOne | Mountain View; Singularity AI SIEM | ARR USD 1,218 million, Q2 FY2027 | 3% |

Cisco's security product revenue reached USD 8,232 million in fiscal 2026, up 2%, and USD 2,226 million in the fourth quarter, up 14%, its [results of 12 August 2026](https://www.sec.gov/Archives/edgar/data/0000858877/000085887726000106/exhibit991pressrelease-q4f.htm) show; Douglas Insights estimates that Splunk security analytics forms about USD 3.1 billion of that line. CrowdStrike's ending ARR reached USD 5.84 billion and quarterly revenue USD 1.47 billion, its [release of 26 August 2026](https://ir.crowdstrike.com/node/17386/html) shows, and it agreed on 27 August 2025 to buy Onum, a real-time data pipeline company, to feed Falcon Next-Gen SIEM, its [release](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-agrees-acquire-onum-supercharge-falcon-next-gen-siem) states.

Acquisitions are redrawing the second tier. Google completed its purchase of the cloud security company Wiz on 11 March 2026, its [release](https://www.googlecloudpresscorner.com/2026-03-11-Google-Completes-Acquisition-of-Wiz) states, putting cloud posture data beside Google Security Operations. SentinelOne completed its purchase of Observo AI, a data pipeline start-up, on 22 September 2025 for about USD 130.2 million in cash and 5,263,156 shares with a fair value of USD 185.2 million, its [quarterly report for the period to 31 July 2026](https://www.sec.gov/Archives/edgar/data/0001583708/000158370826000055/s-20260731.htm) shows. Elastic, Rapid7, Exabeam, Securonix and Sumo Logic compete for buyers that want an analytics layer independent of their endpoint vendor.

## What does security analytics cost per organisation, and why does average spend rise?

An organisation pays an average USD 150,000 a year for security analytics in 2025, Douglas Insights estimates: about USD 71,000 for mid-sized buyers and provider clients and USD 745,000 for large enterprises, with ingest charges making up about half of the bill.

Average spend rises 3.00% a year to about USD 201,600 by 2035, a Douglas Insights estimate, because data volumes grow faster than unit prices fall. Per-gigabyte rates keep dropping: Microsoft's data lake tier charges USD 0.10 per gigabyte for processing, its [September 2025 announcement](https://techcommunity.microsoft.com/blog/microsoft-security-blog/-/4456342) states, a fraction of a traditional analytics-tier ingest rate, and commitment tiers starting at 100 GB a day carry discounts of up to 52%, the [pricing page](https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel) shows. Douglas Insights estimates the blended price per gigabyte falls about 8% a year.

Volume offsets the cut. Douglas Insights estimates that a typical enterprise's security telemetry grows about 12% a year as cloud workloads, identities and AI agents add logs, so the bill rises even as the rate falls. Bundling also shifts how price is recorded: Falcon Flex and XSIAM contracts price analytics as a module inside a platform commitment, which Douglas Insights allocates by list price. Microsoft keeps the first 90 days of retention free and offers a 31-day trial of 10 GB a day, its [billing documentation, updated 6 May 2026](https://learn.microsoft.com/en-us/azure/sentinel/billing), states, a structure that pulls smaller buyers in at low entry cost.

## Which rules shape security analytics, from incident reporting to log retention?

Three kinds of rules shape the market: incident-reporting deadlines that require fast detection, resilience laws that require logging and monitoring, and retention rules that set how long logs must be kept.

Reporting deadlines come first. Listed US companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining materiality, with compliance from 18 December 2023, the [SEC's release of 26 July 2023](https://www.sec.gov/newsroom/press-releases/2023-139) sets out. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will require 72-hour incident reports and 24-hour ransom payment reports, but its final rule's effective date is still "yet-to-be-determined", the [CISA page](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia) shows.

Resilience laws set the floor in Europe. The Digital Operational Resilience Act (DORA) has applied to EU financial firms since 17 January 2025, [ESMA](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora) states. The European Commission sent reasoned opinions to 19 member states over incomplete NIS2 transposition on 7 May 2025, its [notice](https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive) shows, and referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026, its [release](https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules) states. The UK Cyber Security and Resilience Bill had its first reading on 12 November 2025, [GOV.UK](https://www.gov.uk/government/collections/cyber-security-and-resilience-bill) shows. Retention rules complete the picture: India's CERT-In directions of 28 April 2022 require logs to be kept for a rolling 180 days within India and incidents reported within 6 hours, the [directions](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) state.

## What if budgets tighten or AI-driven SOCs scale faster: how large is security analytics in 2035?

The security analytics market ends 2035 between USD 34.0 billion and USD 63.1 billion across three cases, around a USD 47.6 billion base. The pace of new buyers and the growth of data per buyer set most of the spread.

| Case | Customer leg | Spend leg | Revenue rate | 2035 value |
| --- | --- | --- | --- | --- |
| Slower | 5.00% | 1.50% | 6.57% | USD 34.0 billion |
| Base case | 7.00% | 3.00% | 10.21% | USD 47.6 billion |
| Faster | 9.00% | 4.00% | 13.36% | USD 63.1 billion |

In the slower case IT budgets tighten, platform bundles squeeze analytics prices and more mid-sized buyers outsource to providers counted as labour, taking 2.0 points off the customer leg and 1.5 points off spend. In the faster case AI-driven SOC tools cut the analyst cost of running analytics, pulling in 2.0 points more customers, and AI agents add telemetry that lifts spend 1.0 point. One extra point of yearly revenue growth adds about USD 4.5 billion to 2035 value, Douglas Insights estimates.

Company signals bracket the base. Palo Alto Networks grew NGS ARR 63% including acquisitions, CrowdStrike grew ending ARR 24% to USD 5.25 billion in fiscal 2026 and SentinelOne 22%, while Rapid7's ARR fell 2.2%; our 10.21% rate sits below the platform leaders because their growth includes acquired revenue and share taken from legacy tools.

## Douglas Exclusive: the SOC Consolidation Ledger

The SOC Consolidation Ledger is a Douglas Insights model built from 10 inputs: 5 completed or agreed acquisitions, 4 vendor recurring-revenue disclosures and 1 platform launch. It tracks how fast security analytics spend moves from standalone tools to the five largest platforms.

| Date | Input | What it moves |
| --- | --- | --- |
| 27 August 2025 | CrowdStrike agrees to buy Onum | Pipeline inside the platform |
| 22 September 2025 | SentinelOne completes Observo AI deal | Pipeline inside the platform |
| 30 September 2025 | Microsoft Sentinel data lake GA | Storage cost per gigabyte |
| 29 January 2026 | Palo Alto Networks completes Chronosphere | Telemetry inside the platform |
| 11 February 2026 | Palo Alto Networks completes CyberArk | Identity signals in XSIAM |
| 3 March 2026 | CrowdStrike Falcon Flex ARR USD 1.69 billion | Platform licensing |
| 11 March 2026 | Google completes Wiz | Cloud signals in Google SecOps |
| 26 August 2026 | CrowdStrike Falcon Flex ARR above USD 2.29 billion | Platform licensing |
| 1 September 2026 | XSIAM about 1,000 active customers | Platform SIEM replacement |
| 4 November 2026 | Rapid7 ARR down 2.2% | Standalone vendor churn |

The finding, a Douglas Insights estimate: the five largest platforms held about 53% of security analytics value in 2025, up from about 45% in 2023, and reach about 65% by 2030 if acquisitions continue at the 2025-2026 pace. Every large deal in the ledger bought data handling, not detection content, which shows where the platforms see the bottleneck.

The ledger changes how to read the next three years. Because pipelines now sit inside the platforms, independent SIEM vendors lose the cost argument they used to win deals, and Douglas Insights expects standalone vendors to compete on openness and price per gigabyte rather than on detection breadth.

## How does the methodology turn 120,000 paying organisations into USD 18.0 billion?

Our methodology multiplies about 120,000 organisations paying for security analytics in 2025 by an average USD 150,000 a year to reach USD 18.0 billion, then grows organisations 7.00% and spend 3.00% a year.

The model covers 5 product types, 3 buyer groups and 5 regions, using 52 data points, 19 sourced and 33 modelled. Organisation counts come from vendor customer disclosures and enterprise counts by region, and spend from list prices and disclosed ARR; the splits are Douglas Insights estimates. Arithmetic: 14,000 large enterprises x USD 745,000 + 106,000 smaller buyers x USD 71,000 including provider resale = about USD 18.0 billion; USD 18.0 billion x (1.0700 x 1.0300)^10 = USD 47.6 billion. Organisations reach about 128,400 in 2026 and 236,000 in 2035.

Two cross-checks agree. First, our estimated 53% top-five share implies about USD 9.5 billion of 2025 analytics revenue across Cisco, Microsoft, Palo Alto Networks, CrowdStrike and Google, consistent with Cisco's USD 8.23 billion security line and the platform ARR disclosures above. Second, the market equals about 7.9% of the USD 228.21 billion our Cyber Security Market study puts on all 2025 security spending. AI tools help draft the text and automated checks test the arithmetic and links; the Douglas Insights research desk chooses the sources, builds the model and approves publication, as our [editorial standards](https://www.douglasinsights.com/research-methodology/) explain.

## What counts in the security analytics study, and what is excluded?

The study counts SIEM, XDR and threat analytics, NDR, UEBA and security data pipeline and lake software and cloud services. Managed detection labour, endpoint agents without analytics, firewalls, identity products sold alone and observability tools for IT operations are excluded.

The study splits value by 5 product types, 3 buyer groups and 5 regions: North America, Europe, Asia Pacific, Latin America and the Middle East and Africa. Values are in US dollars at 2025 average exchange rates, counted at what the end organisation or service provider pays the software vendor. Readers following wider security spending can compare our [Cyber Security Market](https://www.douglasinsights.com/cyber-security-market/) study.

## Market by segment

| Segment | Share | Value |
| --- | --- | --- |
| SIEM | 44% | $7.92 Bn |
| XDR and threat analytics | 24% | $4.32 Bn |
| Network detection and response | 12% | $2.16 Bn |
| Security data pipelines and lakes | 11% | $1.98 Bn |
| UEBA | 9% | $1.62 Bn |

## Market by region (USD million)

| Region | 2025 | 2026 | 2035 | CAGR 2026-2035 |
| --- | --- | --- | --- | --- |
| Global | 18 | 19.84 | 47.6 | 10.21% |
| North America | 7.92 | 8.66 | 19.45 | 9.4% |
| Europe | 4.68 | 5.15 | 12.14 | 10% |
| Asia Pacific | 3.78 | 4.23 | 11.53 | 11.8% |
| Latin America | 0.81 | 0.9 | 2.2 | 10.5% |
| Middle East and Africa | 0.81 | 0.9 | 2.41 | 11.5% |

## Dataset

| Series | Value | Unit |
| --- | --- | --- |
| Market size 2025 | 18 | USD billion |
| Market size 2035 | 47.6 | USD billion |
| Revenue CAGR 2026-2035 | 10.21 | percent |
| Volume CAGR 2026-2035 | 7 | percent |
| Spend per organisation CAGR 2026-2035 | 3 | percent |

## Frequently asked questions

### How big is the security analytics market in 2025 and 2035?

USD 18.0 billion in 2025, from about 120,000 paying organisations at USD 150,000 a year, rising to USD 47.6 billion by 2035 at a 10.21% CAGR.

### Which security analytics product earns the most?

SIEM, with 44.0% of 2025 value or USD 7.92 billion; security data pipelines and lakes grow fastest at 15.0% a year.

### Which companies lead security analytics?

Cisco through Splunk with about 17% of 2025 value, Microsoft with 14% and Palo Alto Networks with 9%, Douglas Insights estimates.

### Which region spends the most on security analytics?

North America, with 44.0% of 2025 value or USD 7.92 billion; Asia Pacific grows fastest at 11.8% a year.

### What does security analytics cost?

An average USD 150,000 a year in 2025, from about USD 71,000 for mid-sized buyers to USD 745,000 for large enterprises, Douglas Insights estimates; Microsoft charges USD 0.10 per gigabyte for Sentinel data lake processing.

### Which rules push organisations to buy security analytics?

US SEC Form 8-K Item 1.05 four-business-day disclosure, EU DORA since 17 January 2025, NIS2, the UK Cyber Security and Resilience Bill and India's 180-day CERT-In log retention.

### How far apart are the slower and faster 2035 cases?

USD 34.0 billion in the slower case and USD 63.1 billion in the faster case, against a USD 47.6 billion base.

## Sources

- [IBM, IBM study: one in four malicious breaches are AI-enabled](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average)
- [IBM, IBM Cost of a Data Breach Report 2025](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls)
- [Palo Alto Networks (SEC), Palo Alto Networks fiscal Q4 and FY2026 results](https://www.sec.gov/Archives/edgar/data/0001327567/000132756726000019/ex991q426earningsrelease.htm)
- [Palo Alto Networks, Palo Alto Networks Q4 FY2026 earnings presentation](https://investors.paloaltonetworks.com/static-files/8864c425-7c5d-4471-85c9-cdbf9072cfe5)
- [Palo Alto Networks, Palo Alto Networks to acquire Chronosphere](https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-to-acquire-chronosphere--next-gen-observability-leader--for-the-ai-era)
- [Palo Alto Networks, Palo Alto Networks completes acquisition of CyberArk](https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era)
- [CrowdStrike, CrowdStrike second quarter fiscal 2027 results](https://ir.crowdstrike.com/node/17386/html)
- [CrowdStrike (SEC), CrowdStrike fourth quarter fiscal 2026 results](https://www.sec.gov/Archives/edgar/data/1535527/000153552726000007/crwd-20260303xex991.htm)
- [CrowdStrike (SEC), CrowdStrike third quarter fiscal 2026 results](https://www.sec.gov/Archives/edgar/data/1535527/000153552725000030/crwd-20251202xex991.htm)
- [CrowdStrike, CrowdStrike agrees to acquire Onum](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-agrees-acquire-onum-supercharge-falcon-next-gen-siem)
- [Cisco (SEC), Cisco fourth quarter and fiscal 2026 results](https://www.sec.gov/Archives/edgar/data/0000858877/000085887726000106/exhibit991pressrelease-q4f.htm)
- [Microsoft, Microsoft Sentinel data lake general availability](https://techcommunity.microsoft.com/blog/microsoft-security-blog/-/4456342)
- [Microsoft, Microsoft Sentinel pricing](https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel)
- [Microsoft Learn, Microsoft Sentinel billing](https://learn.microsoft.com/en-us/azure/sentinel/billing)
- [Google Cloud, Google completes acquisition of Wiz](https://www.googlecloudpresscorner.com/2026-03-11-Google-Completes-Acquisition-of-Wiz)
- [SentinelOne, SentinelOne second quarter fiscal 2027 results](https://investors.sentinelone.com/press-releases/news-details/2026/SentinelOne-Announces-Second-Quarter-Fiscal-Year-2027-Financial-Results/default.aspx)
- [SentinelOne (SEC), SentinelOne 10-Q, quarter ended 31 July 2026](https://www.sec.gov/Archives/edgar/data/0001583708/000158370826000055/s-20260731.htm)
- [Rapid7 (SEC), Rapid7 third quarter 2026 results](https://www.sec.gov/Archives/edgar/data/0001560327/000156032726000049/q32026rapid78-kex991.htm)
- [Elastic, Elastic first quarter fiscal 2027 results](https://ir.elastic.co/News--Events/news/news-details/2026/Elastic-Reports-First-Quarter-Fiscal-2027-Financial-Results/)
- [US SEC, SEC adopts cybersecurity disclosure rules](https://www.sec.gov/newsroom/press-releases/2023-139)
- [CISA, CIRCIA](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia)
- [ESMA, Digital Operational Resilience Act](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora)
- [European Commission, Commission calls on 19 member states to transpose NIS2](https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive)
- [European Commission, Commission refers four member states over NIS2](https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules)
- [GOV.UK, Cyber Security and Resilience Bill](https://www.gov.uk/government/collections/cyber-security-and-resilience-bill)
- [CERT-In, CERT-In Directions of 28 April 2022](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf)

## How to cite

Douglas Insights, "Security Analytics Market", DI-IT-10867, updated 2026-11-06, https://www.douglasinsights.com/security-analytics-market/