Security Analytics Market

The average data breach cost USD 4.99 million in IBM’s 2026 study, against USD 4.44 million a year earlier, and one in four malicious breaches was AI-enabled at about USD 6 million each, its release of 29 July 2026 states. The security analytics market covers the software and cloud services that collect security telemetry and turn it into detections: security information and event management (SIEM), extended detection and response (XDR) analytics, network detection and response (NDR), user and entity behaviour analytics (UEBA) and security data pipelines and lakes, valued at what organisations pay in subscriptions, licences and ingest charges. Managed detection services sold as labour, endpoint agents sold without analytics and firewalls are excluded. Douglas Insights sizes the market at USD 18.0 billion in 2025, about 120,000 paying organisations at an average USD 150,000 a year, and at USD 47.6 billion in 2035, a 10.21% compound annual growth rate (CAGR). The study sits beside our Cyber Security Market, Cybersecurity Mesh Market and Cloud Computing Market reports; every figure follows the Douglas Insights research methodology.

Which security analytics products earn the most: SIEM, XDR analytics, NDR, data pipelines or UEBA?

SIEM earns the most, 44.0% of 2025 value or USD 7.92 billion, Douglas Insights estimates. XDR and threat analytics take 24.0%, NDR 12.0%, security data pipelines and lakes 11.0% and UEBA 9.0%.

SIEM leads because it remains the system of record for almost every security operations centre (SOC): about 60,000 of the 120,000 paying organisations run a SIEM as their primary console, Douglas Insights estimates, at an average of about USD 132,000 a year. The product is being rebuilt rather than replaced. CrowdStrike names Falcon Next-Gen SIEM as a growth driver in its third quarter fiscal 2026 results of 2 December 2025, and Microsoft made its Sentinel data lake generally available on 30 September 2025, its security blog states. SIEM value still grows only 7.3% a year to USD 16.0 billion by 2035, a Douglas Insights estimate, because buyers move detection logic into XDR consoles and cheaper storage tiers.

XDR and threat analytics, USD 4.32 billion, grow 13.0% to USD 14.7 billion as endpoint, identity and cloud signals merge in one console. Palo Alto Networks says Cortex XSIAM has about 1,000 active customers, more than double a year earlier, and that XSIAM deals above USD 10 million rose 45%, its fourth quarter fiscal 2026 earnings deck of 1 September 2026 shows. Security data pipelines and lakes, USD 1.98 billion, grow fastest at 15.0% to USD 8.01 billion, a Douglas Insights estimate, as filtering and routing tools cut what reaches the expensive analytics tier. NDR, USD 2.16 billion, grows 9.5% and UEBA, USD 1.62 billion, 8.0%, as behaviour models increasingly ship inside SIEM and XDR licences. Product values for 2035 sum to USD 47.5 billion, 0.08% below the headline.

Who buys security analytics: large enterprises, the mid-market or service providers, and in which deployment?

Large enterprises with more than 5,000 staff pay about 58% of 2025 value, Douglas Insights estimates, mid-sized organisations about 30% and managed security service providers about 12%. Cloud-delivered analytics take about 62% of value and self-managed software 38%.

Large enterprises spend most because log volume scales with headcount, devices and cloud workloads. Douglas Insights estimates about 14,000 large organisations spending an average USD 745,000 a year, against about 106,000 smaller buyers and provider clients at an average USD 71,000. Elastic, whose search platform underpins many self-built SOCs, counts more than 1,800 customers with annual contract value above USD 100,000, its first quarter fiscal 2027 results of 27 August 2026 show, while its Elastic Cloud revenue rose 20% to USD 235.2 million in the quarter.

The mid-market is where the customer count grows. Smaller buyers rarely run a 24-hour SOC, so they take analytics bundled with endpoint protection or through a provider. CrowdStrike’s Falcon Flex licensing, which lets customers draw on SIEM, identity and cloud modules from one commitment, reached ending annual recurring revenue (ARR) above USD 2.29 billion, its second quarter fiscal 2027 results of 26 August 2026 state. Cloud delivery passes self-managed deployment because data lakes priced per gigabyte remove the hardware and storage planning that once tied SIEM to the data centre; Douglas Insights estimates the cloud share reaches about 80% of value by 2035.

What drives security analytics demand: breach costs, platform consolidation, cheaper data lakes or the mid-market?

Paying organisations rise 7.00% a year in our base case, from about 120,000 in 2025 to 236,000 in 2035. Four drivers add 8.60 gross points; restraints remove 1.60.

Breach costs and AI-enabled attacks: 2.60 points

Breach economics are the largest driver, worth 2.60 points. The global average breach cost rose to USD 4.99 million in 2026 from USD 4.44 million in 2025, and security AI cut breach costs by almost USD 2 million, the IBM release of 29 July 2026 states. In the 2025 study the mean time to identify and contain a breach was 241 days, extensive use of AI and automation saved USD 1.9 million and shortened the lifecycle by 80 days, and the US average reached a record USD 10.22 million, the IBM release of 30 July 2025 shows. An 80-day cut worth USD 1.9 million pays for about 13 years of the average USD 150,000 analytics subscription, Douglas Insights estimates, which is why boards fund detection even when other IT budgets are flat.

Platform consolidation: 2.40 points

Consolidation onto large platforms adds 2.40 points. Palo Alto Networks’ Next-Generation Security ARR rose 63% to USD 9.10 billion and fourth quarter revenue 34% to USD 3.41 billion, its results of 1 September 2026 show, helped by the CyberArk purchase it completed on 11 February 2026, its release states. CrowdStrike’s Falcon Flex ARR climbed from USD 1.69 billion, up more than 120%, at the end of January 2026, its fourth quarter fiscal 2026 results of 3 March 2026 show, to above USD 2.29 billion seven months later. Douglas Insights estimates that each consolidated platform deal adds analytics to 1.3 organisations that previously bought endpoint tools only.

Cheaper security data lakes: 2.00 points

Lower storage cost adds 2.00 points. Microsoft charges USD 0.10 per gigabyte ingested for Sentinel data lake processing from 1 October 2025 and bills storage after 6:1 compression, across more than 350 connectors, its blog of 30 September 2025 states. Palo Alto Networks paid USD 3.35 billion for Chronosphere, a telemetry platform with ARR above USD 160 million at the end of September 2025, its announcement of 19 November 2025 shows, and completed the deal on 29 January 2026. Cheaper retention lets organisations that once kept 30 days of logs keep a year, Douglas Insights estimates, bringing new buyers into analytics.

Mid-market and provider-led adoption: 1.60 points

The mid-market adds the last 1.60 points. SentinelOne’s ARR rose 22% to USD 1,218 million and quarterly revenue 21% to USD 292 million, its second quarter fiscal 2027 results of 27 August 2026 show, much of it from customers with fewer than 5,000 staff. Summed, 2.60 + 2.40 + 2.00 + 1.60 = 8.60 points; after 1.60 points of restraints the 7.00% customer leg combined with the 3.00% spend leg gives the 10.21% revenue rate.

What holds back security analytics: legacy churn, alert overload or runaway data bills?

Three restraints remove 1.60 points a year from customer growth: churn among legacy and mid-tier vendors takes 0.70 points, alert overload and staff shortages 0.50 points and unpredictable data bills 0.40 points.

Legacy churn is the largest brake. Rapid7’s ARR fell 2.2% to USD 819.7 million and its third quarter revenue fell 2.5% to USD 212.4 million, its results of 4 November 2026 show. Douglas Insights estimates that about 6% of organisations stop paying for a standalone analytics tool each year when they fold it into a platform, so part of the platform vendors’ growth is migration rather than new demand.

Alert overload is the second brake. A mid-sized SOC can face thousands of alerts a day, Douglas Insights estimates, and organisations without analysts to triage them delay purchases or buy a managed service that we count as labour, not analytics. The third brake is cost uncertainty: ingest-priced tools grow bills as fast as log volumes, and Microsoft’s own pricing shows that commitment tiers from 100 to 50,000 GB a day save “up to 52%” against pay-as-you-go, its Sentinel pricing page states, a gap that pushes buyers to cap data rather than expand coverage.

Which region spends the most on security analytics, and where does demand grow fastest?

North America spends the most, about USD 7.92 billion or 44.0% of 2025 value, led by the United States. Asia Pacific grows fastest at 11.8% a year, reaching USD 11.5 billion by 2035.

North America leads because it hosts most of the vendors and the costliest incidents: the US breach average of USD 10.22 million in 2025 was more than twice the global figure, the IBM 2025 release shows. Douglas Insights estimates about 48,000 paying US and Canadian organisations at an average USD 165,000. Growth slows to 9.4% as the large-enterprise base saturates.

Europe, USD 4.68 billion, grows 10.0% as banks, energy operators and public bodies extend logging to meet new resilience obligations. Asia Pacific, USD 3.78 billion, grows 11.8%, with India, Japan, Australia and Southeast Asia adding cloud-first buyers; in India, every service provider and data centre must keep 180 days of system logs under the CERT-In directions of 28 April 2022, which builds a large retention base. Latin America and the Middle East and Africa, USD 810 million each, grow from low adoption, with Gulf banks and Brazilian financial institutions the main buyers. Regional values sum to USD 19.8 billion in 2026, 0.01% below the headline, and USD 47.7 billion in 2035, 0.29% above it.

Which companies lead security analytics, and how are acquisitions reshaping the field?

Cisco, through Splunk, leads with about 17% of 2025 value, a Douglas Insights estimate, ahead of Microsoft at about 14%, Palo Alto Networks at about 9%, CrowdStrike at about 7% and Google at about 6%. The top five hold about 53%.

Cisco’s security product revenue reached USD 8,232 million in fiscal 2026, up 2%, and USD 2,226 million in the fourth quarter, up 14%, its results of 12 August 2026 show; Douglas Insights estimates that Splunk security analytics forms about USD 3.1 billion of that line. CrowdStrike’s ending ARR reached USD 5.84 billion and quarterly revenue USD 1.47 billion, its release of 26 August 2026 shows, and it agreed on 27 August 2025 to buy Onum, a real-time data pipeline company, to feed Falcon Next-Gen SIEM, its release states.

Acquisitions are redrawing the second tier. Google completed its purchase of the cloud security company Wiz on 11 March 2026, its release states, putting cloud posture data beside Google Security Operations. SentinelOne completed its purchase of Observo AI, a data pipeline start-up, on 22 September 2025 for about USD 130.2 million in cash and 5,263,156 shares with a fair value of USD 185.2 million, its quarterly report for the period to 31 July 2026 shows. Elastic, Rapid7, Exabeam, Securonix and Sumo Logic compete for buyers that want an analytics layer independent of their endpoint vendor.

What does security analytics cost per organisation, and why does average spend rise?

An organisation pays an average USD 150,000 a year for security analytics in 2025, Douglas Insights estimates: about USD 71,000 for mid-sized buyers and provider clients and USD 745,000 for large enterprises, with ingest charges making up about half of the bill.

Average spend rises 3.00% a year to about USD 201,600 by 2035, a Douglas Insights estimate, because data volumes grow faster than unit prices fall. Per-gigabyte rates keep dropping: Microsoft’s data lake tier charges USD 0.10 per gigabyte for processing, its September 2025 announcement states, a fraction of a traditional analytics-tier ingest rate, and commitment tiers starting at 100 GB a day carry discounts of up to 52%, the pricing page shows. Douglas Insights estimates the blended price per gigabyte falls about 8% a year.

Volume offsets the cut. Douglas Insights estimates that a typical enterprise’s security telemetry grows about 12% a year as cloud workloads, identities and AI agents add logs, so the bill rises even as the rate falls. Bundling also shifts how price is recorded: Falcon Flex and XSIAM contracts price analytics as a module inside a platform commitment, which Douglas Insights allocates by list price. Microsoft keeps the first 90 days of retention free and offers a 31-day trial of 10 GB a day, its billing documentation, updated 6 May 2026, states, a structure that pulls smaller buyers in at low entry cost.

Which rules shape security analytics, from incident reporting to log retention?

Three kinds of rules shape the market: incident-reporting deadlines that require fast detection, resilience laws that require logging and monitoring, and retention rules that set how long logs must be kept.

Reporting deadlines come first. Listed US companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining materiality, with compliance from 18 December 2023, the SEC’s release of 26 July 2023 sets out. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will require 72-hour incident reports and 24-hour ransom payment reports, but its final rule’s effective date is still “yet-to-be-determined”, the CISA page shows.

Resilience laws set the floor in Europe. The Digital Operational Resilience Act (DORA) has applied to EU financial firms since 17 January 2025, ESMA states. The European Commission sent reasoned opinions to 19 member states over incomplete NIS2 transposition on 7 May 2025, its notice shows, and referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026, its release states. The UK Cyber Security and Resilience Bill had its first reading on 12 November 2025, GOV.UK shows. Retention rules complete the picture: India’s CERT-In directions of 28 April 2022 require logs to be kept for a rolling 180 days within India and incidents reported within 6 hours, the directions state.

What if budgets tighten or AI-driven SOCs scale faster: how large is security analytics in 2035?

The security analytics market ends 2035 between USD 34.0 billion and USD 63.1 billion across three cases, around a USD 47.6 billion base. The pace of new buyers and the growth of data per buyer set most of the spread.

In the slower case IT budgets tighten, platform bundles squeeze analytics prices and more mid-sized buyers outsource to providers counted as labour, taking 2.0 points off the customer leg and 1.5 points off spend. In the faster case AI-driven SOC tools cut the analyst cost of running analytics, pulling in 2.0 points more customers, and AI agents add telemetry that lifts spend 1.0 point. One extra point of yearly revenue growth adds about USD 4.5 billion to 2035 value, Douglas Insights estimates.

Company signals bracket the base. Palo Alto Networks grew NGS ARR 63% including acquisitions, CrowdStrike grew ending ARR 24% to USD 5.25 billion in fiscal 2026 and SentinelOne 22%, while Rapid7’s ARR fell 2.2%; our 10.21% rate sits below the platform leaders because their growth includes acquired revenue and share taken from legacy tools.

Douglas Exclusive: the SOC Consolidation Ledger

The SOC Consolidation Ledger is a Douglas Insights model built from 10 inputs: 5 completed or agreed acquisitions, 4 vendor recurring-revenue disclosures and 1 platform launch. It tracks how fast security analytics spend moves from standalone tools to the five largest platforms.

The finding, a Douglas Insights estimate: the five largest platforms held about 53% of security analytics value in 2025, up from about 45% in 2023, and reach about 65% by 2030 if acquisitions continue at the 2025-2026 pace. Every large deal in the ledger bought data handling, not detection content, which shows where the platforms see the bottleneck.

The ledger changes how to read the next three years. Because pipelines now sit inside the platforms, independent SIEM vendors lose the cost argument they used to win deals, and Douglas Insights expects standalone vendors to compete on openness and price per gigabyte rather than on detection breadth.

How does the methodology turn 120,000 paying organisations into USD 18.0 billion?

Our methodology multiplies about 120,000 organisations paying for security analytics in 2025 by an average USD 150,000 a year to reach USD 18.0 billion, then grows organisations 7.00% and spend 3.00% a year.

The model covers 5 product types, 3 buyer groups and 5 regions, using 52 data points, 19 sourced and 33 modelled. Organisation counts come from vendor customer disclosures and enterprise counts by region, and spend from list prices and disclosed ARR; the splits are Douglas Insights estimates. Arithmetic: 14,000 large enterprises x USD 745,000 + 106,000 smaller buyers x USD 71,000 including provider resale = about USD 18.0 billion; USD 18.0 billion x (1.0700 x 1.0300)^10 = USD 47.6 billion. Organisations reach about 128,400 in 2026 and 236,000 in 2035.

Two cross-checks agree. First, our estimated 53% top-five share implies about USD 9.5 billion of 2025 analytics revenue across Cisco, Microsoft, Palo Alto Networks, CrowdStrike and Google, consistent with Cisco’s USD 8.23 billion security line and the platform ARR disclosures above. Second, the market equals about 7.9% of the USD 228.21 billion our Cyber Security Market study puts on all 2025 security spending. AI tools help draft the text and automated checks test the arithmetic and links; the Douglas Insights research desk chooses the sources, builds the model and approves publication, as our editorial standards explain.

Sources

1. IBM IBM study: one in four malicious breaches are AI-enabled (2026)
2. IBM IBM Cost of a Data Breach Report 2025 (2025)
3. Palo Alto Networks (SEC) Palo Alto Networks fiscal Q4 and FY2026 results (2026)
4. Palo Alto Networks Palo Alto Networks Q4 FY2026 earnings presentation (2026)
5. Palo Alto Networks Palo Alto Networks to acquire Chronosphere (2025)
6. Palo Alto Networks Palo Alto Networks completes acquisition of CyberArk (2026)
7. CrowdStrike CrowdStrike second quarter fiscal 2027 results (2026)
8. CrowdStrike (SEC) CrowdStrike fourth quarter fiscal 2026 results (2026)
9. CrowdStrike (SEC) CrowdStrike third quarter fiscal 2026 results (2025)
10. CrowdStrike CrowdStrike agrees to acquire Onum (2025)
11. Cisco (SEC) Cisco fourth quarter and fiscal 2026 results (2026)
12. Microsoft Microsoft Sentinel data lake general availability (2025)
13. Microsoft Microsoft Sentinel pricing (2026)
14. Microsoft Learn Microsoft Sentinel billing (2026)
15. Google Cloud Google completes acquisition of Wiz (2026)
16. SentinelOne SentinelOne second quarter fiscal 2027 results (2026)
17. SentinelOne (SEC) SentinelOne 10-Q, quarter ended 31 July 2026 (2026)
18. Rapid7 (SEC) Rapid7 third quarter 2026 results (2026)
19. Elastic Elastic first quarter fiscal 2027 results (2026)
20. US SEC SEC adopts cybersecurity disclosure rules (2023)
21. CISA CIRCIA (2026)
22. ESMA Digital Operational Resilience Act (2025)
23. European Commission Commission calls on 19 member states to transpose NIS2 (2025)
24. European Commission Commission refers four member states over NIS2 (2026)
25. GOV.UK Cyber Security and Resilience Bill (2025)
26. CERT-In CERT-In Directions of 28 April 2022 (2022)

What counts in the security analytics study, and what is excluded?

The study counts SIEM, XDR and threat analytics, NDR, UEBA and security data pipeline and lake software and cloud services. Managed detection labour, endpoint agents without analytics, firewalls, identity products sold alone and observability tools for IT operations are excluded.

The study splits value by 5 product types, 3 buyer groups and 5 regions: North America, Europe, Asia Pacific, Latin America and the Middle East and Africa. Values are in US dollars at 2025 average exchange rates, counted at what the end organisation or service provider pays the software vendor. Readers following wider security spending can compare our Cyber Security Market study.