CIO Brief: Cloud-Native SIEM vs. Legacy SIEM — The Cost and Coverage Trade-Off

Retrospective: this article looks back at events from February 2019, written in 2026 with the benefit of hindsight.

The short version: In 2019, Microsoft released Sentinel, a security monitoring service that runs in the cloud. It made centralized security monitoring affordable for mid-sized companies — as long as costs are planned, because the price depends on how much data you send it.

What a SIEM does

A security information and event management system collects logs from across your environment — sign-ins, emails, servers, cloud accounts — and looks for patterns that indicate an attack. It is also where investigators go to answer "what happened?" after an incident.

Cloud SIEM versus traditional SIEM

• Traditional: large upfront license and hardware costs, specialist administrators, predictable pricing.
• Cloud-native: no infrastructure, quick start, pay for data ingested. Costs can grow quickly if every log is collected.

Questions to ask your team

• If we had a breach today, where would we look to understand what happened, and how far back could we see?
• What would a cloud SIEM cost for our highest-value data sources?
• Who would respond to alerts, including outside business hours?
• Do our insurers or customers require centralized logging?

What good looks like

Centralized logging of identity, email, endpoint and cloud activity, retained for at least a year, a focused set of tuned detections, and a defined response process — in-house or through a managed provider.

The decision

Ask for a cost estimate covering your top five data sources and a response model. For many Microsoft-centric organizations, Sentinel plus a managed response partner costs less than one additional security hire.