Ran Elastic Endpoint Security for 18 months on ~2000 AWS EC2 instances (mix of Linux/Windows). Goal was consolidating AV and EDR. Here are the operational facts.
**Pros:**
* Tight integration with existing Elastic SIEM stack was the main win. Single pane for logs and security events.
* Agent performance overhead was acceptable, typically 2-3% CPU on most workloads.
* Policy management at scale via Kibana was functional once configured.
**Cons & Costs:**
* The real cost wasn't the Elastic subscription, but the AWS infrastructure to support it. Ingest and storage for enriched security events blew up our Elasticsearch cluster size and cost.
* Per-endpoint licensing became punitive with auto-scaling groups. We had to over-provision licenses for peak capacity.
* Alert fatigue was high. Tuning the default rules required a dedicated analyst.
**Bottom line:** It works if you are already all-in on Elastic and can manage the data volume. For pure endpoint security at this scale, dedicated EDR solutions were more cost-effective and required less overhead. We switched.
- mark
Data > Marketing
Your AWS cost observation is spot on. The real budget killer is always the data pipeline, not the vendor license.
> Alert fatigue was high
This is universal with Elastic Endpoint. Their default rule set generates massive noise. You need at least a 0.5 FTE just to write suppression exceptions and tune risk scores, which negates the "integrated" efficiency.
Did you consider tiering your hot/warm data? We pushed anything older than 14 days to cold storage with a much lower replica count. Cut our cluster costs by about 40% without losing searchability for historical incidents.
Spot on about the auto-scaling group licensing pain. We hit that exact same wall.
Our "solution" was to try and script agent decommissioning hooks to release licenses from terminated instances, but the lag and occasional failures meant we were still constantly juggling a 10-15% license buffer. It felt like paying a tax for agility.
Curious, did you ever run into issues with the agent's own update mechanism at that scale? We had a few bad updates that required manual pushes, which was a nightmare across 2k nodes.
Thank you for this detailed breakdown, Mark. The point about the real cost being the infrastructure to support it really resonates with a project I'm just starting to look into. We're also on Elastic SIEM and were considering Endpoint for that unified view.
Could you share a bit more about the tipping point for your team? Was it a specific cost threshold from the Elasticsearch cluster growth, or did the operational overhead of tuning alerts become the bigger burden? Trying to gauge what kind of internal pushback we should prepare for before we even run a POC.
Also, so glad you mentioned the dedicated EDR solutions being more cost effective at scale. It's a perspective I haven't heard enough of in our internal chats.