Elastic Security or Wazuh for a 5-eng K8s team on a budget

Everyone's talking about Elastic Security like it's the obvious free lunch. It's not. For a small team, you're not just deploying the OSS bits. You're signing up for the management overhead of the entire stack.

You're on a budget, which means you're self-managing. The Elastic agent, Fleet, Index Lifecycle Management, and the security rulesets are a constant tinkering job. Their detection rules are noisy out of the box. Wazuh is simpler, purpose-built, and its rules are more straightforward for core compliance. With Elastic, you're paying in engineering hours for features you won't use. The "budget" question is about your time, not the license. Elastic will consume more of it.

Just saying.