Everyone's shouting about "vendor lock-in" with cloud, but they're sleeping on the operational lock-in you get with a self-managed Elastic stack for security. The real cost isn't the license. It's the hidden tax on your team's sanity.
Let's break down the on-prem "savings":
* **Hardware:** You need hot/warm/cold tiers. SSDs for hot. Don't cheap out. That's $50k-$100k minimum for a decent starting cluster, and it's a depreciating asset.
* **Operational Burden:** The Elasticsearch cluster *is* your problem now. Tuning, scaling, patching. Here's a taste of the "fun":
```bash
# Ever tried tuning JVM heap for a data-heavy security node?
ES_JAVA_OPTS="-Xms24g -Xmx24g -XX:+UseG1GC -XX:InitiatingHeapOccupancyPercent=30"
```
And that's just one flag. Get it wrong, enjoy the 2am OOM kill.
* **Ingestion Pipeline:** Building and maintaining your own parsing, enrichment, and alerting pipelines. That's months of work. Cloud? They handle the plumbing. On-prem? You *are* the plumber.
Cloud costs are predictable and visible. On-prem costs are a slow bleed of engineering time, hardware refreshes, and storage upgrades. You're not saving money, you're converting salary into infrastructure. Which would you rather optimize?
-- old school
I'm a senior platform engineer at a mid-sized fintech. Our stack is Kubernetes on-prem, and we run Elastic Security in production across both self-managed and cloud-managed deployments for different workloads.
**Initial Deployment & Setup:** On-prem, expect 3-6 months for a production-ready security cluster with proper parsing, alerting, and retention. The cloud offering gets you to a basic operational state in under two weeks. The delta is mostly the data pipeline engineering.
**Staffing & Sustaining Cost:** For on-prem, budget for at least 1.5 dedicated FTE (a platform engineer and a security engineer's partial time) for care and feeding. That's roughly $180k-$250k in annual salary burden before hardware. Cloud's operational cost is zero; you pay for the managed service premium instead.
**Performance & Scaling Latency:** Adding 1TB of hot storage or scaling ingest by 2k EPS takes a cloud API call (minutes). On-prem, it's a procurement and provisioning cycle - anywhere from 2 weeks to 3 months. We've had to keep 30% buffer capacity on-prem "just in case," which is dead money.
**Disaster Recovery Complexity:** A true HA/DR setup for an on-prem Elastic security cluster is a multi-region replication project. With their cloud, cross-region replication is a checkbox in the UI. Our team spent 4 months building what they provide as a standard feature.
I'd recommend the cloud offering for any team where security is a *consumer* of the stack, not the builder. Go on-prem only if you have a dedicated infra team that lives in the Elastic ecosystem already. To make a clean call, tell us your team's size and your average daily log volume.
git push and pray