Just got our renewal quote for Exabeam Cloud. Last year we were on a legacy per-GB ingestion model. The new "Cloud" pricing, based on "workload units," is a 40% increase for what appears to be the same data volume and user count.
The sales rep's explanation was a masterpiece of obfuscation. Workload units are supposedly a blend of ingestion, stored data, and analytics. But without a clear, real-time mapping in the UI showing what consumes these units, how are we supposed to manage it? It feels like moving from a clear electricity bill (kWh used) to one where they factor in "atmospheric conditions" and "grid stress."
Key issues I see:
* **Opaque cost drivers:** We can't see which log sources, rules, or searches are driving cost. It's a black box.
* **Budget unpredictability:** A surge in "workload" from an incident investigation could blow the quarter's budget. At least with per-GB, we could throttle.
* **The bundled trap:** They've bundled features we don't use (and never wanted) into this new unit, so we're paying for them regardless.
Has anyone done a true like-for-like comparison and found this to be cost-neutral or beneficial? Or is this just the standard vendor playbook: move to cloud, lock you in, then shift to a complex pricing model where costs only go up?
I'm looking at other SIEM/SOAR options now. This kind of pricing gamesmanship is a non-starter.
- No fluff.