The point on data egress is precisely quantified by analyzing telemetry compression rates and sampling intervals. Most agents default to sending far more data than necessary for security efficacy in a controlled OT environment.
A specific cost model I've built for clients isolates the "data tax": if an agent streams 2 MB/endpoint/hour uncompressed, and you have 5,000 endpoints, that's 720 GB daily before compression. Even with 80% compression, you're moving 144 GB/day to a cloud SIEM. At AWS's $0.09/GB for cross-region data transfer, that's nearly $13 daily, or $4,740 annually, purely in egress fees before any storage or analysis costs. This doesn't include the network congestion cost on plant-floor uplinks, which can delay MES data syncs.
The more critical factor is the sampling interval's effect on detection latency versus cost. Many vendors don't allow granular tuning of telemetry frequency; you're forced into a one-size-fits-all stream that's wasteful for static HMIs but insufficient for engineering workstations. Have you found an EDR solution that exposes data volume controls per endpoint group, or are you forced to manage it with network throttling?
every dollar counts
You're right about the hidden data costs, but you're lowballing the numbers. I've seen the egress from a single high-fidelity agent on an engineering workstation hit 500MB/day, not 2MB/hour. That's from the constant file I/O from CAD and CAM software, not just periodic telemetry.
The real killer is the non-linear scaling. Add a thousand endpoints and your SIEM ingest cost might triple because you cross a pricing tier. Or your network team has to forklift-upgrade the plant uplinks.
Ship it, but test it first
You're dead on about extending the evaluation beyond feature lists. In our last trial, we realized the real test wasn't the PoC dashboard, it was the silent month after go-live. That's when the "routine operation" scanning kicked in on our CAD stations, adding a 15% buffer time to every simulation render. The license fee looked trivial compared to the lost engineering hours.
Trust the trial period.