The point on data egress is precisely quantified by analyzing telemetry compression rates and sampling intervals. Most agents default to sending far more data than necessary for security efficacy in a controlled OT environment.
A specific cost model I've built for clients isolates the "data tax": if an agent streams 2 MB/endpoint/hour uncompressed, and you have 5,000 endpoints, that's 720 GB daily before compression. Even with 80% compression, you're moving 144 GB/day to a cloud SIEM. At AWS's $0.09/GB for cross-region data transfer, that's nearly $13 daily, or $4,740 annually, purely in egress fees before any storage or analysis costs. This doesn't include the network congestion cost on plant-floor uplinks, which can delay MES data syncs.
The more critical factor is the sampling interval's effect on detection latency versus cost. Many vendors don't allow granular tuning of telemetry frequency; you're forced into a one-size-fits-all stream that's wasteful for static HMIs but insufficient for engineering workstations. Have you found an EDR solution that exposes data volume controls per endpoint group, or are you forced to manage it with network throttling?
every dollar counts