Wazuh vs Elastic Security cost: which one costs less to run yourself?
If you are budgeting a self-hosted SIEM, the first line item to check is the license, and here the gap is clear. Wazuh server and agents are licensed under GPL-2.0 with an OpenSSL linking exception, and the supplied facts show no license fee for that code. Elastic is different. Its self-managed detection engine, machine learning anomaly detection and case management sit under the Platinum tier, and endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit under Enterprise. Platinum is no longer sold to new customers, so a new self-managed buyer who needs paid security features chooses Enterprise or moves to Elastic Cloud. Confirm the current Enterprise price and term directly with Elastic before comparing totals, because the license line is the only one that differs in kind.
The license is rarely the largest cost, though. Your bill is driven by what the platform must store and how many nodes it needs to store it. Wazuh stores alerts in its indexer, a fork of OpenSearch, and the Wazuh server can run as a cluster for horizontal scaling. Elastic Security runs on Elasticsearch, where a highly available cluster needs at least three master-eligible nodes and separate data tiers for hot, warm, cold and frozen storage. Ask both vendors and your own engineers to size retention for your real event volume, then price the hosts, disks and backups that follow from that number. Rule tuning is the second driver: Wazuh ships over 3,000 built-in rules and decoders, while Elastic's prebuilt detection rules are delivered automatically to its detection engine. Tuning effort depends on your environment, so estimate it with your own analysts.
Staff time is the cost most often left out of the first budget. Ask for a written quote from Elastic that names the tier, the deployment model and the support level, and ask for the same scope from any implementation partner you consider, including who runs upgrades and who tunes rules. Keep one-time costs (design, migration, rule work) separate from recurring costs (licenses, hosts, storage growth, on-call time). For a broader view of the trade-offs, the Wazuh vs Elastic Security comparison covers license, coverage and tier details alongside this cost discussion.
Which cost components each platform actually carries
Wazuh's server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the indexer and dashboard are Apache-2.0, so the open-source components carry no license fee to Wazuh. Elastic's default distribution is under the Elastic License 2.0, and several features that security teams often need sit in paid subscription tiers. Free and open (Basic) covers much of the core stack, but endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on are listed under Enterprise.
- Who pays Elastic: the subscription for each tier you need, on terms set out in the Elastic subscriptions page and your order.
- Platinum is closed to new buyers: the detection engine, machine learning anomaly detection and case management are listed under Platinum, so confirm in writing which tier includes them for a new purchase.
- Who pays Wazuh: no license fee for the open-source components, but your own staff or a services provider carry deployment, tuning and upgrades.
- Recurring versus one-time: Elastic subscriptions recur per term, while the Wazuh license cost is zero and its recurring cost sits in hosting and labor.
Check the tier, node count and subscription term with Elastic in writing, and confirm which features your intended hosting model needs before you treat any license line as final.
Both platforms keep alerts in a search index, so storage is often the largest recurring infrastructure cost and grows with event volume and retention. The Wazuh indexer is an open source fork of OpenSearch, while Elastic Security runs on Elasticsearch, whose data nodes can be arranged into hot, warm, cold and frozen tiers to move older data onto cheaper storage. The storage line in your budget depends more on your log volume and retention choices than on the license.
- Retention drives disk: longer retention and more endpoints raise storage on both platforms, so set retention per data class before you size hardware.
- Tiered storage on Elastic: hot, warm, cold and frozen tiers can lower the cost of older data, but they add node roles and configuration your team must operate.
- Wazuh indexer sizing: the indexer holds alerts, so disk and memory need sizing to your event rate and agent count, using the sizing guidance in Wazuh's deployment documentation.
- Replicas and snapshots: replica count and snapshot storage multiply raw disk use, and both are recurring costs to model in your own environment.
Check by building a storage estimate from your own events per second, retention per log type and replica count, then compare it with both vendors' sizing guidance before buying hardware or cloud capacity.
A highly available Elasticsearch cluster needs at least three master-eligible nodes, and data, ingest and coordinating roles add hosts as volume grows. Wazuh can run the server as a cluster for horizontal scaling, and its indexer is a separate tier you size on its own. Node count drives the compute bill and the patching workload, so compare the topology each vendor documents for the availability you need.
- Minimum for high availability on Elastic: three master-eligible nodes, plus data nodes sized for your shard and replica layout.
- Wazuh server cluster: adds analysis capacity horizontally, so server nodes and indexer nodes scale separately.
- Kubernetes operator: Elastic Cloud on Kubernetes is offered in Basic and Enterprise tiers and reduces manual work, but you still run and pay for the Kubernetes platform beneath it.
- Who runs the hosts: in your cloud or data center you pay for compute, storage and network, and your team patches every node on the cadence each vendor requires.
Check by asking each vendor for the node count, roles and replica layout its reference architecture requires for your endpoint count and availability target, then price each host in your own environment.
Detection content has a running cost even when it is free to download. Wazuh's ruleset ships over 3,000 built-in rules and decoders mapped to MITRE ATT&CK. Elastic's prebuilt rules are developed in the elastic/detection-rules repository and delivered to the Kibana detection engine automatically. On either platform, the recurring expense is analyst time spent suppressing false positives, adjusting thresholds and writing custom detections for your own applications.
- Prebuilt content on both sides: Wazuh ships its rules and decoders with the platform, and Elastic delivers prebuilt rules that you can customize.
- False positive triage: alert volume from default rules drives analyst hours, and tuning work recurs with each new log source you onboard.
- Alert suppression: Elastic lists alert suppression among its detection capabilities, so confirm which tier includes it before you depend on it.
- Custom content: decoders and rules for in-house applications are a labor cost on both platforms, and they survive upgrades only if your team tracks them in version control.
Check by running a pilot on each platform for a fixed period, recording the tuning hours your analysts log, and asking the implementer to estimate tuning scope in writing.
For most SIEM programs, people cost more than software. Elastic sells paid support through its subscription tiers, while the Wazuh open-source license includes no support, so operating the platform falls to your team or to a paid service. Staff time covers platform administration, upgrades, incident response and compliance evidence, and the mix of skills differs between the two stacks. Upgrade timing also shapes labor: Elastic publishes end-of-maintenance dates for each release line.
- Elastic support: compare the support level included in each subscription tier, and ask what response commitments that tier carries.
- Wazuh support: confirm which commercial support or Wazuh Cloud options exist and their terms, since the open-source license does not include them.
- Upgrade schedule: Elastic lists end of maintenance for 8.x on January 15, 2027 and for 9.x on October 15, 2027, and Wazuh's 4.14 line shipped patch releases roughly every one to two months in 2026, so plan upgrade windows on those dates.
- Outside help: most DeployOpen engagements are fixed-scope, with scope and deliverables agreed in writing before work starts, and ongoing support is available as a retainer.
Check by recording the administrator, analyst and on-call hours your team spends today, then asking each vendor or partner which tier or service covers the gap.
What pushes the cost of each platform up or down
Both platforms are free to download under their licenses, so the real spend sits in the infrastructure, the paid tiers and the people who run detections. The cards below show which decisions move those costs most and what to confirm before you ask for a quote.
Data volume and retention
Indexer storage is the cost line that grows fastest on both sides. On Wazuh, the indexer stores alerts and archived events, so daily event volume and how long you keep them set the disk and memory you buy. On Elastic Security, the same logic applies to the Elasticsearch data tiers, where hot, warm, cold and frozen placement changes the hardware bill. Ask each vendor or partner to model your events per second, retention period and replica count before comparing totals.
Endpoint count and agent coverage
Licensing for the core platforms does not scale with agent count, but hardware, network traffic and alert volume do. Wazuh agents run on Linux, Windows, macOS, Solaris, AIX and HP-UX, and agentless devices such as firewalls can be added through syslog. Elastic Agent is managed through Fleet, and Elastic Defend adds endpoint prevention only in the paid tier. Count the hosts you must cover, including the ones that need agentless collection, before you assume the free core covers them.
Paid tier for SSO and prevention
Elastic places SAML and OpenID Connect single sign-on and endpoint malware and ransomware prevention in its Enterprise tier. New self-managed buyers can no longer pick Platinum, so detection engine features and machine learning anomaly alerting follow the Enterprise path or move to Elastic Cloud. Wazuh offers single sign-on in its open documentation, but you should confirm each feature you need against the current edition. List the controls your auditors require before you request a quote.
Rule tuning and false positives
Rules are where staff time goes. Wazuh ships a built-in ruleset with decoders that map alerts to MITRE ATT&CK, but every environment still needs suppression of noisy alerts and custom rules for internal applications. Elastic provides prebuilt detection rules that update automatically from its detection-rules repository, and alert suppression is a paid capability. Estimate the analyst hours for tuning in your own environment, because this recurring work often outweighs the platform fee on both sides.
High availability node counts
A highly available Elasticsearch cluster needs at least three master-eligible nodes, and data nodes add to that count as volume grows. Wazuh can run the server as a cluster for horizontal scaling and the indexer across several nodes, which also means more hosts, load balancing and certificates to maintain. Each extra node adds compute, storage and patching time. Ask for the node layout that meets your recovery objectives and price it as a separate line item.
Upgrade cadence and maintenance windows
Both stacks ship patches often, so upgrade effort recurs. Wazuh shipped 4.14 patch releases on 17 March, 23 April, 1 July, 29 July, 23 September and 14 October 2026, and Elastic maintains 9.x and 8.x lines on separate end-of-life dates. The Elastic core 8.x line reaches end of maintenance on January 15, 2027, and 9.x on October 15, 2027. Budget for staff time to test and roll out each release, and confirm which line your partner will support.
How Elastic subscription tiers map to the features you need
Start by mapping each security feature on your list to an Elastic tier, because the tier decides what you pay for. The detection engine, machine learning anomaly detection and case management sat under the Platinum tier on Elastic's self-managed subscriptions page. Platinum is no longer sold to new customers, so a new self-managed buyer who needs those features is pointed to Elastic Cloud or to a different tier. Endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on are listed under Enterprise. If your requirements include any of these, the Enterprise tier is the line item to price.
Basic is the free tier. Per Elastic's announcement that made security features free in Basic, TLS, the file and native user realms and role-based access control are included at no subscription cost. Single sign-on, Active Directory and LDAP authentication and field- or document-level security stayed in paid tiers. Ask Elastic which of the detection, case management and anomaly features you need are available in the self-managed tier you are considering, and confirm how the current subscription page describes alerting rules based on anomaly detection, since it limits those to Platinum and Enterprise.
Confirm current pricing directly with Elastic rather than relying on any figure in this comparison, since subscription terms change. When requesting a quote, list each feature by name, the node count and the deployment model (self-managed or Elastic Cloud), and ask whether support and the Elastic license term are included. Then compare that quote with the Wazuh side of the cost model, where the server and agents are GPL-2.0 licensed with no license fee, but staffing and infrastructure still apply. Also check the Elastic end-of-life dates for the version you plan to run, so the subscription and upgrade budget covers the support window you will actually get.
How to model the cost in your own environment
This sequence turns a vague comparison into a written, line-by-line cost model that you can test against both platforms and any implementation partner's scope. Each step ends with an artifact you can check before you request quotes.
List required features and map them to tiers
Start by writing down every capability your team needs from the SIEM, such as detection rules, machine learning anomaly detection, case management, single sign-on, endpoint malware prevention and host isolation. For Elastic, check each one against the self-managed subscription page, where detection engine, anomaly detection and case management sit under Platinum, which is no longer sold to new customers, and endpoint prevention, host isolation and SAML or OpenID Connect single sign-on sit under Enterprise. For Wazuh, check which items are covered by the GPL-2.0 server and agents and which need work you would do yourself. The output is a feature register with a tier or license column, reviewed by your security lead and your identity team.
Size data volume and retention per source
List every log source, its average daily event volume and the retention period your compliance obligations and investigations require. Separate hot, searchable data from older data you only need to keep. Ask each vendor how their indexer or Elasticsearch storage sizing works for your ingest rate, replica count and retention, and request that they state the assumptions behind their figures. The output is a per-source sizing sheet that shows total stored terabytes with replicas, which becomes the input for node counts and storage pricing on both sides.
Model indexer and Elasticsearch node counts
Translate the storage sizing into node counts for each platform. For Elastic, use the node roles documentation to plan data tiers and dedicated master-eligible nodes, and remember that a highly available cluster needs at least three master-eligible nodes. For Wazuh, plan the indexer cluster and server nodes from the deployment options your team chooses, and confirm the sizing guidance in the Wazuh documentation for your endpoint count. Include the cost of the hosts, operating system licenses where applicable, backups and the cloud or data center capacity that carries them. The output is a node and host table for a production and a non-production environment, with the HA choice stated explicitly.
Estimate tuning hours for detections and rulesets
Estimate the analyst and engineer hours needed to bring detections to a usable state. On Elastic, this covers reviewing prebuilt rules from the detection rules repository, customizing them, setting alert suppression and tuning noise against your environment. On Wazuh, it covers reviewing the built-in ruleset of more than 3,000 rules and decoders, mapping alerts to your MITRE ATT&CK coverage, writing custom rules and checking compliance dashboards for PCI DSS, GDPR, HIPAA and NIST 800-53. Use your own historical alert volumes to size the work and record the assumptions. The output is a tuning backlog with hours per item, which you can compare across both platforms with the same scope.
Price the staff time for operations and upgrades
Assign hours to recurring work: patching, upgrades, certificate rotation, capacity reviews, backup testing, on-call coverage and agent rollout. Note that Elastic maintains each major release only for a fixed window, and that Wazuh ships 4.14 patch releases roughly every one to two months, so upgrade effort recurs on both sides. Price these hours at your own loaded rates, separating the share of existing staff from any new hires or contractors. The output is an annual staff-hours table with a role for each line, which shows the recurring cost that license fees alone do not capture.
Separate one-time and recurring costs
Group the results into one-time costs such as design, migration, initial tuning, integration and hardening, and recurring costs such as subscriptions, hosting, storage growth, staff time, support retainers and renewals. For Wazuh, the server and agents carry no license fee, but the indexer and dashboard are Apache-2.0 and still need hosts and staff. For Elastic, state the subscription tier and any Elastic Cloud alternative separately. Identify what drives each line up or down, such as endpoint count, ingest rate, retention and the number of detection use cases. The output is a two-column cost model with drivers listed beside each line, ready for review by finance.
Request written quotes against the same scope
Send the same written scope, including the feature register, sizing sheet, node model, tuning backlog and staffing assumptions, to Elastic and to any implementation partner you are considering, including DeployOpen if it fits your scope. Ask Elastic to quote the specific subscription tier and features you listed, and ask partners to itemize hours, deliverables, exclusions and support terms. Because DeployOpen works on fixed scope agreed in writing, expect a quote to follow from that written scope rather than a published price list. The output is a set of quotes that can be compared line by line, which closes the model.
When cost should decide between Wazuh and Elastic Security
Cost should decide when the feature list you need already sits inside what Wazuh ships. The server and agent are GPL-2.0 and the indexer and dashboard are Apache-2.0, so the platform itself carries no license fee. The ruleset includes over 3,000 built-in rules and decoders mapped to MITRE ATT&CK, and the dashboard has prebuilt views for PCI DSS, GDPR, HIPAA and NIST 800-53. In this case the budget moves to people and infrastructure: indexer nodes and disk sized for your retention period, the analysts who tune rules to reduce noise, and the time to test each patch release before rollout. These costs recur, so ask any quote to separate one-time deployment from ongoing tuning and upgrade hours.
Cost does not decide when single sign-on, endpoint prevention or host isolation are mandatory and the Enterprise tier is already budgeted. Elastic lists SAML and OpenID Connect single sign-on, endpoint malware and ransomware prevention and host isolation under Enterprise, and Platinum is closed to new self-managed buyers. A new buyer who needs paid detection features therefore chooses between Enterprise and Elastic Cloud. If that line item exists, the question becomes whether the staff time needed to build equivalent controls on Wazuh costs more than the subscription. Confirm which identity controls your team requires, check them against the Wazuh single sign-on documentation, and map each mandatory control to a named feature before comparing totals.
Confirm the release line before you plan either path. The current Wazuh 4.x release is 4.14.9, published October 14, 2026, but a Wazuh 5.0.0 release candidate appeared on GitHub on October 5, 2026. A release candidate is a poor basis for sizing storage, tuning effort or upgrade windows, so wait for its final release notes and check whether your rules, decoders and integrations carry forward. On the Elastic side, the EOL page lists end of maintenance for 8.x on January 15, 2027 and for 9.x on October 15, 2027, so any Elastic upgrade you budget also needs a dated plan. Ask both vendors and your partner to state their support windows in writing.
Questions buyers ask about Wazuh and Elastic Security costs
Does Wazuh have any license fee?
The Wazuh server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard are Apache-2.0, so the software itself carries no license fee. Your cost is the infrastructure to run it, the staff to install, tune and patch it, and any outside support you buy. Confirm with Wazuh which paid offerings, such as Wazuh Cloud, you might add, since those are separate from the open-source components. Check the Wazuh LICENSE file for the exact terms that apply to each component before you build a budget around them.
Which Elastic tier covers SSO and endpoint prevention?
In Elastic's self-managed subscriptions, SAML or OpenID Connect single sign-on and endpoint malware and ransomware prevention with host isolation sit under the Enterprise tier. The detection engine, machine learning anomaly detection and case management were listed under Platinum, which is closed to new self-managed buyers. Free and open (Basic) covers TLS, the file and native user realms and role-based access control, as Elastic announced in 2019. Confirm the current tier boundaries on the Elastic subscriptions page before you sign, because Elastic can change them.
Can you still buy Elastic Platinum for self-managed deployments?
No, Elastic states that Platinum is no longer available to new customers. New self-managed buyers who need paid security features choose between Basic and Enterprise, or move to Elastic Cloud. This matters for cost because a budget built on Platinum pricing from an older quote is no longer valid. Ask your Elastic representative to quote Enterprise against your node count and features, and ask what happens to existing Platinum agreements at renewal. Confirm the terms in writing rather than relying on past quotes.
What drives indexer storage costs in Wazuh?
Indexer storage is driven by how many alerts and archived events you keep, how long you retain them, and how many endpoints and log sources feed the indexer. Wazuh's indexer is a full-text search and analytics engine that stores alerts, so retention period and event volume set the disk you need. Plan for growth in both agent count and log noise, and tune which events are forwarded to avoid storing data no one reviews. Ask the vendor or your own test environment to measure daily ingestion before you size disks. The same drivers apply to Elastic Security, because Elasticsearch holds the data in both products.
How many nodes does high availability need?
The answer depends on the component. Elasticsearch documents that a highly available cluster needs at least three master-eligible nodes, which is a fixed floor in the Elastic design. For Wazuh, the server can run as a cluster for horizontal scaling, and the indexer can run across multiple nodes, but the exact node count for your scale should come from Wazuh's sizing guidance and your own load tests. Each extra node adds hardware, operating system patching and monitoring, so ask for the node count for each role in any quote. Hot, warm and cold data tiers in Elasticsearch add further nodes if you use them.
How much staff time does rule tuning take?
Tuning time depends on how noisy your sources are, how many rules you enable and how many custom detections you write. Wazuh ships over 3,000 built-in rules and decoders mapped to MITRE ATT&CK, so most of the early effort is reviewing which of those fire in your environment and suppressing the false positives. Elastic Security adds prebuilt detection rules, which Elastic develops in the elastic/detection-rules repository and delivers to the Kibana detection engine automatically. Both platforms need recurring analyst time, and that time is usually the largest ongoing cost. Ask any implementer to estimate tuning hours for your log sources and to state which work is one-time and which recurs.
Can we run this ourselves, or do we need outside help?
Your own team can run either platform if it has Linux, search cluster and detection engineering skills and enough time for upgrades. Wazuh 4.14 has had six patch releases in 2026, so plan for a steady patch cadence. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, usually under a fixed-scope agreement with scope, deliverables and timelines agreed in writing before work starts. Ongoing support and upgrades are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope.
What should we ask for in a cost quote?
Ask for each cost component separately: infrastructure for the indexer, server and dashboard, storage sized to your retention, node counts for each role, licenses for any paid Elastic tier, implementation effort, tuning effort and ongoing support. Ask which items are one-time and which recur each year, and what drives each up or down, such as endpoint count or retention. Request the license terms in writing and the Elastic tier that covers each feature you need. Compare both platforms against the same scope so the numbers reflect the same workload.
What switching later costs in either direction
Switching cost is the part of this decision most teams underestimate, so confirm it before you commit. Wazuh's indexer is an open source fork of OpenSearch, while Elastic Security runs on Elasticsearch and Kibana under the Elastic License 2.0 by default. Those index formats and APIs are related but not interchangeable, so you should not assume that alerts, saved searches or dashboards built on one side will load on the other. Ask both vendors, and your own engineers, which artifacts can be exported in a usable form and which must be rebuilt from scratch.
Rules are the asset most likely to be locked up. Wazuh's ruleset is GPL-2.0 licensed and includes more than 3,000 built-in rules and decoders, so custom rules and decoders written for Wazuh can be kept under your own control and version-controlled. Elastic's detection rules are published in the elastic/detection-rules repository under the Elastic License v2, which permits use but carries its own terms on offering the software as a managed service. Before you migrate, inventory every custom rule, check its license position with counsel if you plan to redistribute it, and budget time to re-express detections in the other engine's language and test them against replayed events.
Agents and retained data carry the largest recurring risk. Wazuh agents can report to a Wazuh server, and the migration guide covers mixed OSSEC and Wazuh agents, but moving endpoints from Elastic Agent and Elastic Defend to Wazuh means redeploying software on every host, reviewing policy coverage and rerunning baseline tests. Historical data is different: re-ingesting months of logs into a new indexer costs storage, compute and time, and you may need to keep the old cluster read-only for compliance retention. Ask each vendor and partner for a written export and re-ingestion plan that names the formats, the throughput assumptions and who performs the work.
How DeployOpen helps you model and implement the cost
DeployOpen plans, implements and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the cost model reflects your real infrastructure. We start from a written scope, build and document the deployment, and hand over the evidence and runbooks your finance and security teams need to check the numbers.
How we scope
- We agree a written scope covering endpoint counts, log volumes and retention before any work starts
- Engagements are fixed-scope, with deliverables and timelines confirmed in writing
- We list the Elastic subscription tier you need and check it against the current self-managed tier availability
- We document which hosts, storage and support staff the cost model assumes, so you can challenge each line
How we build
- We deploy the chosen platform in your infrastructure and size indexer, server and node storage to the agreed scope
- We tune Wazuh rules or Elastic detection rules for your sources so alert volume and rule upkeep are measured, not guessed
- We test authentication, single sign-on and access roles for the features your chosen tier includes
- We record the operating effort for each component so the recurring cost is traceable to actual work
How we hand over
- You receive architecture diagrams, sizing notes and a cost component register that maps each line to who pays for it
- We provide runbooks for upgrades, patch cycles and agent rollout, including the Wazuh 4.14 patch cadence you will follow
- We document licensing assumptions, including which Elastic features depend on paid tiers, for your procurement file
- We give you a list of quote questions to put to vendors and to us, so you can compare offers on the same basis
How we support
- Ongoing support, upgrades and continuous testing are available as retainers
- A retainer can cover re-sizing when endpoint counts or retention requirements change
- We can review the cost model after each Elastic or Wazuh release line changes that affects your deployment
- Support scope, response expectations and fees are confirmed in writing before the retainer starts
