Sentinel vs Splunk Cloud vs Google SecOps: what 50 GB a day costs for three years

The meter matters more than the rate

A 1,000-employee estate sending 50 GB of security telemetry a day is buying three different products. Microsoft Sentinel charges for gigabytes landing in an analytics tier, Splunk charges per gigabyte indexed per day or by compute unit, and Google SecOps draws down a prepaid gigabyte credit balance. Two of the three publish no usable rate, and the one that does publishes no single per-gigabyte figure at all, because rates vary by region. That is the first fact a renewal committee has to accept: there is no list price to compare, only a meter to model.

The meters also behave differently under growth. An ingestion meter charges the moment a log line arrives, and compression or tiering afterwards changes nothing about what has already been paid. A credit balance is predictable until it runs out and then bills overage in arrears, which means the first sign of a problem is an invoice rather than an alert.

What each platform actually bills

The grid below is the part of the comparison that survives a sales call, because it describes mechanics rather than discounts. Rates are the published or independently estimated anchors for 2026, not quotes.

The three-year arithmetic at 50 GB a day

Take the estimates at face value and the arithmetic is not close. At 50 GB a day an estate sends 18,250 GB a year. At the $5.20 per GB pay-as-you-go figure reported for Sentinel in 2026, that is $94,900 a year and about $285,000 over three years. The obvious move is to buy a commitment tier, except that Microsoft's reserved capacity starts at 100 GB a day, so a 50 GB estate committing to the smallest tier buys 36,500 GB a year: at the reported $2.96 per GB for that tier the bill is $108,040 a year, about $324,000 over three years. Committing to double your volume can cost more than staying on pay-as-you-go, which is the kind of finding that only appears when the floor is modelled.

Splunk's anchor is a different shape. One verified customer paid under $100,000 a year for 200 GB a day on ingest pricing, which works out close to $500 per gigabyte per day per year after enterprise discounting. At 50 GB a day that is roughly $25,000 before Enterprise Security, and Enterprise Security is a separate licence that independent estimates put at 50 to 100 percent on top, so call it $37,500 to $50,000 a year, or $113,000 to $150,000 across three years. Google publishes nothing comparable. The one real figure in circulation is a Forrester total economic impact study commissioned by Google, which modelled a composite customer with $8 billion in revenue and 20,000 employees at $575,000 a year in licensing after a 15 percent risk adjustment, a company roughly twenty times the size of the estate in question.

The Microsoft 365 grant is the biggest lever

The Sentinel arithmetic above assumes that every gigabyte is billable, and for a Microsoft-heavy estate that assumption is wrong. Microsoft 365 E5 customers get a daily data grant that covers first-party sources, and the practical effect is that Defender telemetry, Entra ID sign-in and audit logs and several other Microsoft sources stop being the line that grows. For an estate whose identity, endpoint and email already sit in Microsoft, Sentinel's per-gigabyte rate applies to a much smaller volume than the raw total, and the comparison against Splunk changes character entirely.

For an estate without that gravity the advantage disappears. If the cloud is mostly AWS or Google Cloud and the endpoint agent is not Defender, every major source pays the full rate and the gap to Splunk narrows to the difference in operational headcount. The decision is therefore not Sentinel versus Splunk in the abstract; it is how much of the estate already reports into Microsoft, and that is a question about the last three years of purchasing rather than about security.

Retention is the second bill

Every one of these platforms includes some retention and charges for the rest, and the included window is where the comparison is usually won or lost. Sentinel includes 90 days in the analytics tier and meters longer retention, with independent estimates putting extended retention near $0.02 per GB per day. Splunk includes 90 days in the cloud and adds an estimated 30 to 50 percent for longer. Google includes 12 months of hot retention in all three packages, which is the single most useful difference in the table for an estate with a one-year investigation or audit window, because historical searches stop hitting a cold tier.

The trap is treating retention as a storage decision. A 50 GB a day estate holds roughly 18 TB a year before compression, and a compliance obligation to keep a year searchable is a licence question on two of the three platforms and a storage question on Google. Model retention as a separate line with its own growth rate, because it is the line that keeps growing after ingestion volume has been filtered down.

The decision rule

Choose Sentinel if the estate's identity, endpoint and mail already run on Microsoft licences that carry the first-party data grant, and check the commitment floor against your actual daily volume before signing, because the smallest tier can cost more than the meter it replaces. Choose Splunk Cloud if the data is genuinely heterogeneous, the team already writes SPL and the Enterprise Security licence is part of a broader Cisco relationship. Choose Google SecOps if the twelve-month retention window removes a second purchase and the estate is large enough that a prepaid balance beats a per-gigabyte meter.

Then do the thing none of the three makes easy: ask each vendor for the three-year number at 50 GB a day, flat, with retention, support and the security module included, and require the volume assumption in writing. A quote that will not state the daily volume it assumes is not a quote, and it is the reason two estates of the same size can report wildly different costs for the same platform.