Question 1

What is Exabeam, and what changed with the LogRhythm merger?

Accepted Answer

Exabeam is a pure-play security operations vendor, founded in 2013 in Foster City, California and backed by Thoma Bravo, best known for UEBA — user and entity behaviour analytics. The core idea is that rules catch what you predicted and baselines catch what you did not: rather than matching events against signatures, Exabeam builds a model of what each user and machine normally does and scores deviation from it, which is how a valid-but-stolen credential surfaces. That case defeats rule-based detection by definition, because nothing malformed ever happens. In July 2024 Exabeam completed a merger with LogRhythm, another established SIEM vendor, under Thoma Bravo ownership. That merger is the most important thing to understand when buying from them today, because of how the combined portfolio was arranged: New-Scale became the cloud-native platform and LogRhythm's competing cloud product, Axon, was retired; LogRhythm SIEM continues as the SELF-HOSTED platform, exclusively on-premises. So the company deliberately answers both the cloud buyer and the on-premises buyer with a mature product on each side, which very few SIEM vendors can. Leadership changed too: Pete Harteveld stepped up from Chief Revenue Officer to CEO in October 2025; Chris O'Malley led the combined company through the integration and then retired. Practical consequence: any comparison written before mid-2024, or any that discusses Axon, is describing a portfolio that no longer exists.

Question 2

How is Exabeam priced?

Accepted Answer

By data volume. Exabeam’s own Americas price list, effective 1 August 2023 and published by resellers, sells SIEM, Security Analytics and Fusion as one-year cloud subscriptions sized by GB ingested per day — for example US$36,000 a year for SIEM up to 50 GB/day and US$51,000 for Fusion at the same volume. That list is dated and American, and an India quote will differ, but it settles the axis: like most of the category, the bill follows ingest. Older write-ups describing per-user Exabeam licensing do not describe this price list. The practical advice is to measure daily volume per source, filter logs with no detection value before they reach the meter, and ask what happens when you outgrow a tier. LogRhythm SIEM is different: subscription or perpetual licences on what Exabeam calls an unlimited-data model, with you running the infrastructure. New-Scale Analytics can also be bought alone to augment a SIEM you already own. TechBag sizes it and quotes in INR with GST.

Question 3

New-Scale or LogRhythm SIEM — which one should we buy?

Accepted Answer

In almost every case this is decided by your deployment mandate rather than by comparing features, and that is a genuinely useful thing about the portfolio. If you can use cloud, New-Scale is the answer: it is the platform the combined company standardised on, it is where the AI and analytics investment is going, and Axon's retirement in its favour tells you the direction of travel. If your regulator, contract or board rules out SaaS, LogRhythm SIEM is the answer, and it is a serious one — a mature self-hosted platform with over 1,100 prebuilt correlation rules and a long track record in regulated and government estates, rather than a cloud product bent into an on-premises shape. That distinction matters, because several vendors claim on-premises capability that turns out to mean a hosted appliance with cloud dependencies. For Indian buyers under DPDP, or subject to RBI, SEBI or IRDAI expectations, self-hosted answers both the storage and the processing residency questions by definition, since the data never leaves your infrastructure. The honest caveat, and you should raise it directly with them: any two-platform portfolio after a merger invites a question about where investment goes, and Axon's retirement demonstrates that this company will consolidate where products overlap. New-Scale and LogRhythm SIEM do not overlap — they serve different deployment models — but ask for the roadmap commitment in writing anyway. A vendor confident in its plan will give you one.

Question 4

How does Exabeam compare to Securonix and Splunk?

Accepted Answer

Exabeam and Securonix are the two UEBA-led vendors and they meet each other in most competitive evaluations, so start there. Both built on behavioural analytics rather than rules; both now wrap that in a full SIEM with AI agents on top. The differences that actually decide deals: both were Leaders in the 2025 Gartner Magic Quadrant for SIEM — Securonix for the sixth consecutive time, Exabeam for the sixth time overall — and both price on data volume, but Exabeam has a genuine self-hosted platform in LogRhythm SIEM. If your mandate rules out cloud, that is often the whole comparison, because Securonix is cloud-native. If you can use cloud, compare detections on your own data and model both bids at the same daily ingest. Against Splunk, both UEBA vendors are making the same argument — that Splunk gives you the deepest search and content library in the category but leaves the detection quality to you, whereas they ship the behavioural layer as the product. Splunk's counter is real: two decades of content, the largest talent pool by a wide margin, and deployment anywhere. The honest framing is that Splunk is the strongest choice when you have engineers to build with it, and the UEBA vendors are strongest when you need good detections without staffing a detection-engineering team. Also worth shortlisting: Microsoft Sentinel if your estate is Microsoft-shaped, and Elastic Security if cost control or air-gapped deployment dominates. TechBag sells across the field.

Question 5

What is Exabeam Nova, and should we pay for AI agents?

Accepted Answer

Nova is Exabeam's agentic AI suite, and the structure is more informative than the label. Rather than one assistant that claims to help with everything, it is a set of agents scoped to named SOC jobs: threat scoring, investigation, an analyst assistant, rule creation, search, an advisor and visualisation. It runs on New-Scale, and LogRhythm SIEM customers reach it through the cloud-hybrid LogRhythm Intelligence add-on. That scoping is a genuinely good sign — an agent with a defined job can be evaluated against that job, whereas a general assistant can only be evaluated on impressions. Should you pay for it? The honest answer is that you cannot know from a demo. Every SIEM vendor in the market is shipping AI agents right now, all of them demonstrate well on curated data, and the only evidence that means anything is what happens to YOUR alert queue. So make it part of the evaluation rather than a line item you accept on faith: run the agents against your own noisy, real alerts during the trial, and measure whether analysts actually accept the agents' conclusions or quietly re-do the work. If they re-do it, the productivity claim is not landing in your environment regardless of what it does elsewhere. What is fair to say is that AI-assisted triage is where this whole category is going, and buying a SIEM in 2026 without a credible answer here would be short-sighted. Just insist the answer is demonstrated on your data. TechBag will structure the evaluation so that it is.

Question 6

Why buy Exabeam through TechBag?

Accepted Answer

Because the two decisions that set your cost with Exabeam are ones a vendor has no incentive to help you get right. The first is which half of the portfolio you actually need — New-Scale if you can use cloud, LogRhythm SIEM if you cannot — and TechBag settles that against your real mandate rather than a preference, including being clear about what self-hosted does for your residency obligations under DPDP or RBI, SEBI and IRDAI expectations. The second is sizing: the cloud subscriptions follow GB ingested per day, so we measure your volume source by source and show which feeds are worth their tier before you quote. We will also tell you when the smaller purchase is the right one: if your log platform is fine and the problem is that nobody trusts its alerts, New-Scale Analytics on top of your existing SIEM is a far smaller decision than replacing it, and that option rarely gets volunteered. Beyond scoping: putting the post-merger roadmap question to them in writing, structuring the Nova evaluation so the AI claims are tested on your own alert queue rather than a curated demo, and being honest when a different vendor fits better — we sell Splunk, Microsoft Sentinel and Elastic too. Quoted in INR with GST-compliant invoicing and local support.

Product	Licensing model	How you enter	Best for
New-Scale SIEM	One-year subscription sized by GB ingested per day	2023 US list: $36,000/yr up to 50 GB/day	Cloud-capable estates
New-Scale Analytics	GB per day; can augment a third-party SIEM	2023 US list: $31,000/yr up to 50 GB/day	SIEMs whose alerts nobody trusts
Exabeam Nova	Licensing not published — quote-only	On New-Scale; LogRhythm via cloud-hybrid add-on	Triage backlogs, proven in a trial
LogRhythm SIEM	Subscription or perpetual, unlimited-data model	You supply and run the infrastructure	Mandates that rule out SaaS

Exabeam

Four intel pages. Two platforms, one behavioural core.

Exabeam New-Scale SIEM

Exabeam New-Scale Analytics

Exabeam Nova

LogRhythm SIEM

Agent Behavior Analytics

NetMon

Why “behaviour, not signatures” is the whole story

Behaviour, not signatures

Two platforms, deliberately

A 2025 Gartner Leader

Analytics you can buy separately

The roadmap question is fair

Peer & market recognition

Leader, 2025

Google Cloud Partner of the Year 2026

July 2024

UEBA heritage

1,100+ correlation rules

Recorded Future partnership

Two deployment answers

Thoma Bravo backing

The company in six figures

See the platform, hear the pitch

The AI-Driven Exabeam Security Operations Platform Overview

Exabeam SIEM Overview

Introducing New-Scale Analytics — Analyst Workflow

Where Exabeam sits — the grids

Exabeam Across Its Platform

The Detection × Deployment Map

New to this? Learn it properly.

Where should you start with Exabeam?

What is UEBA, and why does it matter?

Two platforms after a merger — which is yours?

Sizing a SIEM by daily ingest

Adding analytics to a SIEM you already own

What agentic AI actually does in a SOC

Exabeam vs Securonix vs Splunk

The acronym decoder

Buy it like you’ve done this before

Settle deployment before anything else

Measure daily ingest, source by source

Decide whether you are replacing or augmenting

Ask the roadmap question directly

Test the AI on your own alerts

Get it quoted in INR with GST

The licensing cheat-sheet

Five pitfalls that cost buyers quarters

Reading a pre-2024 comparison

Trusting per-user pricing write-ups

Assuming on-prem means second-class

Buying the platform when you needed the layer

Taking AI productivity claims on trust

The evaluation kit

Skip the homework entirely

The forces shaping this market

Category momentum — estimated market growth

Agentic AI in the SOC

UEBA as the differentiator again

Post-merger consolidation

Non-human identity monitoring

On-prem demand is not going away

Ingest filtering as cost control

Questions buyers ask about Exabeam

Ready to shortlist Exabeam?