Question 1

What is Exabeam, and what changed with the LogRhythm merger?

Accepted Answer

Exabeam is a pure-play security operations vendor, founded in 2013 in Foster City, California and backed by Thoma Bravo, best known for UEBA — user and entity behaviour analytics. The core idea is that rules catch what you predicted and baselines catch what you did not: rather than matching events against signatures, Exabeam builds a model of what each user and machine normally does and scores deviation from it, which is how a valid-but-stolen credential surfaces. That case defeats rule-based detection by definition, because nothing malformed ever happens. In July 2024 Exabeam completed a merger with LogRhythm, another established SIEM vendor, under Thoma Bravo ownership. That merger is the most important thing to understand when buying from them today, because of how the combined portfolio was arranged: New-Scale became the cloud-native platform and LogRhythm's competing cloud product, Axon, was retired; LogRhythm SIEM continues as the SELF-HOSTED platform, exclusively on-premises. So the company deliberately answers both the cloud buyer and the on-premises buyer with a mature product on each side, which very few SIEM vendors can. Leadership changed too: Pete Harteveld stepped up from Chief Revenue Officer to CEO in October 2025; Chris O'Malley led the combined company through the integration and then retired. Practical consequence: any comparison written before mid-2024, or any that discusses Axon, is describing a portfolio that no longer exists.

Question 2

How is Exabeam priced?

Accepted Answer

On monitored users, plus sources, plus modules — and quote-only, with no published list. That axis is the single most important commercial fact about Exabeam, because it inverts the cost curve that governs most of this category. A SIEM priced per gigabyte ingested gets more expensive every year whether or not your organisation grows, because log volume grows on its own: more cloud services, more verbose applications, more telemetry per endpoint. Exabeam's meter is your identity count, which grows roughly with your headcount and is therefore far more predictable. Where that helps: an estate with very large log volume relative to a small security team — which describes a great many cloud-native organisations — can find Exabeam substantially cheaper than an ingest-metered competitor for the same coverage. Where it does not: if you have many employees and modest log volume, the arithmetic runs the other way and an ingest-priced SIEM may well be cheaper. There is no shortcut here; you have to model both. The practical advice is to arrive at any evaluation with an accurate count of monitored identities, not just a GB/day estimate — teams that bring only the volume figure cannot meaningfully compare an Exabeam bid against anyone else's. Note also that New-Scale Analytics can be licensed to augment a SIEM you already own, which is a materially smaller purchase than a platform replacement. TechBag scopes the user count and the platform fit, and quotes in INR with GST.

Question 3

New-Scale or LogRhythm SIEM — which one should we buy?

Accepted Answer

In almost every case this is decided by your deployment mandate rather than by comparing features, and that is a genuinely useful thing about the portfolio. If you can use cloud, New-Scale is the answer: it is the platform the combined company standardised on, it is where the AI and analytics investment is going, and Axon's retirement in its favour tells you the direction of travel. If your regulator, contract or board rules out SaaS, LogRhythm SIEM is the answer, and it is a serious one — a mature self-hosted platform with over 1,100 prebuilt correlation rules and a long track record in regulated and government estates, rather than a cloud product bent into an on-premises shape. That distinction matters, because several vendors claim on-premises capability that turns out to mean a hosted appliance with cloud dependencies. For Indian buyers under DPDP, or subject to RBI, SEBI or IRDAI expectations, self-hosted answers both the storage and the processing residency questions by definition, since the data never leaves your infrastructure. The honest caveat, and you should raise it directly with them: any two-platform portfolio after a merger invites a question about where investment goes, and Axon's retirement demonstrates that this company will consolidate where products overlap. New-Scale and LogRhythm SIEM do not overlap — they serve different deployment models — but ask for the roadmap commitment in writing anyway. A vendor confident in its plan will give you one.

Question 4

How does Exabeam compare to Securonix and Splunk?

Accepted Answer

Exabeam and Securonix are the two UEBA-led vendors and they meet each other in most competitive evaluations, so start there. Both built on behavioural analytics rather than rules; both now wrap that in a full SIEM with AI agents on top. The differences that actually decide deals: Securonix has been named a Leader in the Gartner Magic Quadrant for SIEM six consecutive times and meters on GB/day with a hybrid commitment model, while Exabeam meters on monitored users and — crucially — has a genuine self-hosted platform in LogRhythm SIEM. If your mandate rules out cloud, that is often the whole comparison, because Securonix is cloud-native. If you can use cloud, the pricing axis becomes the question: large log volume against a small team favours Exabeam's user-based meter; the reverse favours a volume-based one. Against Splunk, both UEBA vendors are making the same argument — that Splunk gives you the deepest search and content library in the category but leaves the detection quality to you, whereas they ship the behavioural layer as the product. Splunk's counter is real: two decades of content, the largest talent pool by a wide margin, and deployment anywhere. The honest framing is that Splunk is the strongest choice when you have engineers to build with it, and the UEBA vendors are strongest when you need good detections without staffing a detection-engineering team. Also worth shortlisting: Microsoft Sentinel if your estate is Microsoft-shaped, and Elastic Security if cost control or air-gapped deployment dominates. TechBag sells across the field.

Question 5

What is Exabeam Nova, and should we pay for AI agents?

Accepted Answer

Nova is Exabeam's agentic AI suite, and the structure is more informative than the label. Rather than one assistant that claims to help with everything, it is a set of agents scoped to named SOC jobs: threat scoring, investigation, an analyst assistant, rule creation, search, an advisor and visualisation. It spans both the cloud and self-hosted platforms. That scoping is a genuinely good sign — an agent with a defined job can be evaluated against that job, whereas a general assistant can only be evaluated on impressions. Should you pay for it? The honest answer is that you cannot know from a demo. Every SIEM vendor in the market is shipping AI agents right now, all of them demonstrate well on curated data, and the only evidence that means anything is what happens to YOUR alert queue. So make it part of the evaluation rather than a line item you accept on faith: run the agents against your own noisy, real alerts during the trial, and measure whether analysts actually accept the agents' conclusions or quietly re-do the work. If they re-do it, the productivity claim is not landing in your environment regardless of what it does elsewhere. What is fair to say is that AI-assisted triage is where this whole category is going, and buying a SIEM in 2026 without a credible answer here would be short-sighted. Just insist the answer is demonstrated on your data. TechBag will structure the evaluation so that it is.

Question 6

Why buy Exabeam through TechBag?

Accepted Answer

Because the two decisions that set your cost with Exabeam are ones a vendor has no incentive to help you get right. The first is which half of the portfolio you actually need — New-Scale if you can use cloud, LogRhythm SIEM if you cannot — and TechBag settles that against your real mandate rather than a preference, including being clear about what self-hosted does for your residency obligations under DPDP or RBI, SEBI and IRDAI expectations. The second is the meter: Exabeam prices on monitored users, sources and modules rather than gigabytes, so we count identities properly and model that bill against the ingest-priced alternatives, because that comparison is the one that decides whether Exabeam is cheap or expensive for your specific shape. We will also tell you when the smaller purchase is the right one: if your log platform is fine and the problem is that nobody trusts its alerts, New-Scale Analytics on top of your existing SIEM is a far smaller decision than replacing it, and that option rarely gets volunteered. Beyond scoping: putting the post-merger roadmap question to them in writing, structuring the Nova evaluation so the AI claims are tested on your own alert queue rather than a curated demo, and being honest when a different vendor fits better — we sell Splunk, Microsoft Sentinel and Elastic too. Quoted in INR with GST-compliant invoicing and local support.

Product	Licensing model	How you enter	Best for
New-Scale SIEM	Monitored users + sources + modules; quote-only, cloud-delivered	Monitored users + sources + modules; quote-only, cloud-delivered	Monitored users + sources + modules; quote-only, cloud-delivered
New-Scale Analytics	Same axis; can be licensed to augment a third-party SIEM	Same axis; can be licensed to augment a third-party SIEM	Same axis; can be licensed to augment a third-party SIEM
Exabeam Nova	Module across both platforms; quote-only	Module across both platforms; quote-only	Module across both platforms; quote-only
LogRhythm SIEM	Self-hosted licensing; you supply and run the infrastructure	Self-hosted licensing; you supply and run the infrastructure	Self-hosted licensing; you supply and run the infrastructure

Exabeam

Five intel pages. One unified observability platform.

Exabeam New-Scale SIEM

Exabeam New-Scale Analytics

Exabeam Nova

LogRhythm SIEM

Agent Behavior Analytics

NetMon

Why “unified observability, one click to root cause” is the whole story

Behaviour, not signatures

Two platforms, deliberately

Priced on attention, not volume

Analytics you can buy separately

The roadmap question is fair

Peer & market recognition

Gartner MQ for SIEM

Google Cloud Partner of the Year 2026

July 2024

UEBA heritage

1,100+ correlation rules

Recorded Future partnership

Two deployment answers

Thoma Bravo backing

The company in six figures

See the platform, hear the pitch

The AI-Driven Exabeam Security Operations Platform Overview

Exabeam SIEM Overview

Introducing New-Scale Analytics — Analyst Workflow

Where Exabeam sits — the grids

Exabeam Across Its Platform

The Unification × Breadth Map

New to this? Learn it properly.

Where should you start with Exabeam?

What is UEBA, and why does it matter?

Two platforms after a merger — which is yours?

Priced on users, not gigabytes

Adding analytics to a SIEM you already own

What agentic AI actually does in a SOC

Exabeam vs Securonix vs Splunk

The acronym decoder

Buy it like you’ve done this before

Settle deployment before anything else

Count monitored users, not gigabytes

Decide whether you are replacing or augmenting

Ask the roadmap question directly

Test the AI on your own alerts

Get it quoted in INR with GST

The licensing cheat-sheet

Five pitfalls that cost buyers quarters

Reading a pre-2024 comparison

Estimating in gigabytes

Assuming on-prem means second-class

Buying the platform when you needed the layer

Taking AI productivity claims on trust

The evaluation kit

Skip the homework entirely

The forces shaping this market

Category momentum — estimated market growth

Agentic AI in the SOC

UEBA as the differentiator again

Post-merger consolidation

Non-human identity monitoring

On-prem demand is not going away

Pricing axis as strategy

Questions buyers ask about Exabeam

Ready to shortlist Exabeam?