Question 1

What is Exabeam New-Scale Analytics?

Accepted Answer

New-Scale Analytics is Exabeam's user and entity behaviour analytics and risk-scoring engine. Where a traditional SIEM detects threats by matching events against rules someone wrote in advance, this builds a statistical baseline of normal behaviour for every user, host, peer group and service account, then scores deviation from it. The practical difference matters. A rule engine can tell you a login came from an unusual country. It cannot easily tell you that a particular finance user logged in at an unusual hour, from an unfamiliar network, touched repositories they never use, and moved ten times their normal data volume — and that those four individually unremarkable facts together describe a compromised account. Behavioural analytics accumulates weighted risk across weak signals until the total is worth an analyst's time. Around that core sit several components. Entity resolution stitches the many identifiers a person has — AD account, email, VPN username, cloud principal — into one identity. Dynamic risk scoring applies weighting adjusted by business context, so a domain administrator's anomaly outranks a contractor's identical one. Threat Center and Smart Timelines assemble evidence into a chronological narrative an analyst reads rather than reconstructs. Exabeam Nova, a set of AI agents scoped to named SOC jobs, handles summarisation, natural-language search and reporting. More recently Exabeam extended the same approach to AI agents themselves — behavioural baselining for autonomous agent activity, which is genuinely early and worth evaluating on its merits rather than assuming maturity.

Question 2

How is it priced?

Accepted Answer

By daily ingest. Exabeam’s own Americas price list, effective 1 August 2023 and published by resellers, sells Security Analytics as one-year subscriptions sized by GB ingested per day — US$31,000 a year up to 50 GB/day, US$52,000 up to 100 GB/day and US$355,000 up to 1,000 GB/day. Fusion, which bundles SIEM and analytics, starts at US$51,000 for 50 GB/day. These are dated US list prices, not an India quote. The portfolio today has three licences — New-Scale SIEM, New-Scale Analytics and New-Scale Fusion — and Analytics can be bought alone to augment a SIEM you already run. In overlay mode you choose what to send, so scope the feed to identity, authentication, endpoint and cloud-control-plane logs rather than everything. Ask which modules, and whether Nova, are included. TechBag scopes it and quotes in INR with GST.

Question 3

Should I augment my existing SIEM, or replace it?

Accepted Answer

This is the most consequential question on the page, and the answer turns on diagnosing your actual problem correctly. If your SIEM is failing at collection, storage, retention or compliance reporting — it falls over at your volumes, cannot hold logs long enough, or the operational burden is unsustainable — then you have a SIEM problem, and a behavioural layer will not fix it. Consider full replacement, whether that is New-Scale Fusion or a competitor. If your SIEM collects and stores adequately but only catches what someone wrote a rule for, you have a detection problem. That is the augmentation case: keep your existing platform doing the unglamorous work it does acceptably, and add the behavioural layer on top. Exabeam supports feeding from Splunk, Microsoft Sentinel, QRadar and OpenText Enterprise Security Manager (formerly ArcSight ESM) without restructuring your ingestion. The commercial and organisational difference is substantial. A SIEM replacement means re-onboarding every log source, rewriting every detection, retraining analysts, running parallel operations during cutover, and negotiating a large multi-year contract — typically several quarters and a business case that reaches the board. Augmentation is a smaller purchase, a shorter project, and often a decision the CISO can make within existing authority. That is frequently the difference between a project that happens and one deferred indefinitely. The honest cost caveat: in augmentation mode you pay for both. This does not reduce your Splunk or Sentinel bill, it adds to it, so the business case must rest on detection value and analyst time saved rather than displacement savings. Anyone presenting augmentation as cost-neutral is being careless with your budget.

Question 4

How does it compare to Securonix and Splunk?

Accepted Answer

Three genuinely different propositions, and TechBag sells across them. Securonix is the closest competitor and in several respects the strongest: also UEBA-led, cloud-native with no self-hosted legacy line to maintain, and a Gartner Magic Quadrant SIEM Leader six consecutive times as of the 2025 report — a longer unbroken run than Exabeam's. If you want a single modern cloud platform from a vendor with no merger integration underway, Securonix is a legitimate winner and we will say so. The trade-off runs the other way on one axis: Securonix is more naturally sold as a platform than as a layer over someone else's SIEM (both vendors price on data volume). If your driver is augmenting Splunk rather than replacing it, Exabeam fits that shape better. Splunk is a different category. It is exceptional at collecting, searching and retaining machine data at scale, and dominant for good reasons. Its behavioural analytics has historically been an add-on rather than the centre of the product, and its volume-based pricing is the most common complaint we hear at renewal. Many organisations end up running Splunk for what it is genuinely best at and layering behavioural detection on top — precisely the pattern this product is built for, which makes them more often complements than alternatives. Microsoft Sentinel deserves a mention because it is frequently the real alternative in mid-market deals: if you are Microsoft-committed, already paying for E5, and your SOC is small, Sentinel's own UEBA may be sufficient and materially cheaper. It is weaker on deep behavioural modelling and on heterogeneous non-Microsoft estates, but 'good enough and already paid for' wins a lot of arguments legitimately.

Question 5

What are its real limitations?

Accepted Answer

Five things we would want to know before signing. Baselining takes time: UEBA cannot score deviation from normal until it has learned normal, so expect several weeks before scoring is trustworthy, and treat any promise of immediate value as a warning sign about the salesperson rather than a feature of the product. Plan the business case around a value date months out, not weeks. Tuning is ongoing work rather than a phase: every real environment generates benign anomalies — quarter-end finance behaviour, developers with legitimately unusual access, service accounts that act strangely by design, executives who travel constantly — and suppressing these without suppressing genuine threats requires a named owner. Deployments that disappoint almost always disappoint here, and the pattern is consistent: nobody was assigned, the noise was never tuned out, and the team stopped trusting the scores. Identity data quality is a prerequisite you must meet yourself: entity resolution is the foundation everything rests on, and it depends on AD hygiene and HR feed reliability. Stale accounts, inconsistent naming and unreliable joiner-mover-leaver processes degrade resolution, and the models inherit that. The product will expose your identity data problems; it will not fix them. It is not a SIEM — in augmentation mode something else still collects and retains your logs, and you keep paying for it. And merger integration is still in progress, so get written roadmap commitments for whichever line you buy.

Question 6

Why buy Exabeam New-Scale Analytics through TechBag?

Accepted Answer

Because the single biggest determinant of whether a UEBA deployment succeeds is whether the augment-or-replace decision was made correctly at the start, and the second biggest is whether anyone was assigned to own tuning. Both are questions to settle before a quote, not after — and a vendor has little incentive to steer you toward the smaller purchase. TechBag is Bengaluru-based and sells Exabeam's competitors too, including Securonix, Splunk and Microsoft, which shapes how this conversation goes. A reseller carrying one security vendor has one recommendation; we do not, so we can tell you when this is the wrong answer. On this product we frequently do: if you need a SIEM rather than a detection layer, if you need value inside a quarter, or if your identity data is in poor shape, we will point that out before you spend money rather than after. We will work through your current SIEM's actual detection gaps, your identity data readiness and your realistic staffing before recommending a licence — and if that assessment concludes you should buy Securonix instead, or extend what you already have, we will say so. We also make sure the questions above get asked and answered in writing during the vendor call, including which ingest tier fits the sources you send and the post-merger roadmap commitment for your line. Those details determine whether year two feels like a good decision. Everything is quoted in INR with GST-compliant invoicing and local support.

Dimension	Rule-based detection alone	Exabeam New-Scale Analytics
Detection basis	Rules you wrote in advance	Baselines per user, host and service account
Stolen credentials	Nothing malformed to match	Deviation accumulates into a risk score
Existing SIEM	Rip and replace to get UEBA	Feed Splunk, Sentinel or QRadar data across
Alert volume	Every anomaly fires on its own	Weak signals surface only when they add up
Investigation	Pivot across consoles	Smart Timelines assembled automatically
Pricing axis	Bundled into the SIEM price	Daily-ingest tiers, alone or in Fusion
Honest caveat	—	Weeks of baselining; overlay adds to SIEM spend
Best fit	—	SIEMs that work, alerts nobody trusts

Dimension	Exabeam	Securonix	Splunk Enterprise Security	Microsoft Sentinel	Elastic Security
Position	UEBA-led SecOps, cloud AND self-hosted	The other UEBA-led vendor	The reference SIEM	SIEM for Microsoft estates	Search-engine-native SIEM
Pricing axis	GB ingested per day, tiered	GB/day, hybrid commitment + PAYG	Ingest or workload — historically costly	Per GB ingested per day	Subscription tier + resources
Behavioural analytics	The founding capability	The founding capability	Available, an add-on heritage	UEBA included	Entity risk scoring
Self-hosted option	LogRhythm SIEM — genuinely on-prem	Cloud-native only	Cloud, on-prem or hybrid	SaaS only, on Azure	Self-managed, even air-gapped
Analyst standing (SIEM MQ 2025)	Leader — sixth time	Leader, six times running	Leader	Leader	Visionary, not Leader
Augments a SIEM you own	New-Scale Analytics, licensed separately	UEBA available	Buy the platform	Buy the platform	Buy the platform
AI in the SOC	Nova — seven agents, named jobs	Sam, the AI SOC analyst	Cisco AI Assistant	Security Copilot + MCP	Elastic AI Assistant
Talent pool	Smaller than the incumbents	Smaller than the incumbents	SPL — the largest by far	KQL — widely known	Large for the engine, smaller for security
The thing to plan around	Two platforms post-merger — ask the roadmap	Cloud-only; model the GB/day	Cisco integration reshaping roadmap	Azure portal retires 31 Mar 2027	You operate it unless you buy Cloud
Best fit	UEBA-led detection — cloud or on-prem	UEBA-led with Leader standing	Engineers who will build with it	Microsoft-standardised estates	Air-gapped, or existing ELK

Exabeam New-Scale Analytics

The Exabeam platform family

Quick facts

Understand SIEM economics before you buy it

What is it?

A rules-only SIEM vs Exabeam New-Scale Analytics — the honest table

The five pieces of New-Scale Analytics

Data ingestion

Entity resolution

Behavioural models

Dynamic risk scoring

Threat Center

Twelve capabilities. Resolve, baseline, score.

Bring your own SIEM

Common schema parsing

Entity resolution

Business enrichment

Behavioural profiling

Dynamic risk scoring

Insider threat detection

Lateral movement

Agent Behavior Analytics

Smart Timelines

AI agent assistance

Coverage reporting

Watch Exabeam New-Scale Analytics in action

Introducing New-Scale Analytics — Analyst Workflow

The AI-Driven Exabeam Security Operations Platform

Exabeam SIEM Overview

Better detections without a SIEM migration.

It buys detection quality without a SIEM migration

Risk scoring attacks alert volume at the right end

Smart Timelines change what tier-one analysts actually do

Overlay pricing follows what you send it

The honest caveats — where this will frustrate you

The honest positioning

The numbers behind the platform

What your Exabeam New-Scale Analytics rollout looks like

Decide augment or replace

Connect the data

Let the models learn

Make it trustworthy

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag SIEM Grid

Detection Depth × Cost of Entry

Exabeam New-Scale Analytics vs the field

Does Exabeam New-Scale Analytics fit you?

Choose Exabeam if…

Choose Securonix if…

Choose Splunk if…

Choose Microsoft Sentinel if…

Choose Elastic Security if…

What does your daily ingest cost — and what does growth add?

Three ways to consume it

Augment your SIEM

Inside New-Scale

+ Nova agents

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every UEBA vendor

Questions buyers ask

Ready to evaluate Exabeam New-Scale Analytics?