Question 1

What is Exabeam New-Scale Analytics?

Accepted Answer

New-Scale Analytics is Exabeam's user and entity behaviour analytics and risk-scoring engine. Where a traditional SIEM detects threats by matching events against rules someone wrote in advance, this builds a statistical baseline of normal behaviour for every user, host, peer group and service account, then scores deviation from it. The practical difference matters. A rule engine can tell you a login came from an unusual country. It cannot easily tell you that a particular finance user logged in at an unusual hour, from an unfamiliar network, touched repositories they never use, and moved ten times their normal data volume — and that those four individually unremarkable facts together describe a compromised account. Behavioural analytics accumulates weighted risk across weak signals until the total is worth an analyst's time. Around that core sit several components. Entity resolution stitches the many identifiers a person has — AD account, email, VPN username, cloud principal — into one identity. Dynamic risk scoring applies weighting adjusted by business context, so a domain administrator's anomaly outranks a contractor's identical one. Threat Center and Smart Timelines assemble evidence into a chronological narrative an analyst reads rather than reconstructs. Exabeam Nova, a set of AI agents scoped to named SOC jobs, handles summarisation, natural-language search and reporting. More recently Exabeam extended the same approach to AI agents themselves — behavioural baselining for autonomous agent activity, which is genuinely early and worth evaluating on its merits rather than assuming maturity.

Question 2

How is it priced?

Accepted Answer

On monitored users, data sources and modules — quote-only, with no published list, and deliberately not metered on gigabytes ingested. The absence of volume metering is the structurally interesting part. When a SIEM bills on data volume it creates an incentive that works directly against security: teams stop onboarding log sources, sample the noisy ones, or shorten retention to control spend, and the resulting blind spots sit exactly where attackers prefer to operate. Volume pricing also makes budgeting adversarial, because a cloud migration or a chatty new application moves your bill without anyone having decided anything. Licensing on users and sources tracks something you control and can forecast — headcount grows predictably, log volume does not. For comparison, Securonix prices on GB/day, and Splunk's history with volume-based licensing is familiar to anyone who has been through a renewal. The portfolio has three licences: New-Scale SIEM (collection, storage, core detection), New-Scale Analytics (this behavioural layer), and New-Scale Fusion (both). Analytics can be bought alone to augment a SIEM you already run, which is usually the decision that determines your cost. What to establish in the vendor conversation: exactly how monitored users are counted — named, active, or every directory object, because the difference is large — what happens when headcount grows mid-term, which modules are included versus separately licensed, and whether Nova is bundled. Get that in your quote rather than from a blog post. TechBag scopes it and quotes in INR with GST.

Question 3

Should I augment my existing SIEM, or replace it?

Accepted Answer

This is the most consequential question on the page, and the answer turns on diagnosing your actual problem correctly. If your SIEM is failing at collection, storage, retention or compliance reporting — it falls over at your volumes, cannot hold logs long enough, or the operational burden is unsustainable — then you have a SIEM problem, and a behavioural layer will not fix it. Consider full replacement, whether that is New-Scale Fusion or a competitor. If your SIEM collects and stores adequately but only catches what someone wrote a rule for, you have a detection problem. That is the augmentation case: keep your existing platform doing the unglamorous work it does acceptably, and add the behavioural layer on top. Exabeam supports feeding from Splunk, Microsoft Sentinel, QRadar and ArcSight without restructuring your ingestion. The commercial and organisational difference is substantial. A SIEM replacement means re-onboarding every log source, rewriting every detection, retraining analysts, running parallel operations during cutover, and negotiating a large multi-year contract — typically several quarters and a business case that reaches the board. Augmentation is a smaller purchase, a shorter project, and often a decision the CISO can make within existing authority. That is frequently the difference between a project that happens and one deferred indefinitely. The honest cost caveat: in augmentation mode you pay for both. This does not reduce your Splunk or Sentinel bill, it adds to it, so the business case must rest on detection value and analyst time saved rather than displacement savings. Anyone presenting augmentation as cost-neutral is being careless with your budget.

Question 4

How does it compare to Securonix and Splunk?

Accepted Answer

Three genuinely different propositions, and TechBag sells across them. Securonix is the closest competitor and in several respects the strongest: also UEBA-led, cloud-native with no self-hosted legacy line to maintain, and a Gartner Magic Quadrant SIEM Leader six consecutive times as of the 2025 report — a longer unbroken run than Exabeam's. If you want a single modern cloud platform from a vendor with no merger integration underway, Securonix is a legitimate winner and we will say so. The trade-offs run the other way on two axes: Securonix prices on GB/day, reintroducing the volume-metering problem, and it is more naturally sold as a platform than as a layer over someone else's SIEM. If your driver is augmenting Splunk rather than replacing it, Exabeam fits that shape better. Splunk is a different category. It is exceptional at collecting, searching and retaining machine data at scale, and dominant for good reasons. Its behavioural analytics has historically been an add-on rather than the centre of the product, and its volume-based pricing is the most common complaint we hear at renewal. Many organisations end up running Splunk for what it is genuinely best at and layering behavioural detection on top — precisely the pattern this product is built for, which makes them more often complements than alternatives. Microsoft Sentinel deserves a mention because it is frequently the real alternative in mid-market deals: if you are Microsoft-committed, already paying for E5, and your SOC is small, Sentinel's own UEBA may be sufficient and materially cheaper. It is weaker on deep behavioural modelling and on heterogeneous non-Microsoft estates, but 'good enough and already paid for' wins a lot of arguments legitimately.

Question 5

What are its real limitations?

Accepted Answer

Five things we would want to know before signing. Baselining takes time: UEBA cannot score deviation from normal until it has learned normal, so expect several weeks before scoring is trustworthy, and treat any promise of immediate value as a warning sign about the salesperson rather than a feature of the product. Plan the business case around a value date months out, not weeks. Tuning is ongoing work rather than a phase: every real environment generates benign anomalies — quarter-end finance behaviour, developers with legitimately unusual access, service accounts that act strangely by design, executives who travel constantly — and suppressing these without suppressing genuine threats requires a named owner. Deployments that disappoint almost always disappoint here, and the pattern is consistent: nobody was assigned, the noise was never tuned out, and the team stopped trusting the scores. Identity data quality is a prerequisite you must meet yourself: entity resolution is the foundation everything rests on, and it depends on AD hygiene and HR feed reliability. Stale accounts, inconsistent naming and unreliable joiner-mover-leaver processes degrade resolution, and the models inherit that. The product will expose your identity data problems; it will not fix them. It is not a SIEM — in augmentation mode something else still collects and retains your logs, and you keep paying for it. And merger integration is still in progress, so get written roadmap commitments for whichever line you buy.

Question 6

Why buy Exabeam New-Scale Analytics through TechBag?

Accepted Answer

Because the single biggest determinant of whether a UEBA deployment succeeds is whether the augment-or-replace decision was made correctly at the start, and the second biggest is whether anyone was assigned to own tuning. Both are questions to settle before a quote, not after — and a vendor has little incentive to steer you toward the smaller purchase. TechBag is Bengaluru-based and sells Exabeam's competitors too, including Securonix, Splunk and Microsoft, which shapes how this conversation goes. A reseller carrying one security vendor has one recommendation; we do not, so we can tell you when this is the wrong answer. On this product we frequently do: if you need a SIEM rather than a detection layer, if you need value inside a quarter, or if your identity data is in poor shape, we will point that out before you spend money rather than after. We will work through your current SIEM's actual detection gaps, your identity data readiness and your realistic staffing before recommending a licence — and if that assessment concludes you should buy Securonix instead, or extend what you already have, we will say so. We also make sure the questions above get asked and answered in writing during the vendor call, including how monitored users are counted and the post-merger roadmap commitment for your line. Those details determine whether year two feels like a good decision. Everything is quoted in INR with GST-compliant invoicing and local support.

Dimension	No / separate AI tool	Exabeam New-Scale Analytics
Detection basis	Rules you wrote in advance	Baselines, and deviation from them
Stolen credentials	Nothing malformed to match	Behaviour is wrong, so it scores
Pricing axis	Per GB ingested — grows on its own	Monitored users — grows with headcount
Deployment	Cloud-only, or on-prem-only	Both, with a mature product each side
Existing SIEM	Rip and replace	Analytics can augment what you have
Investigation	Analyst queries for the timeline	Smart Timelines assembled for them
Honest caveat	—	Two platforms post-merger — ask the roadmap
Best fit	—	Big volume, small team — or on-prem

Dimension	Exabeam	Securonix	Splunk Enterprise Security	Microsoft Sentinel	Elastic Security
Position	UEBA-led SecOps, cloud AND self-hosted	The other UEBA-led vendor	The reference SIEM	SIEM for Microsoft estates	Search-engine-native SIEM
Pricing axis	Monitored users + sources + modules	GB/day, hybrid commitment + PAYG	Ingest or workload — historically costly	Per GB ingested per day	Subscription tier + resources
Behavioural analytics	The founding capability	The founding capability	Available, an add-on heritage	UEBA included	Entity risk scoring
Self-hosted option	LogRhythm SIEM — genuinely on-prem	Cloud-native only	Cloud, on-prem or hybrid	SaaS only, on Azure	Self-managed, even air-gapped
Analyst standing (SIEM MQ 2025)	Long-running MQ presence	Leader, six times running	Leader	Leader	Visionary, not Leader
Augments a SIEM you own	New-Scale Analytics, licensed separately	UEBA available	Buy the platform	Buy the platform	Buy the platform
AI in the SOC	Nova — seven agents, named jobs	Sam, the AI SOC analyst	Cisco AI Assistant	Security Copilot + MCP	Elastic AI Assistant
Talent pool	Smaller than the incumbents	Smaller than the incumbents	SPL — the largest by far	KQL — widely known	Large for the engine, smaller for security
The thing to plan around	Two platforms post-merger — ask the roadmap	Cloud-only; model the GB/day	Cisco integration reshaping roadmap	Azure portal retires 31 Mar 2027	You operate it unless you buy Cloud
Best fit	Large log volume, small team — or on-prem	UEBA-led with Leader standing	Engineers who will build with it	Microsoft-standardised estates	Air-gapped, or existing ELK

Exabeam New-Scale Analytics

The Microsoft platform family

Quick facts

Understand SIEM economics before you buy it

What is it?

A two-copy SIEM architecture vs Elastic’s — the honest table

The five pieces of the platform

Data ingestion

Entity resolution

Behavioural models

Dynamic risk scoring

Threat Center

Twelve capabilities. Draft, analyse, automate.

Bring your own SIEM

Common schema parsing

Entity resolution

Business enrichment

Behavioural profiling

Dynamic risk scoring

Insider threat detection

Lateral movement

Agent Behavior Analytics

Smart Timelines

AI agent assistance

Coverage reporting

Watch Microsoft Defender in action

Introducing New-Scale Analytics — Analyst Workflow

The AI-Driven Exabeam Security Operations Platform

Exabeam SIEM Overview

AI works best where the work already happens.

It buys detection quality without a SIEM migration

Risk scoring attacks alert volume at the right end

Smart Timelines change what tier-one analysts actually do

Pricing that does not punish you for collecting logs

The honest caveats — where this will frustrate you

The honest positioning

The numbers behind the platform

What your Exabeam New-Scale Analytics rollout looks like

Decide augment or replace

Connect the data

Let the models learn

Make it trustworthy

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag Endpoint-Security (EDR/XDR) Grid

In-App Integration × Estate Breadth

Exabeam New-Scale Analytics vs the field

Does Exabeam New-Scale Analytics fit you?

Choose Exabeam if…

Choose Securonix if…

Choose Splunk if…

Choose Microsoft Sentinel if…

Choose Elastic Security if…

Users or gigabytes — which meter suits you?

Three ways to consume it

Augment your SIEM

Inside New-Scale

+ Nova agents

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every SIEM vendor

Questions buyers ask

Ready to evaluate Exabeam New-Scale Analytics?