- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Gurucul
The leading unified cloud observability platform — metrics, traces, logs, real-user experience and security on ONE platform, with best-in-class correlation (one click: symptom → root cause). Powerful & easy — with an honest guide to the cost. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. One unified observability platform.
The complete Gurucul platform — every linked card is a full intel page, from infrastructure metrics to the real user experience.
Gurucul Next-Gen SIEM
The only Leader on our shelf you can run on your own infrastructure.
SIEM with behavioural analytics built into the core rather than bolted alongside it — UEBA, identity analytics and network traffic analysis run against the same data as the detection rules, so an analyst moves from a risk score to the raw events without switching tools. Gartner's own text confirms it is available as SaaS, cloud or self-hosted, which is the deciding fact for any Indian buyer whose mandate rules out foreign SaaS. Pricing is flexible in an unusual way: per-asset or per-user is offered as an alternative to per-GB metering, though data-volume and EPS options exist too, so confirm which axis your quote actually uses.
Gurucul UEBA
Behavioural analytics from the company that started there.
Gurucul began as a UEBA company in 2010 and grew a SIEM around it, which is the reverse of how most of this market was assembled. The models baseline each user and entity, correlate identity, access and activity data, and score deviation — catching the attacker who signs in correctly with stolen credentials and does permitted things, which is precisely the gap rule-based detection cannot close. It is sold as part of the platform rather than a separate meter. The honest dependency: peer groups are only as good as your identity data, and service accounts need named owners before they need baselines.
Gurucul Open XDR
Detection across your existing tools, weighted by identity.
Ingests telemetry from the endpoint, network and cloud tools you already run rather than requiring you to replace them, then applies identity and access analytics on top so that identity-based attacks — the ones that look like ordinary logins — surface with the context needed to act. The "open" claim is about vendor-neutral data ingestion, and it is worth testing against your actual stack during a proof of concept rather than taking on trust: every XDR vendor claims openness, and the integration depth is what separates them.
Gurucul Identity Analytics
Which access is dangerous, not merely which access exists.
Identity Access Analytics scores entitlements and access patterns for risk rather than simply cataloguing them, surfacing excess privilege, dormant high-risk access and the accumulation that follows people around after a decade of role changes. For Indian BFSI buyers this maps onto the access-review evidence RBI and SEBI expect, and Gurucul publishes India-specific content on SEBI's CSCRF — a sign that the India go-to-market is deliberate rather than incidental. It runs on the same platform as the SIEM, so access risk and detection share one identity model.
Insider Risk Management
Platform & enginePackaged for the insider-threat buyer; the same behavioural engine underneath
Security for AI
Platform & engineRuntime detection for AI workloads — previewed at Black Hat USA 2026, treat as direction
Gurucul is one of 26 SIEM & log management products TechBag carries. The SIEM & log management guide shows how the category splits and which part is yours. →
Why “a Leader you can actually deploy” is the whole story
There are six Leaders in the 2025 Gartner Magic Quadrant for SIEM, and TechBag sells all six. Five of them are cloud-only, or cloud-only where the analytics actually run. So for the Indian buyer whose regulator, contract or security posture requires the platform on infrastructure they control, most of that quadrant is not an expensive option — it is not an option. Gurucul is the exception, and it is Gartner’s own report text rather than a sales deck that says so: Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted— which is what lets you hold 180 days of logs inside Indian jurisdiction on hardware you own, with a commercial vendor contractually behind it rather than a DIY open-source stack. That is the entire case for this page. Everything else — the UEBA heritage, the Pune engineering, the founder still running the company — is supporting evidence.
One platform, not four acquisitions
REVEAL converges SIEM, UEBA, identity analytics, network traffic analysis and SOAR into a single product with one data model. Most of this market was assembled by acquisition, which is why the seams show as separate consoles and duplicated data. Gurucul built the analytics first and the SIEM around it, so the behavioural layer is not an add-on you license separately and reconcile later.
Self-hosted, and that is the whole India argument
Gartner's own Magic Quadrant text states that Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted. Every other 2025 Leader — Microsoft, Splunk, Google, Securonix, Exabeam — is cloud-only or cloud-only at the analytics control plane. For a regulated Indian buyer this is not a feature comparison, it is the difference between a viable shortlist entry and one that compliance will reject.
Behavioural detection as the foundation
A rule only catches what someone thought to write down. A stolen credential signs in correctly, from a plausible place, and accesses what the account is entitled to access — every step permitted, so no rule fires. Baselining each user and entity and scoring deviation is the only way to close that gap, and it is what Gurucul has been building since 2010 rather than something it acquired when the category became fashionable.
Pricing that can decouple from data volume
Gartner records that Gurucul offers all-inclusive per-asset and per-user pricing, enterprise agreements, module-based, data-volume/EPS-based and platform-based options. The per-asset and per-user axes are the interesting ones, because they break the link between logging more and paying more. Note the precision: per-GB options also exist, so the accurate question at quote time is which axis YOUR contract uses, not whether the vendor has a better model available.
Bootstrapped, for better and worse
Fifteen years without a venture round is unusual, and Gurucul markets it deliberately. The upside is real: no investor pressure toward a licence change, an acquisition or a forced exit, and a founder still running the company she started. The downside is equally real, and we would rather say it — this is a sub-$100M boutique competing against Microsoft, Google and Cisco. Weigh that as a vendor-viability question, not a product question.
Start with Infrastructure Monitoring (the core) — then add APM, Logs, Cloud Security and Digital Experience, all correlated on one platform. (And manage the cost — TechBag’s key value.)
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader, 2025
First year as a Leader, promoted from Visionary
Visionary, 2022–2024
Three consecutive years before the promotion
4.9 out of 5
109 reviews — highest rating of the major SIEMs
Overall Leader, I-SIEM
2024 Leadership Compass — note the year
SaaS, cloud or self-hosted
Confirmed in Gartner's own MQ text
Pune engineering since 2013
Gurucul Solutions Pvt Ltd, incorporated June 2013
Absent
Not evaluated in Security Analytics Platforms
Bootstrapped since 2010
No venture rounds — no war chest either
The company in six figures
See the platform, hear the pitch
Gurucul REVEAL — Security Analytics Platform Overview
The platform, presented by Gurucul.
Next-Gen SIEM Overview
The SIEM the 2025 MQ evaluated.
The Gurucul REVEAL Platform: How it Works
How the converged platform fits together.
Where Gurucul sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Gurucul Across Its Platform
Each dot is a Gurucul product: competitive position vs category momentum.
2025 MQ Leader, and self-hostable.
The Unification × Breadth Map
Deployment flexibility and cost control vs the field — and where the Leaders still go deeper.
The only 2025 Leader that self-hosts.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Gurucul?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is forcing the decision?
2. What does your threat model centre on?
3. Where must the platform run?
What being a 2025 MQ Leader actually means
Gurucul's first year as a Leader after three as a Visionary — and why the marketing you will read elsewhere is out of date.
Read →Self-hosting and CERT-In's 180 days
Why the deployment model, not the quadrant, is the fact that decides a regulated Indian shortlist.
Read →Why UEBA-first is different from UEBA-added
Gurucul built analytics first and a SIEM around it. Most competitors did the reverse, and the seams show.
Read →Per-asset, per-user or per-GB
Gurucul offers all three. Which axis your contract lands on is the question that decides your bill.
Read →Gurucul against the other five Leaders
The honest matrix — where a boutique beats Microsoft and Google, and where it plainly does not.
Read →What to confirm in writing before you sign
Air-gap support, the pricing axis, and India data-region status: three answers to get on paper.
Read →The acronym decoder
Every term on these pages, in one place- REVEAL
- Gurucul's platform name — the converged layer carrying SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model.
- UEBA
- User and Entity Behaviour Analytics. Baselines how each user and machine normally behaves and scores deviation, catching attacks that break no rule.
- Identity Access Analytics
- Scoring entitlements and access patterns for risk rather than cataloguing them — excess privilege, dormant access, accumulated permissions.
- Open XDR
- Detection and response across security tools you already own, rather than requiring the vendor's own agent everywhere. Test the openness claim on your stack.
- Self-hosted
- The platform runs on infrastructure you control. Confirmed by Gartner for Gurucul, and the reason a regulated Indian buyer can shortlist it at all.
- Magic Quadrant Leader
- Gartner's top-right quadrant, scoring both execution and vision. Gurucul entered it in 2025; it is not the same as "included in the MQ".
- Visionary
- Strong vision, less proven execution. Gurucul's position for the three years before 2025 — and still what parts of its own website advertise.
- Peer group
- The cohort a user is compared against. Peer-group quality is bounded by your identity data, which is why directory hygiene precedes any UEBA deployment.
- EPS
- Events per second — one of the axes Gurucul can meter on, alongside per-asset, per-user and data volume.
- CERT-In Directions
- India's 2022 rules requiring six-hour incident reporting and 180 days of ICT logs maintained within Indian jurisdiction.
- SEBI CSCRF
- SEBI's Cybersecurity and Cyber Resilience Framework. Gurucul publishes India-specific content mapping to it, which is unusual for a vendor this size.
- Bootstrapped
- Funded from revenue rather than venture capital. Gurucul has taken no institutional rounds in fifteen years and markets that as a stability argument.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Establish the deployment mandate first
Write down whether a regulator, a contract or your own posture requires the platform on infrastructure you control. If it does, that single answer eliminates most of the 2025 Leaders before any feature comparison, and it is the reason Gurucul is on your list.
Get the air-gap answer in writing
Self-hosted is confirmed by Gartner. A fully AIR-GAPPED deployment is marketed but we could not independently verify it, so if you need genuine disconnected operation, make it a written pre-condition rather than an assumption. TechBag obtains this as part of the quote.
Settle which pricing axis your quote uses
Gurucul can meter per asset, per user, per module, by data volume or by EPS. The per-asset and per-user options break the link between logging more and paying more — but per-GB options exist too, so confirm the axis in the order form rather than the brochure.
Ask about India data residency explicitly
The India answer here is self-hosting, not a vendor-run India region — we found no evidence one exists. If you want vendor-hosted SaaS inside India, ask directly and get a written answer before you evaluate features.
Prepare your identity data before the UEBA lands
Behavioural analytics is bounded by directory quality. Peer groups built on a stale directory mean little, and service accounts need named owners before they need baselines. This work improves your posture regardless of which vendor wins.
Weigh vendor scale honestly
Gurucul is a bootstrapped boutique competing with Microsoft, Google and Cisco. That means no investor pressure toward a licence change or a forced exit, and also no war chest. Treat it as a vendor-viability question, decide deliberately, and revisit it at renewal.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Next-Gen SIEM | Quote-only — per asset, per user, per module, by data volume or by EPS | Confirm which axis your order form actually uses | Per-asset or per-user, where you can get it |
| UEBA | Part of the platform rather than a separate meter | Included with the SIEM entitlement | Threat models centred on credentials and insiders |
| Open XDR | Quote-only, platform-based | Ingests the tools you already own | Estates with tools they cannot replace |
| Identity Analytics | Quote-only, on the same platform | Shares one identity model with the SIEM | Access-review evidence for RBI and SEBI |
Quote-only, metered on monitored users plus sources plus modules rather than gigabytes ingested — so the number that decides your bill is your identity count. The cost that surprises is your engineers’ time, not the licence. The compounds across modules. TechBag scopes the tier you actually need AND prices your engineers’ time honestly (Elastic bills USD; GST added).
Five pitfalls that cost buyers quarters
Quoting the Visionary marketing instead of the Leader fact
Parts of Gurucul's own website still advertise "Most Visionary, three consecutive years" — accurate for 2022 to 2024 and superseded in October 2025, when it was promoted to Leader. Quote the current position, and be equally precise the other way: 2025 is its FIRST year as a Leader, so "a Leader for years" would be wrong too. Boards notice when a vendor claim does not survive a search.
Assuming self-hosted means air-gapped
These are different things and the difference matters most to exactly the buyers who care. Self-hosted, Gartner-confirmed, means the platform runs on your infrastructure. Air-gapped means no internet path at all — which affects licensing activation, threat-intelligence updates and support access. We could not independently verify Gurucul's air-gap support; treat it as a written pre-condition, not a given.
Expecting the pricing model to be per-asset by default
Gurucul CAN price per asset or per user, which is genuinely useful and breaks the logging-costs-more dynamic. But Gartner records that it also offers data-volume and EPS-based pricing. Which one you get is a negotiation outcome, not a product property, and buyers who assume the better model end up surprised by the order form.
Deploying UEBA onto an unmaintained directory
Behavioural analytics is only as good as the identity data underneath it. Peer groups built from a stale directory produce confident nonsense, and unowned service accounts generate alerts nobody can adjudicate. Budget the identity hygiene work before the deployment, not after the first month of noise.
Skipping the vendor-scale conversation
A bootstrapped sub-$100M vendor competing against Microsoft and Google is a legitimate choice, and it is also a decision your risk function should make explicitly rather than discover. Ask about roadmap funding, support scale in India, and what happens at renewal. We would rather you ask now than be surprised in year three.
The evaluation kit
The flagship intel page carries an 8-question vendor checklist and an automation-savings calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before relying on them. SOC automation is the fastest line — which is what Nova is aimed at.
Data sovereignty deciding Indian shortlists
CERT-In log localisation, RBI outsourcing rules and DPDP increasingly settle Indian deals before features are compared.
What it means for you
Vendors without a self-hosted path or an India region lose regulated buyers outright, whatever their quadrant.
Identity as the primary attack surface
Stolen credentials and insider misuse now account for a large share of real breaches, and neither breaks a detection rule.
What it means for you
Behavioural analytics stops being a premium add-on and becomes the detection layer that actually catches the incident.
SIEM and UEBA converging into one purchase
Buyers increasingly refuse to license behavioural analytics separately from the platform holding the data.
What it means for you
This favours vendors that built one data model rather than acquiring their way to a suite.
Agentic AI in the SOC workflow
AI-assisted triage and investigation summarisation are shipping across the category, Gurucul included.
What it means for you
Treat vendor productivity statistics as unaudited, and never let an AI layer be the reason you buy the platform underneath it.
Consolidation pressure on mid-market security spend
Indian teams are cutting vendor counts, preferring one platform with adequate coverage over four tools they cannot staff.
What it means for you
Converged platforms win, but only where the convergence is real rather than a shared login page.
Boutique vendors under platform-vendor pressure
Microsoft, Google and Cisco bundle SIEM into estates buyers already own, squeezing independent specialists.
What it means for you
Specialists survive on capability depth and deployment flexibility — exactly the two things Gurucul competes on.
Questions buyers ask about Gurucul
Ready to shortlist Gurucul?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — module scoping, realistic cost estimation and active COST MANAGEMENT, honest comparisons, deployment, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.