- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Gurucul
The 2025 Gartner SIEM Leader you can self-host — SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model, available as SaaS, in your cloud or on your own hardware. Honest about the limits too: air-gap unverified, no India storage region found. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One converged platform.
The Gurucul portfolio on TechBag — every linked card is a full intel page, from the SIEM Gartner named a Leader to the identity analytics beneath it.
Gurucul Next-Gen SIEM
Only 2025 Gartner SIEM Leader you can self-host.
SIEM with UEBA and identity analytics built into the core, as SaaS, cloud or self-hosted; per-asset or per-user pricing offered.
Gurucul UEBA
UEBA from the company that started there.
Founded as a UEBA company in 2010; baselines each user and entity to catch attackers signing in with stolen credentials.
Gurucul Open XDR
Detection across your tools, weighted by identity.
Ingests telemetry from the endpoint, network and cloud tools you already run, then applies identity analytics on top.
Gurucul Identity Analytics
Which access is dangerous, not just which exists.
Scores entitlements and access for risk, surfacing excess privilege and dormant high-risk access for RBI and SEBI reviews.
Insider Risk Management
Platform & enginePackaged for the insider-threat buyer; the same behavioural engine underneath
Security for AI
Platform & engineRuntime detection for AI workloads — previewed at Black Hat USA 2026, treat as direction
Gurucul is one of 35 SIEM & log management products TechBag carries. The Security guide shows how the category splits and which part is yours. →
Why “a Leader you can actually deploy” is the whole story
There are six Leaders in the 2025 Gartner Magic Quadrant for SIEM, and TechBag sells all six. Five of them are cloud-only, or cloud-only where the analytics actually run. So for the Indian buyer whose regulator, contract or security posture requires the platform on infrastructure they control, most of that quadrant is not an expensive option — it is not an option. Gurucul is the exception, and it is Gartner’s own report text rather than a sales deck that says so: Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted— which is what lets you hold 180 days of logs inside Indian jurisdiction on hardware you own, with a commercial vendor contractually behind it rather than a DIY open-source stack. That is the entire case for this page. Everything else — the UEBA heritage, the Pune engineering, the founder still running the company — is supporting evidence.
One platform, not four acquisitions
REVEAL converges SIEM, UEBA, identity analytics, network traffic analysis and SOAR into a single product with one data model. Most of this market was assembled by acquisition, which is why the seams show as separate consoles and duplicated data. Gurucul built the analytics first and the SIEM around it, so the behavioural layer is not an add-on you license separately and reconcile later.
Self-hosted, and that is the whole India argument
Gartner's own Magic Quadrant text states that Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted. Every other 2025 Leader — Microsoft, Splunk, Google, Securonix, Exabeam — is cloud-only or cloud-only at the analytics control plane. For a regulated Indian buyer this is not a feature comparison, it is the difference between a viable shortlist entry and one that compliance will reject.
Behavioural detection as the foundation
A rule only catches what someone thought to write down. A stolen credential signs in correctly, from a plausible place, and accesses what the account is entitled to access — every step permitted, so no rule fires. Baselining each user and entity and scoring deviation is the only way to close that gap, and it is what Gurucul has been building since 2010 rather than something it acquired when the category became fashionable.
Pricing that can decouple from data volume
Gartner records that Gurucul offers all-inclusive per-asset and per-user pricing, enterprise agreements, module-based, data-volume/EPS-based and platform-based options. The per-asset and per-user axes are the interesting ones, because they break the link between logging more and paying more. Note the precision: per-GB options also exist, so the accurate question at quote time is which axis YOUR contract uses, not whether the vendor has a better model available.
Bootstrapped, for better and worse
Fifteen years without a venture round is unusual, and Gurucul markets it deliberately. The upside is real: no investor pressure toward a licence change, an acquisition or a forced exit, and a founder still running the company she started. The downside is equally real, and we would rather say it — this is a sub-$100M boutique competing against Microsoft, Google and Cisco. Weigh that as a vendor-viability question, not a product question.
Start with the deployment question — SaaS, your cloud or your own hardware — then decide which of the SIEM, UEBA, Open XDR and identity analytics you need on top.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader, 2025
First year as a Leader, promoted from Visionary
Visionary, 2022–2024
Three consecutive years before the promotion
4.9 out of 5
109 reviews — highest rating of the major SIEMs
Overall Leader, I-SIEM
2024 Leadership Compass — note the year
SaaS, cloud or self-hosted
Confirmed in Gartner's own MQ text
Pune engineering since 2013
Gurucul Solutions Pvt Ltd, incorporated June 2013
Absent
Not evaluated in Security Analytics Platforms
Bootstrapped since 2010
No venture rounds — no war chest either
The company in six figures
See the platform, hear the pitch
Gurucul REVEAL — Security Analytics Platform Overview
The platform, presented by Gurucul.
Next-Gen SIEM Overview
The SIEM the 2025 MQ evaluated.
The Gurucul REVEAL Platform: How it Works
How the converged platform fits together.
Where Gurucul sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Gurucul Across Its Platform
Each dot is a Gurucul product: competitive position vs category momentum.
2025 MQ Leader, and self-hostable.
The Standing × Deployment Map
Analyst standing against where the platform may run — the pair that decides a regulated Indian shortlist.
The only 2025 Leader we sell that self-hosts.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Gurucul?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is forcing the decision?
2. What does your threat model centre on?
3. Where must the platform run?
What being a 2025 MQ Leader actually means
Gurucul's first year as a Leader after three as a Visionary — and why the marketing you will read elsewhere is out of date.
Read →Self-hosting and CERT-In's 180 days
Why the deployment model, not the quadrant, is the fact that decides a regulated Indian shortlist.
Read →Why UEBA-first is different from UEBA-added
Gurucul built analytics first and a SIEM around it. Most competitors did the reverse, and the seams show.
Read →Per-asset, per-user or per-GB
Gurucul offers all three. Which axis your contract lands on is the question that decides your bill.
Read →Gurucul against the other five Leaders
The honest matrix — where a boutique beats Microsoft and Google, and where it plainly does not.
Read →What to confirm in writing before you sign
Air-gap support, the pricing axis, and India data-region status: three answers to get on paper.
Read →The acronym decoder
Every term on these pages, in one place- REVEAL
- Gurucul's platform name — the converged layer carrying SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model.
- UEBA
- User and Entity Behaviour Analytics. Baselines how each user and machine normally behaves and scores deviation, catching attacks that break no rule.
- Identity Access Analytics
- Scoring entitlements and access patterns for risk rather than cataloguing them — excess privilege, dormant access, accumulated permissions.
- Open XDR
- Detection and response across security tools you already own, rather than requiring the vendor's own agent everywhere. Test the openness claim on your stack.
- Self-hosted
- The platform runs on infrastructure you control. Confirmed by Gartner for Gurucul, and the reason a regulated Indian buyer can shortlist it at all.
- Leader (Gartner MQ)
- Gartner's top-right quadrant, scoring both execution and vision. Gurucul entered it in 2025; it is not the same as "included in the MQ".
- Visionary
- Strong vision, less proven execution. Gurucul's position for the three years before 2025 — and still what parts of its own website advertise.
- Peer group
- The cohort a user is compared against. Peer-group quality is bounded by your identity data, which is why directory hygiene precedes any UEBA deployment.
- EPS
- Events per second — one of the axes Gurucul can meter on, alongside per-asset, per-user and data volume.
- CERT-In Directions
- India's 2022 rules requiring six-hour incident reporting and 180 days of ICT logs maintained within Indian jurisdiction.
- SEBI CSCRF
- SEBI's Cybersecurity and Cyber Resilience Framework. Gurucul publishes India-specific content mapping to it, which is unusual for a vendor this size.
- Bootstrapped
- Funded from revenue rather than venture capital. Gurucul has taken no institutional rounds in fifteen years and markets that as a stability argument.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Establish the deployment mandate first
Write down whether a regulator, a contract or your own posture requires the platform on infrastructure you control. If it does, that single answer eliminates most of the 2025 Leaders before any feature comparison, and it is the reason Gurucul is on your list.
Get the air-gap answer in writing
Self-hosted is confirmed by Gartner. A fully AIR-GAPPED deployment is marketed but we could not independently verify it, so if you need genuine disconnected operation, make it a written pre-condition rather than an assumption. TechBag obtains this as part of the quote.
Settle which pricing axis your quote uses
Gurucul can meter per asset, per user, per module, by data volume or by EPS. The per-asset and per-user options break the link between logging more and paying more — but per-GB options exist too, so confirm the axis in the order form rather than the brochure.
Ask about India data residency explicitly
The India answer here is self-hosting, not a vendor-run India region — we found no evidence one exists. If you want vendor-hosted SaaS inside India, ask directly and get a written answer before you evaluate features.
Prepare your identity data before the UEBA lands
Behavioural analytics is bounded by directory quality. Peer groups built on a stale directory mean little, and service accounts need named owners before they need baselines. This work improves your posture regardless of which vendor wins.
Weigh vendor scale honestly
Gurucul is a bootstrapped boutique competing with Microsoft, Google and Cisco. That means no investor pressure toward a licence change or a forced exit, and also no war chest. Treat it as a vendor-viability question, decide deliberately, and revisit it at renewal.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Next-Gen SIEM | Quote-only — per asset, per user, per module, by data volume or by EPS | Confirm which axis your order form actually uses | Per-asset or per-user, where you can get it |
| UEBA | Quote-only — on REVEAL, or as an overlay on a SIEM you keep | Standalone or with the SIEM — confirm packaging | Threat models centred on credentials and insiders |
| Open XDR | Quote-only, on REVEAL — confirm standalone or module | Ingests the tools you already own | Estates with tools they cannot replace |
| Identity Analytics | Quote-only, on REVEAL — confirm standalone or module | Shares one identity model with the SIEM | Access-review evidence for RBI and SEBI |
Quote-only. Gartner records per-asset, per-user, module, data-volume, EPS and platform-based options, so the axis on your order form is negotiated rather than fixed. The cost that surprises is identity-data preparation, not the licence. TechBag gets the axis in writing and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Quoting the Visionary marketing instead of the Leader fact
Parts of Gurucul's own website still advertise "Most Visionary, three consecutive years" — accurate for 2022 to 2024 and superseded in October 2025, when it was promoted to Leader. Quote the current position, and be equally precise the other way: 2025 is its FIRST year as a Leader, so "a Leader for years" would be wrong too. Boards notice when a vendor claim does not survive a search.
Assuming self-hosted means air-gapped
These are different things and the difference matters most to exactly the buyers who care. Self-hosted, Gartner-confirmed, means the platform runs on your infrastructure. Air-gapped means no internet path at all — which affects licensing activation, threat-intelligence updates and support access. We could not independently verify Gurucul's air-gap support; treat it as a written pre-condition, not a given.
Expecting the pricing model to be per-asset by default
Gurucul CAN price per asset or per user, which is genuinely useful and breaks the logging-costs-more dynamic. But Gartner records that it also offers data-volume and EPS-based pricing. Which one you get is a negotiation outcome, not a product property, and buyers who assume the better model end up surprised by the order form.
Deploying UEBA onto an unmaintained directory
Behavioural analytics is only as good as the identity data underneath it. Peer groups built from a stale directory produce confident nonsense, and unowned service accounts generate alerts nobody can adjudicate. Budget the identity hygiene work before the deployment, not after the first month of noise.
Skipping the vendor-scale conversation
A bootstrapped sub-$100M vendor competing against Microsoft and Google is a legitimate choice, and it is also a decision your risk function should make explicitly rather than discover. Ask about roadmap funding, support scale in India, and what happens at renewal. We would rather you ask now than be surprised in year three.
The evaluation kit
Each product page carries a 10-question vendor checklist and a cost model:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Growth rates are TechBag’s reading of public analyst forecasts, not audited figures. Identity threat detection is the fastest line — which is where Gurucul’s UEBA and identity analytics compete.
Data sovereignty deciding Indian shortlists
CERT-In log localisation, RBI outsourcing rules and DPDP increasingly settle Indian deals before features are compared.
What it means for you
Vendors without a self-hosted path or an India region lose regulated buyers outright, whatever their quadrant.
Identity as the primary attack surface
Stolen credentials and insider misuse now account for a large share of real breaches, and neither breaks a detection rule.
What it means for you
Behavioural analytics stops being a premium add-on and becomes the detection layer that actually catches the incident.
SIEM and UEBA converging into one purchase
Buyers increasingly refuse to license behavioural analytics separately from the platform holding the data.
What it means for you
This favours vendors that built one data model rather than acquiring their way to a suite.
Agentic AI in the SOC workflow
AI-assisted triage and investigation summarisation are shipping across the category, Gurucul included.
What it means for you
Treat vendor productivity statistics as unaudited, and never let an AI layer be the reason you buy the platform underneath it.
Consolidation pressure on mid-market security spend
Indian teams are cutting vendor counts, preferring one platform with adequate coverage over four tools they cannot staff.
What it means for you
Converged platforms win, but only where the convergence is real rather than a shared login page.
Boutique vendors under platform-vendor pressure
Microsoft, Google and Cisco bundle SIEM into estates buyers already own, squeezing independent specialists.
What it means for you
Specialists survive on capability depth and deployment flexibility — exactly the two things Gurucul competes on.
Questions buyers ask about Gurucul
Ready to shortlist Gurucul?
Open any of the four product pages for the deep dive, or let a TechBag advisor build the case with you — deployment scoping, the pricing axis in writing, honest comparisons, rollout, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.