Sophos Fusion Rattles SIEM Market with New Pricing Model

Microsoft Sentinel and Splunk Enterprise Security are facing stiff competition from Sophos Fusion, a new next-gen SIEM platform that charges by user and server rather than per gigabyte. This shift in pricing model directly attacks the biggest pain point for both Sentinel and Splunk ES: unpredictable costs when log volume spikes during an incident or compliance audit.

Sophos closed its $859 million acquisition of Secureworks in February 2025, spending the following eighteen months rebuilding the Taegis analytics engine into Sophos Fusion. The new platform bundles Next-Gen SIEM, XDR, and MDR on a shared data layer and is now available to customers.

The pricing comparison between Microsoft Sentinel, Splunk Enterprise Security, and Sophos Fusion highlights key differences in their billing models. Sentinel charges for Security Compute Units consumed by its entity analyzer feature, which adds a new variable to customer bills. Meanwhile, Splunk ES still runs on a base ingest model, with prices ranging from $150 to $2,000 per GB/day depending on volume and contract terms.