Open-Source SIEMs Can Support Sovereignty, but Self-Hosting Carries Staffing Costs
Summary
A vendor-authored analysis argues that self-hosted open-source SIEMs avoid licence fees but require ongoing engineering and audit work. Its three-year model estimates €476,775 in staffing costs for a public-sector team using 1.5 engineers.
Key points
- The EU’s 2026 Technological Sovereignty Package includes CADA and a companion Open Source Strategy promoting European open alternatives, including in cybersecurity.
- The article distinguishes open-source licensing from self-hosting: teams still need to build, tune, patch, upgrade, and operate a SIEM.
- Its example estimates 1.5 engineers at €105,950 in annual loaded cost each, totaling €476,775 over three years; it excludes several additional costs.
- The model estimates €317,850 for one engineer, with greater personnel dependency, and €635,700 for two engineers.
- The article says lean regulated teams must also maintain consistent audit evidence, such as who accessed data, when, and under what authorization.
- Guardsix presents its EU-governed SIEM, predictable pricing, and on-premises roadmap as an alternative to operating the stack internally.
Article Details
- Topic
- Operational costs, staffing requirements, and compliance evidence for self-hosted open-source SIEM versus vendor-operated sovereign security platforms under CADA and NIS2.