Wazuh vs Elastic Security
Wazuh is open source (GPLv2) with no licence cost, built from an indexer, server and dashboard plus an agent on each endpoint. Elastic Security is billed per gigabyte ingested and retained in its serverless form, or run as self-managed software. Both can be run on your own servers, which leaves the choice of paying with staff time or with a metered bill. Wazuh does not state a country of establishment, and Elastic N.V. lists an Amsterdam address.
Sebastiaan SmitsFounderVendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
Choose Wazuh ifyou have Linux skills in house, want endpoint-centred detection with no licence fee, and can size and patch the indexer, server and dashboard yourself.
Choose Elastic Security ifyou prefer per-GB billing, want prebuilt detection rules and endpoint protection in the entry tier, and like having both a serverless and a self-managed route.
Wazuh and Elastic Security side by side
| Wazuh | Elastic Security | |
|---|---|---|
| Our SIEM software rank | #1 of 12 | #3 of 12 |
| Established in | Not stated by the vendor | Netherlands |
| List price, 2 November 2026 | Self-hosted software free; Wazuh Cloud from $571 per month (up to 100 agents), $923 (250), $1467 (500) | Per-GB serverless billing: ingest at $0.09 (Essentials) or $0.11 (Complete), retention at $0.017 or $0.019 monthly, egress $0.05 once past 50 free GB |
| Free tier | — | — |
| Open source | Yes | — |
| Self-hostable | Yes | — |
| Built for | Teams with Linux skills that want endpoint-centred detection without any licence fee | Teams with search skills that want per-gigabyte billing and a self-run exit |
| Not for | Teams with nobody to run servers and tune detection rules | Buyers who want a fixed annual price per organisation |
Both are reviewed in full in our SIEM software ranking: Wazuh and Elastic Security.
Where they differ
Wazuh 2 · Elastic Security 2 · open 1- 01
Licence and cost of the software
Wazuh's home page says 'no license cost' and its core repository is under the GNU General Public License version 2. Elastic's repository gives a choice of AGPL v3, SSPL or Elastic License 2.0, while its serverless service starts at $0.09 per ingested GB. Wazuh is the only one with no licence fee for the software.
Edge: Wazuh
- 02
Managed route and its price
Wazuh Cloud starts at $571 per month for up to 100 active agents with one month of indexed retention, $923 for up to 250 and $1467 for up to 500. Elastic's serverless route has no agent count at all, since the per-endpoint fee ended on 23 March 2026, and bills ingest, retention and egress instead. Which is cheaper depends on your log volume, so neither wins outright.
Depends on the buyer
- 03
What the entry tier includes
Essentials at Elastic comes with prebuilt detection rules, machine learning and Elastic Defend; moving to Complete is what unlocks entity analytics and the AI Assistant. Wazuh's agent covers file integrity monitoring, configuration assessment, malware detection and vulnerability detection. Both cover a lot, but Elastic documents a tier ladder you can plan against.
Edge: Elastic Security
- 04
Staffing burden
Run Wazuh yourself and you size, patch and monitor three server components, and professional support and consulting are sold separately. Elastic's self-managed route also means running Elasticsearch and Kibana, but its serverless option removes that. Elastic offers an easier way out of the work.
Edge: Elastic Security
- 05
Leaving the vendor
Wazuh's GPLv2 code means you can leave without a contract and keep running what you have. Elastic's AGPL option also allows self-run code, though the same repository carries other licences, noted per file header. The Wazuh position is the cleaner one.
Edge: Wazuh
When neither fits
If nobody on your team wants to run or tune a search stack, look at a managed log product instead. Graylog is another self-run choice, and Sumo Logic sells Cloud SIEM as a cloud service.
Wazuh or Elastic Security: questions
3 answersIs Wazuh really free?
The software is: Wazuh's home page says there is no licence cost and the core code is under GPLv2. Wazuh Cloud, professional support and consulting are paid services.
How much does Wazuh Cloud cost?
Wazuh's cloud page lists Small from $571 per month (up to 100 active agents, one month indexed retention), Medium from $923 (250 agents) and Large from $1467 (500 agents), with a 14-day trial.
Can Elastic Security be self-hosted?
Yes. A self-managed Elasticsearch deployment is on Elastic's list, and the repository licence has an AGPL v3 route.
Sources
Checked 2 November 2026- Wazuh home page: no license cost, open source SIEM, agent capabilities.
- Wazuh Cloud pricing: tiers, agent limits, retention and starting monthly prices, 14-day trial.
- Wazuh repository LICENSE: GNU General Public License version 2.
- Wazuh documentation: indexer, server, dashboard and agent components.
- Wazuh professional support: support, consulting and training sold separately.
- Elastic Security serverless pricing: per-GB rates, what each tier holds, endpoint fee ended.
- Elastic Security SIEM page: serverless, hosted and self-managed routes.
- Elasticsearch repository LICENSE: licence choices in the repository.
- Elastic privacy statement: Elastic N.V. Amsterdam address.