Exabeam

Exabeam sells security operations software for threat detection, investigation and response. Its current cloud product is New-Scale Fusion, which joins New-Scale SIEM (log management and detection) with New-Scale Analytics (behavioral baselining and risk scoring) in one cloud-native platform. The company also sells LogRhythm SIEM, a self-hosted product that runs in your own data center or private cloud, which it sells alongside the cloud platform.

The vendor positions the cloud platform for the agentic SOC: an AI sidebar called Exabeam Nova assists analysts, and Agent Behavior Analytics watches non-human activity such as AI agents. You can replace an existing SIEM or keep it and add the analytics layer on top. Exabeam is headquartered in Broomfield, Colorado, according to its site footer. Buyers are security teams that want behavioral detection of insiders and compromised accounts with a cloud or on-premises route.

• Behavioral analytics. New-Scale Analytics builds baselines for users and other entities and applies dynamic risk scoring. The vendor says it targets insider threats, credential misuse and attacks that fixed rules can miss, and extends the same method to service accounts and AI agents.
• Exabeam Nova. A sidebar assistant that follows analysts across the Threat Center, search timelines and Outcomes Navigator. Named agents cover threat scoring, investigation, search, visualization, advice and rule creation. The vendor states end-to-end encryption and that customer information is never used to train AI models.
• Agent Behavior Analytics. Detects anomalies in the activity of AI agents and other non-human identities. When it flags something, Nova adds context to separate approved use from a genuine threat. LogRhythm SIEM adds collectors for ChatGPT, Google Gemini and GitHub Copilot.
• Outcomes Navigator. Maps detection coverage to MITRE ATT&CK, the OWASP Agentic Top 10 and compliance frameworks, shows gaps, and gives guidance for improving posture. The Advisor Agent summarises this for executives, as the vendor describes it.
• Log management and CIM. Data is ingested, parsed, stored and searched at scale, normalized to a Common Information Model and enriched at ingestion. The Search Agent turns plain-language queries, in several languages, into Exabeam Query Language.
• Automation and MCP server. Low-code playbooks connect 1,000+ tools, and standards-based APIs plus a Model Context Protocol server pass New-Scale data to outside workflows. Federated search and routing to third-party storage are offered through the account team.
• LogRhythm SIEM on-premises. A self-hosted option with 1,100+ prebuilt correlation rules mapped to MITRE ATT&CK, OpenSearch-based drill-down from events to raw logs, and compliance dashboards for frameworks such as PCI DSS, HIPAA and NIST CSF. Local AI models can connect through a community MCP server.

• A bank's security team that wants to keep its current SIEM. The vendor describes an augment path: leave the existing SIEM in place and add New-Scale Analytics for insider-threat and credential-misuse detection. Later the team can switch to full replacement if the added analytics prove their value.
• A utility with data that must stay in its own data center. LogRhythm SIEM runs in a data center or self-managed private cloud, so log data stays under the owner's control. The vendor lists compliance report templates, and a local MCP server lets analysts query SIEM data with local AI models.
• A company starting to run AI agents internally. Agent Behavior Analytics baselines what AI agents and service accounts normally do, and Nova helps decide whether a flagged action was approved. This gives security staff a view of non-human identities next to user activity.

The vendor's path starts with a demo request on the website, where a representative contacts you to schedule a session; no self-service trial or sign-up is described on the pages we fetched. The demo, according to the vendor, shows how to monitor human and agent behavior, build timelines, use multi-agent AI and apply playbooks.

Deployment then follows one of two routes: connect data through prebuilt integrations, APIs, syslog and log aggregators without changing your environment, or deploy LogRhythm in your own infrastructure. Documentation sits at docs.exabeam.com, and education and professional services are listed under Support. Time to value is not stated.

Exabeam united with LogRhythm in 2024, so one vendor now sells a cloud-native platform on Google Cloud and a self-hosted LogRhythm SIEM that keeps data in your own data centre.

The self-hosted edition is offered as subscription or perpetual licence with pricing from sales, and the cloud pages show no price either. Two product lines mean two migration paths, and the vendor says LogRhythm is not cloud native.

The SIEM software list places Exabeam 4 of 12: Elastic Security sits directly above it and Securonix directly below. Challengers hold places 1 to 3 where a category has them; the number here is a place in the order, not a mark out of ten.

Home market: the United States, one of 10 North America bases among the 12 products here.

New-Scale Fusion combines SIEM and analytics on Google Cloud with a 99.5% uptime commitment, a hosting region chosen at purchase and more than 7,000 prebuilt log parsers.

Collectors run as virtual machines behind your firewall.

Exit paths differ by edition, and the pages we read document no data export.

In the catalogue: Cloud-native New-Scale platform or self-hosted LogRhythm SIEM; quoted by sales.

Exabeam does not publish prices on its website. The pricing address redirects to the home page, and the product pages end in Request a Demo or Contact Us. No plan names, per-gigabyte rates, per-user fees or free tier are shown for New-Scale Fusion or LogRhythm SIEM, and no trial is mentioned. The platform is therefore quoted through sales, and the unit of charge (data volume, users or entities) is not stated on the pages we read. Support levels and professional services are described but not priced. Buyers should ask for the quote basis, contract term and what the Nova agents add to it.

Where this comes from: the vendor pages at exabeam.com, checked for Best SIEM Software in 2026 on 5 November 2026.

The vendor says cloud services are available globally so you can choose where data is hosted, using a multi-tenant architecture with isolated tenants. Encryption is AES-256 at rest and TLS in transit.

Certifications listed: ISO 27001, 27017 and 27018, SOC 2 Type II, an IRAP assessment at PROTECTED level, GDPR measures. Retention rules archive data by day, time or storage used, and an audit trail can be searched or exported. SLAs state 99.9% data upload availability and 99.5% product access availability.

Integrations the vendor names (12):

• ChatGPT (collector)
• Google Gemini (collector)
• GitHub Copilot (collector)
• OpenSearch (LogRhythm)
• Model Context Protocol server
• Syslog
• Log aggregators
• Third-party storage (federated search)
• MITRE ATT&CK mapping
• OWASP Agentic Top 10 mapping
• Low-code automation across 1,000+ tools
• Standards-based APIs

Shared tags and a similar price model decide who is listed here; where none match, the neighbours in the ranking fill in.

• Sumo Logic (#6 of 12): Log analytics vendor whose Cloud SIEM sits in the Enterprise Suite. (United States)
• Google Security Operations (#10 of 12): SIEM, SOAR and threat intelligence sold as ingestion-based packages. Best for: Organisations wanting SIEM and SOAR in one ingestion-priced package with long retention.
• Splunk Enterprise Security (#11 of 12): A good match for: Large security teams that already run Splunk for logs and want one vendor.
• IBM QRadar (#12 of 12): Not for: teams wanting a self-serve cloud SIEM with published pricing. On-premises SIEM licensed by events per second or managed servers. (United States)

Read from the vendor’s own pages on 5 November 2026.

• exabeam.com/product: New-Scale Fusion overview, features, FAQ, address
• exabeam.com/platform/exabeam-nova: Nova agents, data protection statements
• exabeam.com/platform/logrhythm-siem: LogRhythm SIEM features and on-premises deployment
• exabeam.com/company/trusted-and-secure: hosting choice, certifications, encryption, SLAs
• exabeam.com/pricing: redirects to home, so no published pricing

The same four questions are asked of every SIEM software product: time to value, real cost, the way out and the intended buyer. The result for Exabeam: #4, out of 12 ranked. The editorial process sets out how facts are gathered and how commercial links are handled.