Authorised IBM Security Partner

IBM QRadar SIEM Pricing in India 2026 — EPS Licensing Explained

QRadar is IBM's SIEM (Security Information and Event Management) platform — the tool that ingests logs from every system on your network and correlates them into detectable threats, and the tool most commonly named in Indian BFSI and enterprise CERT-In compliance conversations. Licensing is not seat-based; it is capacity-based, and understanding that capacity model is what actually determines your cost. As authorised IBM Security partner, National IT Service supplies QRadar with GST invoice, EPS sizing, and deployment support.

Plans & pricing (INR)

What IBM actually publishes — No dollar-per-EPS list price

All Indian buyers

Licensing model is EPS + FPM (or MVS for Enterprise) — this part IBM documents publicly
The rupee or dollar cost per tier is not published — every deal is quoted
Any specific $ figure you see on third-party "SIEM cost calculator" sites is that site's estimate, not an IBM number
A real quote needs your actual log source count and volume

EPS — Events Per Second — Quoted, tiered by capacity

Sized to your log volume

The core licensing unit for most deployments — how many security events per second QRadar can ingest
Base license typically starts around 100 EPS capacity
Sized by counting log sources: firewalls, servers, endpoints, applications, cloud services
Under-sizing causes dropped events during a spike — exactly when you need them most

FPM — Flows Per Minute — Quoted, bundled with EPS tier

Network-level visibility

Licenses network flow data (who talked to whom, how much, how often) alongside event data
Typically bundled at a fixed ratio with the EPS tier (base license commonly pairs 100 EPS with 15,000 FPM)
Flow data catches lateral movement that log-only event data misses

MVS — Managed Virtual Servers (Enterprise) — Quoted, per protected server

Large/complex environments

Alternative licensing model based on counting all physical, virtual and cloud servers in the environment
Simplifies licensing for large estates where counting individual EPS is impractical
Typically the model enterprise-scale Indian deployments end up on

Deployment model — on-prem vs QRadar on Cloud — Same licensing units, different infrastructure cost

Either

On-premise: you own the QRadar appliance/VM infrastructure, IBM licenses the software
QRadar on Cloud: IBM hosts the infrastructure, you pay a combined subscription
India data-residency requirements (CERT-In 180-day retention within India) shape which model fits

India-specific notes

Third-party industry benchmarks (not IBM's own published numbers — flagged clearly as such) put small commercial QRadar deployments around the 100 EPS base tier at roughly 0K/year, mid-market 1,000-2,500 EPS deployments in the $40K-110K/year range, and enterprise tiers above 10,000 EPS between $240K-850K/year. Treat these as directional industry ranges to sanity-check a quote against, not as IBM's contractual price — IBM does not publish a flat rupee — or even a single dollar — list price for this. IBM Cloud's public catalog is priced per service and per instance profile, billed natively in USD, with pay-as-you-go, committed-use and subscription options that each land differently. We are not going to invent a number to fill this space. Through National IT Service you get the exact IBM catalog rate mapped to INR, a GST invoice, and provisioning support. The other major India-specific driver is CERT-In's 180-day log retention requirement, which must be stored within India — this affects both your EPS sizing (more retention means more storage, not more EPS) and your deployment model choice.

How to buy

WhatsApp +91 98119 98370 with your approximate log source count (firewalls, servers, endpoints, cloud services) — we help size the EPS/FPM tier, request the IBM quote, and deliver it in INR with a GST invoice. Typical go-live: 4-8 weeks for a mid-market deployment including log source onboarding.

Frequently Asked Questions

What does "EPS" actually mean and why does it drive the price?

EPS is Events Per Second — the sustained rate at which QRadar can ingest and process security events across all your connected log sources. It is the primary capacity unit, similar to how cloud storage is priced per GB. Under-licensing EPS means QRadar drops events during traffic spikes, which is precisely when an attack is most likely to be happening — so sizing accurately, with headroom, matters more than it might seem.

Is QRadar the right SIEM for a mid-size Indian business, or is it enterprise-only?

QRadar scales down to smaller EPS tiers and is used by mid-market Indian companies, particularly those already running other IBM Security tooling or needing to demonstrate CERT-In-compliant log retention to an auditor. For a company under 50-100 employees with no regulatory driver, a lighter SIEM or a managed detection service is often a better cost fit — QRadar earns its complexity at real log volume and compliance stakes.

How does QRadar help with CERT-In compliance specifically?

CERT-In's Directions 2022 require 180-day log retention stored within India and detection/reporting of specified incident types within 6 hours of becoming aware. QRadar centralises the logs (satisfying retention) and correlates them into detectable incidents (satisfying the "becoming aware" clock) — it is the tool most Indian BFSI and enterprise compliance teams point to when an auditor asks how they meet the Direction.

On-premise QRadar vs QRadar on Cloud — which costs less?

It depends on what you already have. On-premise needs you to provide (or already own) the server infrastructure, which lowers the recurring bill but raises upfront capital cost and requires your team to manage the platform. QRadar on Cloud bundles infrastructure into a subscription, trading a lower upfront cost for a higher recurring one. For Indian buyers with CERT-In data-residency requirements, both models can be configured to keep logs within India — the choice is really about capital vs operating expenditure and who manages the infrastructure.

Get an IBM Cloud or QRadar quote priced in INR with GST invoice — we scope the workload or EPS tier, request the IBM quote, and handle deployment.