If UEBA is a line item in your security budget, there is a fair chance you are paying twice for something one invoice already covers. Splunk stopped selling standalone Splunk UBA on December 12, 2025 and ends all support on January 31, 2027, pointing customers at the UEBA capability inside its own flagship SIEM. Microsoft ships the equivalent inside Sentinel at no extra licence cost. The market has answered the question your renewal cycle is about to ask, and the answer changes what you should be negotiating.
We think the honest framing for a security leader is this. The question is no longer “should we buy UEBA”. It is “are we getting value from the behavioral analytics we already pay for”, and those are very different conversations to have with your SOC lead and your vendor.
The product died. The problem it was sold for did not.
It would be convenient to read Splunk’s exit as proof the whole idea failed, cut the line item and move on. That reading gets the history half right. Anton Chuvakin at Gartner predicted in November 2016 that SIEM and UEBA were headed for a confrontation not every vendor would survive, and a decade later the standalone category is effectively gone. But the capability was absorbed, not abandoned. Splunk moved it into Enterprise Security Premier and Microsoft ships it inside Sentinel, which tells you the platform vendors concluded their customers cannot cover identity threats without it.
They concluded that because the detection gap is structural. Your detection rules encode attacks that look the same everywhere. The attacker who logs in with stolen credentials brings none of that, and MITRE’s detection guidance for valid account abuse is written in words no rule can implement: anomalous logon patterns, unusual times, impossible travel. Unusual compared to what? To that account’s own history, which means someone or something has to keep a baseline per identity. That is the whole of what UEBA is, and killing the budget line does not kill the need. Boards that have watched a breach retrospective know this pattern already; the intruder authenticated normally for weeks and nothing was technically malfunctioning.
If your organization runs on service accounts, OAuth integrations and remote admin tools, and it does, the population of legitimate credentials an attacker can hide behind is growing faster than your rulebook. We made that case in detail, from the trenches, in our practitioner companion to this article, which your detection team can take the queries from.
The real cost was never the licence
Here is the part vendor decks underplay, and the reason some UEBA deployments quietly become shelfware. Behavioral analytics is cheap to switch on and expensive to run well. The vendors themselves concede that immature baselines flood queues with false positives while undertrained models miss real attacks, and that tuning demands people who understand both the analytics and your environment. A baseline needs weeks to converge, resets after every re-org and merger, and produces anomalies, which are statements of rarity, not of guilt. Most rare behavior is a new hire, a vacation or a migration.
So the failure mode to budget against is not the tool missing attacks. It is the tool being technically enabled, generating a feed nobody owns, and training your analysts to ignore it. An anomaly feed without a named owner decays into a muted channel within a quarter, and at that point you are paying, in ingestion and in attention, for nothing. When we scope AI-driven SOC engagements, the behavioral layer is rarely a technology problem; it is an ownership and discipline problem, and the discipline is refusing to page a human on an anomaly score alone.
That gives you the real cost model for the renewal conversation. Licence cost is converging toward zero because the capability is bundled. Operating cost is a fraction of an engineer, ongoing, plus the ingestion of the identity telemetry that feeds the baselines. If you are not prepared to fund the second part, do not pretend the first part buys you coverage.
The default at renewal is consolidation
Our advice, stated plainly so you can disagree with it in a meeting. Treat the SIEM-bundled capability as the default, and make any standalone UEBA renewal justify itself against a written detection gap the bundled version cannot close. Splunk’s own exit tells you how many buyers were clearing that bar. The exceptions are real but narrow, usually a regulated insider-threat program with requirements the SIEM’s models do not meet, or an estate whose SIEM genuinely lacks a behavioral layer.
Consolidation also buys you something subtler than savings. When behavioral scores live inside the platform your analysts already work in, they get used as context on existing alerts rather than as a separate console generating separate tickets. That is the use that survives contact with a real triage queue, and it is the difference between behavioral analytics working for you and behavioral analytics as noise.
What to ask your team this week
Five questions, in the order we would ask them.
- What are we paying for behavioral analytics today, across standalone tools, SIEM tiers and add-ons, and which of those overlap?
- Is the UEBA capability in our SIEM actually enabled, and which identity sources feed it? Partial telemetry produces baselines you cannot trust.
- Who owns tuning the anomaly feed, by name? If the answer is a team rather than a person, assume nobody.
- Show me one incident from the last quarter where a behavioral score changed triage priority. No example means we are paying for a capability we do not use.
- If we run standalone UEBA, what documented detection gap keeps it alive past the next renewal?
If those answers come back thin, the problem is not whether UEBA adds value. It is that nobody has been asked to extract the value you already bought.
Bottom line
Consolidate by default, keep standalone UEBA only against a written gap, and fund a named owner for the anomaly feed or stop pretending the capability is on. The conversation costs nothing, and it is worth having before January 2027 makes part of the decision for you.