Volume Benchmarking · 8 industries · 6 size bands · 16 sources
How much telemetry does an organization like yours generate?
Daily volume of logs, metrics, and traces by source, built from public sizing guidance and published deployments. Pick an industry and headcount, then refine with your own asset counts.
6.2TB/day
Middle 50% of peers: 4.8 to 10.6 TB/day
About 126,000 events per second310 MB per employee per day
Logs 85%Metrics 10%Traces 4.3%
Breakdown
Where the telemetry comes from
16 source categories across four domains. Each line shows the asset count and per-unit daily volume behind the estimate. Switch off any source your estate does not have, and expand a source for its assumptions.
Security
2.3 TB/day24,000 endpoints × 20 MB
24,000 endpoints × 2.5 MB
24,000 endpoints × 3.5 MB
24,000 endpoints × 30 MB + 24,000 endpoints × 26 MB + 3,000 servers × 100 MB
20,000 users × 1.2 MB + 8 domain controllers × 1,350 MB
20,000 users × 0.36 MB
Cloud
80.0 GB/day60 cloud accounts × 600 MB
1,200 cloud workloads × 20 MB
20,000 users × 1 MB
Infrastructure
2.1 TB/day1,500 Windows servers × 260 MB + 1,500 Linux servers × 26 MB
1,110 network devices × 2.2 MB + 24,000 endpoints × 32 MB
300 Kubernetes nodes × 3,000 MB + 10 clusters × 3,000 MB
Application
1.7 TB/day1,080 app hosts × 500 MB × 1.3 intensity
300 database instances × 173 MB × 1.3 intensity
3,000 hosts × 216 MB
690 traced hosts × 300 MB × 1.3 intensity
Bar shows the typical value. The bracket marks the middle 50% of peers for that source.
Model inputs
Change any per-source volume, organization ratio, or retention and growth input. Your edits stay in the scenario link and in the emailed report.
Get this breakdown as a PDF
All 16 sources with an appendix of every assumption behind them, including any you changed, sent to your work email.
Retention gap
How much of the record stays searchable
Over a 3-year retention period, an organization like yours generates 6.8 PB of telemetry. At typical practice, about 3.3% of that record is searchable at any given time.
Typical practice: about 40% of generated telemetry is centralized (middle 50% of organizations: 15% to 65%), with about 90 days searchable. Based on practitioner surveys and published pipeline case studies.
Growth
How the volume grows
Telemetry volume compounds as estates add workloads, services, and sources. The projection applies the low, typical, and high annual growth seen across practitioner surveys: 20%, 25%, and 30%.
Solid line: typical growth at 25% a year. Dashed lines: 20% and 30% a year. Shaded: the span between them.
Compare
Where you sit against peers
Enter the daily volume you centralize today across your log management, security analytics, and observability tools.
Enter a daily volume to see your coverage and percentile. The strip below shows how much peers your size centralize.
Peers your size. Shaded: 10th to 90th percentile. Box: middle 50%. Line: median, 2.5 TB/day.
Full report
Take this scenario with you
A PDF of your scenario with the full 16-source breakdown, the retention gap, your peer comparison, and an appendix of every assumption, with any you changed marked against the benchmark. Sent to your work email.
Work email required. The calculator stays open without it.
Benchmark
By industry and size
Typical generated telemetry at each size band's midpoint headcount. Select a cell to load it into the calculator.
| Industry | <1k | 1k–5k | 5k–20k | 20k–50k | 50k–100k | 100k+ |
|---|---|---|---|---|---|---|
| Financial services | ||||||
| Healthcare and pharma | ||||||
| Retail and e-commerce | ||||||
| Manufacturing | ||||||
| Technology and SaaS | ||||||
| Telecom and media | ||||||
| Public sector | ||||||
| Energy and utilities |
TB per day, typical. Band midpoints: <1k = 500, 1k–5k = 2,500, 5k–20k = 10,000, 20k–50k = 35,000, 50k–100k = 75,000, 100k+ = 150,000.
Method
How the benchmark is built
What it measures
Telemetry generated at standard verbosity across 16 source categories in Security, Cloud, Infrastructure, and Application domains, including logs, metrics, and traces. Volumes are raw bytes in decimal units (1 TB = 1,000 GB), before compression.
How it is calculated
Headcount and industry set the asset counts: users, endpoints, servers and VMs, cloud workloads, and Kubernetes nodes. Each category multiplies one of those counts by a per-unit daily volume drawn from vendor sizing guides, product documentation, practitioner measurements, and surveys.
The range
The middle 50% band comes from 6,000 simulated peers. Each draw varies per-unit volumes across their published ranges, with logging habits partly shared across sources, and varies any asset counts you have not entered. The simulation is seeded, so the same inputs always return the same band.
Checked against published deployments
Model results land between 0.56x and 1.43x of six published organization-level volumes, including a 19,000-employee healthcare company, a 2,000-staff hospital, and an 11,000-employee telecom operator.
Not included
- OT and ICS telemetry (plant networks, SCADA historians)
- Telecom subscriber records (CDR, IPDR) and payment transaction records
- Full packet capture
- Debug-level logging, which runs 2–10x standard verbosity
Retention periods
Industry defaults reflect common regulatory reference points: PCI DSS for retail, HIPAA documentation rules for healthcare, NYDFS audit trails for financial services, OMB M-26-14 for US federal, and NERC CIP for utilities. They are reference points, not legal advice.
Sources · 53
Where the numbers come from
Every per-unit volume traces to one or more of these published sources. Breakdown rows link here by number.
- S1Economic Validation of Google Chronicle, ESG, 2020
- S2Estimating Data Ingestion, LimaCharlie docs, 2026
- S3Calculator EPS (per-device EPS table), ISA Cybersecurity, 2024
- S4FortiSIEM Sizing Guide (event sizes), Fortinet, 2021-2023
- S5FortiAnalyzer Cloud 7.2.8 daily log limits, Fortinet, 2024
- S6Web Transactions Per User Per Day, Zscaler research, 2011
- S7DNS behaviour of enterprise clients (SRA talk), M. Allman, 2016
- S8CrowdStrike FDR add-on: data volumes, Splunk docs, 2021-2024
- S9Export MDE events with the streaming API, J. Appel, 2021
- S10EDR sensor data collected, WithSecure KB, n.d.
- S11Sysmon deployment and volume guide, DecryptionDigest, 2026
- S12Entra log integration considerations (event sizes), Microsoft, current
- S13Calculating Log Analytics cost for Azure AD logs, dirteam, 2020
- S14ACS sizing, Appendix A (domain controller EPS), Microsoft, 2012
- S15WinCollect deployment planning (EPS), IBM docs, n.d.
- S16Email statistics (emails per user per day), Radicati, 2014
- S17NetFlow export bandwidth FAQ, ntop, 2025
- S18Calculating NetFlow volume, Plixer, 2013
- S19Defender for Servers data ingestion benefit (500 MB/node/day), Microsoft Learn, 2026
- S20Security Lake pricing (CloudTrail event size), AWS, 2026
- S21CloudTrail pricing guide (data events per account), Cloudburn, 2026
- S22VPC flow log records and examples, AWS docs, current
- S23O365 and Azure AD volume estimation thread, Splunk Community, 2021
- S24Kubernetes audit log volume, G. Helton, 2025
- S25Cost-effective EKS control plane logging, Autify, 2023
- S26Adjust log throughput (GKE logging agent), Google Cloud docs, current
- S27BYOC logs sizing (log event sizes), Datadog docs, 2026
- S28SIEM sizing calculator (server and DB EPS), UTMStack, n.d.
- S29Prometheus storage (bytes per sample), Prometheus docs, current
- S30Remote write bytes per sample in production, VictoriaMetrics, 2023
- S31Metrics pricing (indexed datapoint size), Elastic, 2026
- S32How many metrics? Estimating series per host, Grafana Labs, 2023
- S33APM storage guide (spans per transaction, sizes), Elastic, 2025
- S34Application Observability invoice (traces per host), Grafana Labs, 2026
- S35Manage trace ingestion (span size), Grafana Tempo docs, current
- S36Charting Observability survey, Edge Delta, 2023
- S37State of SIEM survey, Panther, 2022
- S38Data retention vs compliance survey (Red Canary / Censuswide), BetaNews, 2025
- S39Global DataSphere forecast (23% CAGR), IDC via BusinessWire, 2021
- S40Security log data management ebook (20% YoY), Forgepoint Capital, 2025
- S41The telemetry time bomb (IDC ~29%/yr), Cribl, n.d.
- S42IT spending by industry, Flexera, 2020
- S43Tech budgets and IT spend as % of revenue, Deloitte, 2017
- S44Healthcare company SIEM case study, Netrix, n.d.
- S45Magyar Telekom case study, syslog-ng, n.d.
- S46Hospital QRadar case study, ScienceSoft, n.d.
- S47PCI DSS v4.0.1 Requirement 10.5.1, PCI SSC via Cloudaware, 2024
- S48HIPAA 45 CFR 164.316(b)(2), Cornell LII, current
- S49NYDFS 23 NYCRR 500.6, Cornell LII, current
- S50OMB M-26-14 logging requirements, ACT-IAC, 2026
- S51NERC CIP-007-6 R4.3 (90-day log retention), Emerson, n.d.
- S52Unified Licence amendment: CDR/IPDR two years, India DoT, 2021
- S53Sentinel licensing and illustrative estates, Redress Compliance, 2026
Benchmark data compiled October 2026.
Frequently asked questions
How much log data does a 10,000-employee company generate per day?
It depends most on industry. At 10,000 employees, a typical financial services organization generates about 3.1 TB of telemetry a day, with the middle 50% of peers between 2.4 TB and 5.3 TB. A manufacturer of the same size generates about 1.1 TB a day, and a technology or SaaS company about 7.1 TB. Logs make up 85% to 90% of that volume, and metrics and traces make up the rest.
How much telemetry does one endpoint generate?
A typical workstation generates about 56 MB of telemetry a day on the device itself: about 30 MB of raw EDR telemetry and about 26 MB of operating system event logs, with published ranges from about 25 MB to 100 MB. Counting the firewall, DNS, proxy, and network flow records each device also drives, the benchmark attributes about 114 MB a day to every endpoint.
How many events per second should we plan for?
A 20,000-employee financial services organization generates about 126,000 events per second, averaged over the day. At 10,000 employees, the typical rate runs from about 22,000 events per second in retail to about 133,000 in technology and SaaS. Peak rates run above the daily average, so size pipelines for bursts rather than the mean.
What share of telemetry do organizations actually centralize?
About 40% at the median. The middle 50% of organizations centralize between 15% and 65% of the telemetry they generate, and keep about 90 days of it searchable. Over a three-year retention period, that leaves about 3.3% of the full record searchable at any given time.
How long should security telemetry be retained?
It depends on the regulations that apply to you. The benchmark uses common reference points as industry defaults: three years for financial services (NYDFS audit trails), six years for healthcare (a conservative reading of HIPAA documentation rules), two years for telecom, and one year for retail (PCI DSS), technology, manufacturing, the public sector, and energy. These are reference points, not legal advice.
Why is my number different from what my SIEM receives?
The benchmark measures telemetry generated at standard verbosity across 16 source categories, before filtering or compression. A SIEM usually receives only the share an organization chooses to centralize, about 40% at the median, after sampling, filtering, and sources left out. Enter your centralized daily volume in the comparison section to see your coverage and where you sit against peers.
How is this benchmark built and validated?
Industry and headcount set asset counts such as endpoints, servers, cloud workloads, and Kubernetes nodes. Each of the 16 source categories multiplies one of those counts by a per-unit daily volume drawn from 53 published sources, including vendor sizing guides, product documentation, and practitioner measurements. A seeded simulation of 6,000 peers produces the middle 50% range, and model results land between 0.56x and 1.43x of six published organization-level volumes.
Keep the full record
Bloo Datafabric retains full-fidelity telemetry inside your own cloud, with predictable retention economics, structured so machines can reason over it.
Bloo · Volume Benchmarking
How much telemetry does an organization like yours generate?
Financial services · 20,000 employees · 3-year retention
Typical generated telemetry
6.2 TB/day
- Middle 50% of peers
- 4.8 to 10.6 TB/day
- Events per second
- About 126,000
- Per employee
- 310 MB per day
- Per year
- 2.3 PB
- Full-fidelity history
- 6.8 PB over 3 years
- Typically searchable
- 3.3% of that history
- In three years
- 12.1 TB/day
Scenario link
https://bloo.io/resources/volume-benchmarking
The full 16-source report is available by email from the benchmark page.