Gurucul
The 2025 Gartner SIEM Leader you can self-host — SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model, available as SaaS, in your cloud or on your own hardware. Honest about the limits too: air-gap unverified, no India storage region found. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One converged platform.
The Gurucul portfolio on TechBag — every linked card is a full intel page, from the SIEM Gartner named a Leader to the identity analytics beneath it.
Gurucul Next-Gen SIEM
Only 2025 Gartner SIEM Leader you can self-host.
SIEM with UEBA and identity analytics built into the core, as SaaS, cloud or self-hosted; per-asset or per-user pricing offered.
Gurucul UEBA
UEBA from the company that started there.
Founded as a UEBA company in 2010; baselines each user and entity to catch attackers signing in with stolen credentials.
Gurucul Open XDR
Detection across your tools, weighted by identity.
Ingests telemetry from the endpoint, network and cloud tools you already run, then applies identity analytics on top.
Gurucul Identity Analytics
Which access is dangerous, not just which exists.
Scores entitlements and access for risk, surfacing excess privilege and dormant high-risk access for RBI and SEBI reviews.
Insider Risk Management
Platform & enginePackaged for the insider-threat buyer; the same behavioural engine underneath
Security for AI
Platform & engineRuntime detection for AI workloads — previewed at Black Hat USA 2026, treat as direction
Gurucul is one of 35 SIEM & log management products TechBag carries. The Security guide shows how the category splits and which part is yours. →
Why “a Leader you can actually deploy” is the whole story
There are six Leaders in the 2025 Gartner Magic Quadrant for SIEM, and TechBag sells all six. Five of them are cloud-only, or cloud-only where the analytics actually run. So for the Indian buyer whose regulator, contract or security posture requires the platform on infrastructure they control, most of that quadrant is not an expensive option — it is not an option. Gurucul is the exception, and it is Gartner’s own report text rather than a sales deck that says so: Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted— which is what lets you hold 180 days of logs inside Indian jurisdiction on hardware you own, with a commercial vendor contractually behind it rather than a DIY open-source stack. That is the entire case for this page. Everything else — the UEBA heritage, the Pune engineering, the founder still running the company — is supporting evidence.
One platform, not four acquisitions
REVEAL puts SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model. Gurucul built the analytics first, so behaviour is not a separately licensed add-on.
Self-hosted, and that is the whole India argument
Gartner says Gurucul Next-Gen SIEM runs as SaaS, cloud or self-hosted; other 2025 Leaders are cloud-only, at the analytics control plane at least. That decides regulated Indian shortlists.
Behavioural detection as the foundation
A stolen credential signs in correctly and breaks no rule. Baselining each user and entity and scoring deviation catches it, and Gurucul has built that since 2010 rather than buying it.
Pricing that can decouple from data volume
Gartner lists per-asset, per-user, enterprise, module, data-volume/EPS and platform pricing. Per-asset and per-user break the log-more-pay-more link, but per-GB exists too: check yours.
Bootstrapped, for better and worse
Fifteen years without a venture round: no investor push toward a licence change or forced exit, but also a sub-$100M boutique facing Microsoft, Google and Cisco. Weigh vendor viability.
Start with the deployment question — SaaS, your cloud or your own hardware — then decide which of the SIEM, UEBA, Open XDR and identity analytics you need on top.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader, 2025
First year as a Leader, promoted from Visionary
Visionary, 2022–2024
Three consecutive years before the promotion
4.9 out of 5
109 reviews — highest rating of the major SIEMs
Overall Leader, I-SIEM
2024 Leadership Compass — note the year
SaaS, cloud or self-hosted
Confirmed in Gartner's own MQ text
Pune engineering since 2013
Gurucul Solutions Pvt Ltd, incorporated June 2013
Absent
Not evaluated in Security Analytics Platforms
Bootstrapped since 2010
No venture rounds — no war chest either
The company in six figures
See the platform, hear the pitch
Gurucul REVEAL — Security Analytics Platform Overview
The platform, presented by Gurucul.
Next-Gen SIEM Overview
The SIEM the 2025 MQ evaluated.
The Gurucul REVEAL Platform: How it Works
How the converged platform fits together.
Where Gurucul sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Gurucul Across Its Platform
Each dot is a Gurucul product: competitive position vs category momentum.
2025 MQ Leader, and self-hostable.
The Standing × Deployment Map
Analyst standing against where the platform may run — the pair that decides a regulated Indian shortlist.
The only 2025 Leader we sell that self-hosts.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Gurucul?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is forcing the decision?
2. What does your threat model centre on?
3. Where must the platform run?
What being a 2025 MQ Leader actually means
Gurucul's first year as a Leader after three as a Visionary — and why the marketing you will read elsewhere is out of date.
Read →Self-hosting and CERT-In's 180 days
Why the deployment model, not the quadrant, is the fact that decides a regulated Indian shortlist.
Read →Why UEBA-first is different from UEBA-added
Gurucul built analytics first and a SIEM around it. Most competitors did the reverse, and the seams show.
Read →Per-asset, per-user or per-GB
Gurucul offers all three. Which axis your contract lands on is the question that decides your bill.
Read →Gurucul against the other five Leaders
The honest matrix — where a boutique beats Microsoft and Google, and where it plainly does not.
Read →What to confirm in writing before you sign
Air-gap support, the pricing axis, and India data-region status: three answers to get on paper.
Read →The acronym decoder
Every term on these pages, in one place- REVEAL
- Gurucul’s platform: SIEM, UEBA, identity analytics, network traffic analysis and SOAR on one data model.
- UEBA
- User and Entity Behaviour Analytics: baselines normal behaviour and scores deviation to catch attacks breaking no rule.
- Identity Access Analytics
- Scoring entitlements and access for risk: excess privilege, dormant access, accumulated permissions.
- Open XDR
- Detection and response across security tools you already own, without the vendor’s agent everywhere.
- Self-hosted
- Runs on infrastructure you control; Gartner confirms it for Gurucul, so regulated Indian buyers can shortlist it.
- Leader (Gartner MQ)
- Gartner’s top-right quadrant for execution and vision; Gurucul entered it in 2025. Not the same as being included.
- Visionary
- Strong vision, less proven execution: Gurucul’s position for three years before 2025, still on parts of its site.
- Peer group
- The cohort a user is compared with; its quality depends on your identity data, so directory hygiene comes first.
- EPS
- Events per second — one of the axes Gurucul can meter on, alongside per-asset, per-user and data volume.
- CERT-In Directions
- India's 2022 rules requiring six-hour incident reporting and 180 days of ICT logs maintained within Indian jurisdiction.
- SEBI CSCRF
- SEBI’s Cybersecurity and Cyber Resilience Framework, which Gurucul maps to in India-specific content.
- Bootstrapped
- Funded from revenue, not venture capital; Gurucul has raised no institutional rounds in fifteen years.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Establish the deployment mandate first
Write down whether a regulator, contract or your posture requires infrastructure you control. If so, most 2025 Leaders drop out, which is why Gurucul is listed.
Get the air-gap answer in writing
Self-hosted is Gartner-confirmed; full air-gap is marketed but unverified. Need disconnected operation? Make it a written pre-condition, obtained with the quote.
Settle which pricing axis your quote uses
Gurucul meters per asset, user, module, data volume or EPS. Per-asset and per-user avoid paying more to log more, but confirm the axis on the order form.
Ask about India data residency explicitly
The India answer is self-hosting; we found no vendor-run India region. If you want vendor-hosted SaaS in India, get a written answer before evaluating features.
Prepare your identity data before the UEBA lands
UEBA is bounded by directory quality: stale peer groups mean little, and service accounts need named owners before baselines. This pays off whichever vendor wins.
Weigh vendor scale honestly
A bootstrapped boutique facing Microsoft, Google and Cisco has no investor pressure toward a forced exit, and no war chest. Decide deliberately; revisit at renewal.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Next-Gen SIEM | Quote-only — per asset, per user, per module, by data volume or by EPS | Confirm which axis your order form actually uses | Per-asset or per-user, if offered |
| UEBA | Quote-only — on REVEAL, or as an overlay on a SIEM you keep | Standalone or with the SIEM — confirm packaging | Threat models: credentials, insiders |
| Open XDR | Quote-only, on REVEAL — confirm standalone or module | Ingests the tools you already own | Estates with tools they cannot replace |
| Identity Analytics | Quote-only, on REVEAL — confirm standalone or module | Shares one identity model with the SIEM | Access-review evidence for RBI and SEBI |
Quote-only. Gartner records per-asset, per-user, module, data-volume, EPS and platform-based options, so the axis on your order form is negotiated rather than fixed. The cost that surprises is identity-data preparation, not the licence. TechBag gets the axis in writing and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Quoting the Visionary marketing instead of the Leader fact
Parts of Gurucul’s site still say “Most Visionary, three consecutive years”, true for 2022 to 2024. Cite the 2025 Leader position, and note it is the first year, not years of leadership.
Assuming self-hosted means air-gapped
Self-hosted (Gartner-confirmed) runs on your infrastructure; air-gapped means no internet path, affecting activation, threat intel and support. Make unverified air-gap support a written pre-condition.
Expecting the pricing model to be per-asset by default
Gurucul can price per asset or per user, but Gartner records data-volume and EPS options too. Which you get is negotiated, so check the order form rather than assuming the better model.
Deploying UEBA onto an unmaintained directory
UEBA built on a stale directory produces confident nonsense, and unowned service accounts raise alerts nobody can judge. Budget identity hygiene before deployment, not after the noise.
Skipping the vendor-scale conversation
A bootstrapped sub-$100M vendor against Microsoft and Google is a valid choice, but decide it explicitly. Ask about roadmap funding, India support scale and renewal terms now.
The evaluation kit
Each product page carries a 10-question vendor checklist and a cost model:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Growth rates are TechBag’s reading of public analyst forecasts, not audited figures. Identity threat detection is the fastest line — which is where Gurucul’s UEBA and identity analytics compete.
Data sovereignty deciding Indian shortlists
CERT-In log localisation, RBI outsourcing rules and DPDP increasingly settle Indian deals before features are compared.
What it means for you
Without a self-hosted path or India region, vendors lose regulated buyers, whatever their quadrant.
Identity as the primary attack surface
Stolen credentials and insider misuse now account for a large share of real breaches, and neither breaks a detection rule.
What it means for you
Behavioural analytics becomes the layer that catches the incident, not a premium add-on.
SIEM and UEBA converging into one purchase
Buyers increasingly refuse to license behavioural analytics separately from the platform holding the data.
What it means for you
This favours vendors that built one data model rather than acquiring their way to a suite.
Agentic AI in the SOC workflow
AI-assisted triage and investigation summarisation are shipping across the category, Gurucul included.
What it means for you
Treat vendor productivity stats as unaudited; never buy a platform for its AI layer.
Consolidation pressure on mid-market security spend
Indian teams are cutting vendor counts, preferring one platform with adequate coverage over four tools they cannot staff.
What it means for you
Converged platforms win, but only where the convergence is real rather than a shared login page.
Boutique vendors under platform-vendor pressure
Microsoft, Google and Cisco bundle SIEM into estates buyers already own, squeezing independent specialists.
What it means for you
Specialists survive on depth and deployment flexibility, the two things Gurucul competes on.
Questions buyers ask about Gurucul
Ready to shortlist Gurucul?
Open any of the four product pages for the deep dive, or let a TechBag advisor build the case with you — deployment scoping, the pricing axis in writing, honest comparisons, rollout, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.