---
title: "Wazuh pricing 2026: free license, Cloud from $571/month"
description: "Wazuh has no license fee. Wazuh Cloud starts at $571 a month for 100 agents. What self-hosting costs on 1 to 10 Linux servers: hardware, hours, support."
source: "https://wardio.net/guides/wazuh-cost/"
---

**Security**

# Wazuh pricing: a free licence and the cost of running it

You run a few Linux servers, you have read that Wazuh is free, and you want to know what it will cost before you give it a weekend. The licence costs nothing. The server it runs on and the hours to keep it useful do.

By David Kabel · Updated 2026-09-23 · 11 min read

**The short answer**

Wazuh has no licence fee. The manager and agent are GPLv2, and the indexer and dashboard are Apache 2.0. You pay for running it. Self-hosted, the official quickstart asks for a server with 4 vCPU, 8 GiB RAM and 50 GB of disk for up to 25 agents, plus someone's time for tuning, upgrades, retention and backups. Wazuh Cloud publishes prices from $571 a month for up to 100 agents. Professional support has two plans and no public price.

## Licence terms for each component

The `wazuh/wazuh` repository, which holds the manager and the agent, is licensed under the GNU General Public License version 2, with an added permission to link against OpenSSL. The indexer and dashboard repositories are under the Apache License 2.0. Wazuh's own site describes the platform as having *no license cost* and free community support. You do not need to buy anything from Wazuh to run it, whatever the number of servers.

GPLv2 conditions attach to copying, distributing and modifying the code. The licence text in the repository says that *the act of running the Program is not restricted*. The cost behind "wazuh pricing" is therefore the hardware and the hours, or what someone else charges to take both on.

## Wazuh Cloud: the one way to run it with a price list

Wazuh Cloud is the hosted version, run by Wazuh on AWS, and it is the only way of running Wazuh that comes with public prices. As listed on wazuh.com on 23 September 2026, with retention and capacity figures from the Cloud documentation:

| Profile | Active agents | Indexed / archive retention | Indexed capacity | Listed price |
| --- | --- | --- | --- | --- |
| Small | Up to 100 | 1 month / 3 months | 25 GB | from $571 a month |
| Medium | Up to 250 | 3 months / 1 year | 250 GB | from $923 a month |
| Large | Up to 500 | 3 months / 1 year | 500 GB | from $1,467 a month |

All three profiles include the Standard support plan. Billing is by card, monthly or annual. Upgrading a setting is charged pro rata straight away, downgrades apply from the next cycle, and charges are non-refundable, though you can cancel at any time and keep the environment until the cycle ends. The trial runs 14 days without a card. You pick the AWS region that holds your data. If GDPR applies to you, choose it on purpose.

For one to ten servers, the problem is that the smallest published profile is sized for up to 100 agents. A Custom environment exists, but the public page gives it no price. The only honest figure for a five-server business is therefore "from $571 a month, or ask".

Cloud takes the infrastructure work off you and leaves the security work with you. Wazuh's shared-responsibility table puts deploying and configuring agents, writing custom rules and alerting policies, managing user access and responding to incidents on the customer's side.

## Professional support: two plans, no public price

For self-hosted installations Wazuh sells professional support. Neither plan has a published price; the page ends in a request form.

| Feature | Standard | Premium |
| --- | --- | --- |
| Support hours | 8/5, business hours | 24/7 for critical issues |
| Response SLA | 8 hours | 4 hours |
| Health checks | 2 per year | 4 per year |
| Priority escalation | Normal | High |

The same page lists architecture guidance, health checks and upgrades, custom rules and dashboards, and a dedicated customer success manager as part of the service. Price-comparison sites publish figures for Wazuh contracts. Those are third-party estimates, not Wazuh prices, and I have not used them here.

Training is the exception. Wazuh lists its public courses at $1,800 per seat for Essential and $2,200 per seat for Advanced, each four days, live and online. Consulting work is quoted as a fixed price against a statement of work.

## Self-hosting: what the server needs

The quickstart installs all three central components, the server, the indexer and the dashboard, on one host. The Wazuh 4.14 documentation says this is usually enough for up to 100 endpoints and 90 days of indexed alerts, and recommends:

| Agents | CPU | RAM | Storage (90 days) |
| --- | --- | --- | --- |
| 1 to 25 | 4 vCPU | 8 GiB | 50 GB |
| 26 to 50 | 8 vCPU | 8 GiB | 100 GB |
| 51 to 100 | 8 vCPU | 8 GiB | 200 GB |

One to ten servers puts you in the first row. The indexer installation page shows the arithmetic: a monitored server is estimated at 0.25 alerts per second, about 3.7 GB of indexer storage per agent over 90 days. Ten servers is roughly 37 GB for 90 days. These are estimates keyed to alert rate, so a server that logs heavily will use more.

The 4.14 quickstart recommends Amazon Linux, CentOS Stream 10, RHEL 7 to 10 and Ubuntu 16.04 to 24.04 for the central components, and Debian is not on that list. In my view the Wazuh server belongs on its own VM. Run the manager on one of the machines it watches and whoever takes over that machine also holds the record of what they did.

The documentation's test for whether the server keeps up is two counters that should stay at zero. If either climbs, the server is dropping events or discarding agent messages:

```
sudo grep -E 'events_dropped|discarded_count' \
  /var/ossec/var/run/wazuh-analysisd.state \
  /var/ossec/var/run/wazuh-remoted.state
```

## Self-hosting: the hours, which are the real bill

The VM is one line on your hosting invoice. The recurring cost is the time spent on the jobs below. I will not put an hour figure on them. It depends on how noisy your servers are and how often you change them, and any number here would be invented.

1.  **Tuning rules until alerts mean something**:  Wazuh cannot know that your deploys, cron jobs and backup runs are normal. Tuning means copying rules into `/var/ossec/etc/rules/` and marking them `overwrite="yes"`, because the documentation warns that an upgrade overwrites edits to files in `/var/ossec/ruleset/rules`. An untuned install produces alerts nobody reads, as the [file integrity monitoring guide](/guides/file-integrity-monitoring/) explains.
2.  **Upgrading in the right order**:  All central components must run identical versions, down to the patch level, and the manager must be the same version as the agents or newer. Every release means indexer, server and dashboard together, then agents. Since 4.12.0 the indexer cannot go back to 4.11 or earlier without a fresh install, so take the backup before the upgrade.
3.  **Setting retention yourself**:  The hardware table assumes 90 days of alerts. Holding the indexer to that is an Index State Management policy you create; the documentation walks through one that deletes `wazuh-alerts-*` indices past a set age. Its template covers new indices, and you attach existing ones by hand.
4.  **Looking after certificates**:  The components trust each other through a root CA generated at install. Each node certificate must include that node's IP address or DNS name, and the documentation tells you to keep the root CA, because it signs the other components' certificates. Change an address or add a node and you are issuing certificates. The dashboard's certificate is not from a trusted authority until you replace it.
5.  **Backing up the manager**:  Wazuh's backup guide lists what to copy: `ossec.conf`, your local rules and decoders, `client.keys`, the indexer and dashboard certificates and configuration, and the manager's databases, copied with the manager stopped. `client.keys` holds the unique key the manager generated for each enrolled agent. The same rule applies as for any backup: [it only counts once you have restored it](/guides/backups-that-restore/).

Whichever option you choose, reading what Wazuh finds and acting on it stays your job. Wazuh Cloud leaves incident response with you. The professional support plans describe tickets, health checks, upgrades and custom rules, and nothing in them describes someone watching your alerts.

## Self-host, Wazuh Cloud or managed, side by side

| Cost or task | Self-host | Wazuh Cloud | Managed service |
| --- | --- | --- | --- |
| Paid to Wazuh | Nothing | From $571 a month (Small, up to 100 agents) | Nothing directly; you pay the provider |
| Central components | Your VM: 4 vCPU, 8 GiB, 50 GB for up to 25 agents | Hosted by Wazuh on AWS | The provider's job |
| Upgrades | You | Wazuh | The provider |
| Agents on your servers | You | You | The provider |
| Rule tuning | You | You | The provider |
| Reading alerts | You | You | The provider; check which response times are contractual |
| Price known in advance | Hardware yes, hours no | Yes, for the three listed profiles | Depends on the provider. Wardio includes Wazuh in the [per-machine price](/pricing/), with no licence line |

The last column is not a like-for-like price comparison. Wardio's per-machine fee, for example, also covers patching, backups and monitoring, so set a managed price against everything you would otherwise do yourself, not against the Wazuh Cloud line alone. In Wardio's case, a guaranteed out-of-hours response time is a separate agreement, as the pricing page says.

For one to ten servers, if someone on your staff will read the alerts every week and do the upgrades, self-hosting on a small dedicated VM is in my view the cheapest route in cash. Wazuh Cloud suits a team that will read alerts but does not want to run an indexer, and accepts paying for a profile sized for more agents than it has. If nobody will read the alerts, neither of those fixes it, because both leave the reading to you. A managed service covers that gap. If Wazuh is on your list because PCI DSS asks for file integrity monitoring and log retention, [the compliance page](/compliance/) maps which control answers which requirement.

## Gotchas

-   **A copied rule without overwrite="yes" is ignored.** We copied rule 550 into `local_rules.xml` at level 10. Without the attribute the manager started normally, logged warning 7612, "Rule ID '550' is duplicated. Only the first occurrence will be considered.", and the next file change still alerted at level 7. With `overwrite="yes"` the same change alerted at level 10. After every rule edit, search `ossec.log` for 7612 and trigger a test event.
-   **An agent newer than the manager is turned away.** Our 4.14.8 manager answered an enrolment request from an agent reporting 4.15.0 with "Agent version must be lower or equal to manager version. Unable to add agent". It accepted one reporting 4.14.9, so the check stops at the minor version and a patch mismatch is left to you. Upgrade the manager first, every time.
-   **Enrolment is open by default.** The default server configuration sets `use_password` to `no`. One line sent with `openssl s_client` to port 1515 enrolled a made-up agent and returned its key; nothing asked for a password or a licence key. Allow port 1515 only from your own servers or require a password as the enrolment documentation describes, and remove strays with `manage_agents -r`.
-   **The health counters need root.** On our manager `/var/ossec` was mode 0750, owned by root and the wazuh group, which is why the check above uses `sudo`. Run as an ordinary user, grep printed "Permission denied" for both files and exited 2 instead of showing a zero. The same command run with the wazuh group worked, so give a monitoring script that group rather than root.

**How this was tested.** On 23 September 2026 we ran the Wazuh 4.14.8 manager from the official Docker image, `wazuh/wazuh-manager:4.14.8` on Amazon Linux 2023, and installed the wazuh-agent 4.14.8-1 package from packages.wazuh.com on Debian 13, in Docker on an Ubuntu 24.04 host. We enrolled the agent, tuned a rule, ran the state-file check above and generated certificates with the 4.14 `wazuh-certs-tool.sh`. Nothing asked for a licence key; the agent package's copyright file states GPL version 2 and the manager package's metadata says GPL. With one agent and no indexer or dashboard, the manager container used about 560 MiB of memory at idle, which says nothing about the sizing table. Not tested: the indexer and dashboard, so neither the quickstart sizing, retention policies nor the 4.12 downgrade limit; a real upgrade; backups and restores; Wazuh Cloud, support and training, whose prices and terms come from the Wazuh pages below, with the Cloud prices re-checked on 23 September 2026.

## Sources

1.  [Wazuh Cloud](https://wazuh.com/cloud/), Wazuh Inc., prices checked 23 September 2026
2.  [Sign up for a trial (profile settings)](https://documentation.wazuh.com/current/cloud-service/getting-started/sign-up-trial.html), Wazuh documentation 4.14
3.  [Wazuh Cloud settings](https://documentation.wazuh.com/current/cloud-service/your-environment/settings.html), Wazuh documentation 4.14
4.  [Wazuh Cloud billing FAQ](https://documentation.wazuh.com/current/cloud-service/account-billing/billing-faq.html), Wazuh documentation 4.14
5.  [Wazuh Cloud service FAQ](https://documentation.wazuh.com/current/cloud-service/getting-started/starting-faq.html), Wazuh documentation 4.14
6.  [Wazuh Cloud service (shared responsibility model)](https://documentation.wazuh.com/current/cloud-service/index.html), Wazuh documentation 4.14
7.  [Professional support](https://wazuh.com/services/professional-support/), Wazuh Inc., checked 23 September 2026
8.  [Training courses](https://wazuh.com/services/training-courses/), Wazuh Inc., checked 23 September 2026
9.  [Consulting services](https://wazuh.com/services/consulting-services/), Wazuh Inc., checked 23 September 2026
10.  [Wazuh home page](https://wazuh.com/), Wazuh Inc., checked 23 September 2026
11.  [wazuh/wazuh LICENSE (GPLv2)](https://github.com/wazuh/wazuh/blob/main/LICENSE), GitHub
12.  [wazuh/wazuh-indexer LICENSE (Apache 2.0)](https://github.com/wazuh/wazuh-indexer/blob/main/LICENSE.txt), GitHub
13.  [wazuh/wazuh-dashboard LICENSE (Apache 2.0)](https://github.com/wazuh/wazuh-dashboard/blob/main/LICENSE.txt), GitHub
14.  [Quickstart](https://documentation.wazuh.com/current/quickstart.html), Wazuh documentation 4.14
15.  [Wazuh indexer installation: requirements](https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html), Wazuh documentation 4.14
16.  [Wazuh server installation: requirements and scaling](https://documentation.wazuh.com/current/installation-guide/wazuh-server/index.html), Wazuh documentation 4.14
17.  [Upgrade guide: components compatibility](https://documentation.wazuh.com/current/upgrade-guide/index.html), Wazuh documentation 4.14
18.  [Upgrading the Wazuh central components](https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html), Wazuh documentation 4.14
19.  [Custom rules](https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html), Wazuh documentation 4.14
20.  [Index lifecycle management](https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html), Wazuh documentation 4.14
21.  [Certificates deployment](https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/certificate-deployment.html), Wazuh documentation 4.14
22.  [Backup guide: Wazuh central components](https://documentation.wazuh.com/current/migration-guide/creating/wazuh-central-components.html), Wazuh documentation 4.14
23.  [Wazuh agent enrollment](https://documentation.wazuh.com/current/user-manual/agent/agent-enrollment/index.html), Wazuh documentation 4.14

## Questions

### Is Wazuh free?

Yes. The Wazuh manager and agent are licensed under GPLv2 and the indexer and dashboard under Apache 2.0, and Wazuh describes the platform as having no license cost. You do not buy anything from Wazuh to run it on your own servers. You pay for the machine it runs on and the time to tune, upgrade and maintain it. The Wazuh 4.14 quickstart asks for 4 vCPU, 8 GiB RAM and 50 GB of disk for up to 25 agents.

### How much does Wazuh Cloud cost?

Wazuh lists three Cloud profiles: Small from $571 a month for up to 100 active agents with one month of indexed data, Medium from $923 a month for up to 250 agents, and Large from $1,467 a month for up to 500 agents, both with three months indexed. Standard support is included, billing is monthly or annual by card, and the trial lasts 14 days without a card. Custom environments have no public price.

### How much does Wazuh professional support cost?

Wazuh does not publish prices for professional support. There are two plans: Standard, with business-hours support, an 8-hour response SLA and two health checks a year, and Premium, with 24/7 cover for critical issues, a 4-hour response SLA and four health checks a year. Pricing comes through a request form. Figures on price-comparison sites are third-party estimates, not prices Wazuh has published.

### What hardware does a self-hosted Wazuh server need?

For an all-in-one install of the Wazuh server, indexer and dashboard, the Wazuh 4.14 quickstart recommends 4 vCPU, 8 GiB RAM and 50 GB of storage for 1 to 25 agents, 8 vCPU and 100 GB for 26 to 50, and 8 vCPU and 200 GB for 51 to 100, all sized for 90 days of indexed alerts. The indexer documentation estimates 3.7 GB per monitored server for every 90 days.

### Does Wazuh Cloud remove the work of running Wazuh?

It removes the infrastructure work, because Wazuh hosts, upgrades and scales the central components. It does not remove the security work. Wazuh's own shared-responsibility model leaves deploying and configuring agents, writing custom rules and alerting policies, managing user access and responding to incidents with the customer. If nobody in your business will read the alerts, moving to Wazuh Cloud does not change that.

**Would rather not be the person reading the alerts?**

A free review looks at what your servers would detect today and what running Wazuh on them would involve. [See what the managed option costs](/pricing/).

[Free server review](/contact/)