"Even if SIFT were to cost tens of thousands of dollars, it would still be a very competitive product," says Alan Paller, director of research at SANS. "At no cost, there is no reason it should not be part of the portfolio in every organization that has skilled incident responders."